# Write a Nuclei template to detect a known vulnerability

A working, low-false-positive Nuclei YAML template for detecting a specific vulnerability on systems you're authorized to test.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Coding, Write, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/write-a-nuclei-template-to-detect-a-known-vulnerability

## Prompt

```text
Write a Nuclei (ProjectDiscovery) YAML template that detects a specific known vulnerability or misconfiguration. I will only run it against systems I own or am authorized to test.

**Vulnerability:** [CVE ID or description]
**Affected product and versions:** [DETAILS]
**Advisory or reference details:** [paste the advisory text: vulnerable endpoint, parameter, request, and how a vulnerable response differs]
**Protocol:** [http / dns / tcp / ssl / file]
**Severity:** [info / low / medium / high / critical]

Requirements:
- Valid template structure: id (lowercase, hyphenated), info block (name, author placeholder [AUTHOR], severity, description, reference links I provided, classification with CVE/CWE if known, tags), and the request block.
- Detection only: use safe, non-destructive requests. No payloads that change data, create accounts, or execute commands beyond a harmless proof (e.g. reflected marker or version string).
- Minimize false positives: combine matchers with matchers-condition: and (e.g. status code + a unique response word or regex + content type), and avoid matching on generic strings.
- Use extractors to capture the version or evidence when possible.
- Use {{BaseURL}} and variables rather than hard-coded hosts.
- Only use details from the advisory I gave. If the vulnerable path or response signature is unclear, mark it [CONFIRM FROM ADVISORY] rather than guessing.

Return:
1. The template in a YAML code block.
2. How to validate it (nuclei -validate, then run against a known vulnerable and a patched test instance).
3. Likely false-positive and false-negative cases.
```

## What to fill in

- CVE ID or description
- DETAILS
- http / dns / tcp / ssl / file
- info / low / medium / high / critical
- AUTHOR
- BaseURL
- CONFIRM FROM ADVISORY

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.