Write a Nuclei template to detect a known vulnerability
A working, low-false-positive Nuclei YAML template for detecting a specific vulnerability on systems you're authorized to test.
The prompt
Write a Nuclei (ProjectDiscovery) YAML template that detects a specific known vulnerability or misconfiguration. I will only run it against systems I own or am authorized to test.
Vulnerability: [CVE ID or description]
Affected product and versions: [DETAILS]
Advisory or reference details: [paste the advisory text: vulnerable endpoint, parameter, request, and how a vulnerable response differs]
Protocol: [http / dns / tcp / ssl / file]
Severity: [info / low / medium / high / critical]
Requirements:
- Valid template structure: id (lowercase, hyphenated), info block (name, author placeholder [AUTHOR], severity, description, reference links I provided, classification with CVE/CWE if known, tags), and the request block.
- Detection only: use safe, non-destructive requests. No payloads that change data, create accounts, or execute commands beyond a harmless proof (e.g. reflected marker or version string).
- Minimize false positives: combine matchers with matchers-condition: and (e.g. status code + a unique response word or regex + content type), and avoid matching on generic strings.
- Use extractors to capture the version or evidence when possible.
- Use {{BaseURL}} and variables rather than hard-coded hosts.
- Only use details from the advisory I gave. If the vulnerable path or response signature is unclear, mark it [CONFIRM FROM ADVISORY] rather than guessing.
Return:
1. The template in a YAML code block.
2. How to validate it (nuclei -validate, then run against a known vulnerable and a patched test instance).
3. Likely false-positive and false-negative cases.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- CVE ID or description
- DETAILS
- http / dns / tcp / ssl / file
- info / low / medium / high / critical
- AUTHOR
- BaseURL
- CONFIRM FROM ADVISORY
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Write precise TypeScript types for my data and APIsSafer, readable TypeScript types that rule out impossible states, replace unsafe casts, and come with compile-time tests.
- Write a style guide that documents my app's existing design codeReverse-engineers colors, typography, spacing, and component patterns from your codebase into a STYLE_GUIDE.md developers and AI agents can follow.
- Write a Semgrep rule to catch a risky code patternProduces a working Semgrep rule with test cases, so you can block a bug or security pattern across your codebase.
- Set up environment config and secrets across dev, staging, and productionA clean plan for environment variables, secrets handling, and Docker config so each environment works and nothing sensitive leaks.