How does jaeles decide what counts as a finding?

Each signature pairs one request with a detection condition. When the response matches, jaeles records the target and writes it into the results folder.

Can jaeles scan authenticated pages?

Yes. Export a raw request from Burp and pass it with --raw so signatures replay real authenticated traffic. --ba treats that raw input as {{.BaseURL}} for the signature set.

How is jaeles different from nuclei?

Both run declarative detection rules. nuclei ships a large community template library; jaeles centers on custom signatures and Burp --raw replay. Many workflows run both.

How do I control which signatures run?

Select with --signs and drop with --exclude (both accept multiple selectors). --level filters by signature level. --passive adds passive detections on top of the active set.

Updated Jul 14, 2026

Scanners

Run custom signatures against live web targets

Signature-driven web application scanner.

Run custom signatures against a target Replay authenticated Burp requests Scan a large surface in chunks

overview

What jaeles does

jaeles fires a selected signature set at each target and records matches. Each signature is one request plus one detection condition, so you swap rules per engagement without rewriting the engine.

Reach for it when you have live URLs or a Burp --raw export and a curated --signs selector. Use --exclude and --level to trim the set; --json and --html write structured findings and a report folder.

Trickest provides jaeles as a managed Scanners node. Targets in, findings folder out. Chain after httpx or a crawler. Prefer nuclei when you want a large community template library instead of your own signatures.

source github.com/jaeles-project/jaeles

use cases

Where jaeles fits

Run custom signatures against a target

Select a signature set with the --signs selector and scan a URL or URL file so each rule sends its request and reports the matches as findings.

Replay authenticated Burp requests

Feed a raw request exported from Burp with --raw so jaeles tests real, authenticated traffic against your signatures instead of an unauthenticated guess.

Scan a large surface in chunks

Enable chunk mode on a big URL list so jaeles splits the input with --chunk and runs signatures in batches without overloading one pass.

Produce a report for the writeup

Store output as JSON and generate an HTML report so findings land in a shareable artifact alongside the rest of the workflow results.

reference

jaeles inputs and flags

50 inputs

Name	Type	Flag	Description
url	STRING	--url	URL of the target to scan.
urls	FILE	--urls	File of target URLs for bulk scanning.
raw	FILE	--raw	Raw request exported from Burp, used as the origin request.
signatures	STRING	--signs	Signature selector for the rules to run. Multiple selectors are accepted.
exclude	STRING	--exclude	Exclude a signature selector. Multiple flags are accepted.
level	STRING	--level	Filter signatures by level so only rules at or above the threshold run (default 1).
json	BOOLEAN	--json	Store output as JSON.
html	BOOLEAN	--html	Generate an HTML report after the scan finishes.

Showing key inputs. jaeles exposes 50 inputs in total.

Full flag reference (50 inputs)

Name	Type	Flag	Description
raw	FILE	--raw	Raw request from Burp for origin
url	STRING	--url	URL of target
html	BOOLEAN	--html	Generate an HTML report after the scan finishes
json	BOOLEAN	--json	Store output as JSON
urls	FILE	--urls	URLs file of target
chunk	BOOLEAN	--chunk	Enable chunk running against big input
debug	BOOLEAN	--debug	Enable debug output
delay	STRING	--delay	Delay time between requests
found	STRING	--found	Run a host OS command when a vulnerability is found
level	STRING	--level	Filter signature by level (default 1)
local	BOOLEAN	--local	Enable local analyze (accept input as a local path)
no-db	BOOLEAN	--no-db	Disable the database
proxy	STRING	--proxy	HTTP proxy to route requests through
quiet	BOOLEAN	--quiet	Quiet output
retry	STRING	--retry	HTTP retry count
title	STRING	--title	Report title name
config	FILE	--config	Config file (default is $HOME/.jaeles/config.yaml)
inline	STRING	--inline	Inline detections
params	STRING	--params	Custom params -p='foo=bar' (multiple -p flags are accepted)
report	STRING	--report	Report name
scanID	STRING	--scanID	Scan ID
single	BOOLEAN	--single	Disable parallel mode (use this when a signature needs single-threaded logic)
exclude	STRING	--exclude	Exclude signature selector (multiple flags are accepted)
headers	STRING	--headers	Custom headers (e.g: -H 'Referer: {{.BaseURL}}') (multiple flags are accepted)
passive	BOOLEAN	--passive	Turn on passive detections
refresh	STRING	--refresh	Refresh time for background task (default 10)
rootDir	FOLDER	--rootDir	Root project (default "~/.jaeles/")
signDir	FOLDER	--signDir	Folder containing default signatures (default "~/.jaeles/base-signatures/")
threads	STRING	--threads	Set the concurrency level inside a single signature (default 10)
timeout	STRING	--timeout	HTTP timeout (default 20)
verbose	BOOLEAN	--verbose	Verbose output
base-url	BOOLEAN	--ba	Shortcut to take raw input as {{.BaseURL}}
save-raw	BOOLEAN	--save-raw	Save the raw request
chunk-dir	STRING	--chunk-dir	Temp directory to store the chunk directory
no-output	BOOLEAN	--no-output	Do not store output
chunk-size	STRING	--chunk-size	Chunk size (default 20000)
signatures	STRING	--signs	Signature selector (multiple -s flags are accepted)
always-true	BOOLEAN	--at	Enable Always True detection to observe the response
chunk-limit	STRING	--chunk-limit	Limit size to trigger a chunk run (default 200000)
concurrency	STRING	--concurrency	Set the concurrency level (default 20)
local-proxy	BOOLEAN	--lc	Shortcut for '--proxy http://127.0.0.1:8080'
quietFormat	STRING	--quietFormat	Format for quiet output (default "{{.VulnURL}}")
format-input	BOOLEAN	--format-input	Enable special input format
selectorFile	FILE	--selectorFile	Signature selector from a file
chunk-threads	STRING	--chunk-threads	Number of chunk threads (default 2)
no-background	BOOLEAN	--no-background	Do not run background task (default true)
store-verbose	BOOLEAN	--sverbose	Store verbose info in the summary file
filtering-mode	BOOLEAN	--fi	Enable filtering mode (to use Diff() detection)
passive-selector	STRING	--sp	Selector for passive detections (default "*")
disable-replicate-request	BOOLEAN	--dr	Shortcut to disable replicate request (avoid sending many requests to timeout)

example

Run jaeles

jaeles · command

# run custom signatures against live URLs, store JSON and an HTML reportjaeles scan --urls live-urls.txt --signs 'common/.*' --level 2 --json --html

sample output

[*] Loaded 1042 signatures[*] Start scanning 37 URLs from live-urls.txt[High][GET] Spring Boot Actuator env exposure - https://api.example.com/actuator/env[Medium][GET] Open Redirect - https://app.example.com/out?url=//198.51.100.24[Low][GET] Exposed .git directory - https://staging.example.com/.git/config[*] Done. 3 findings written to jaeles-report/[*] HTML report: jaeles-report/index.html

guidance

Choosing jaeles

Use jaeles when live hosts need a curated custom-signature pass, especially with --raw Burp replay for authenticated flows. It tests; it does not discover. Feed httpx or crawler output first. For broader community templates, nuclei is the usual peer.

nuclei

Template-driven scanner with a large community library. jaeles centers on custom signatures and Burp --raw replay.

nikto

Classic web server scanner with fixed checks. jaeles is signature-driven and easier to extend per engagement.

wapiti

Black-box crawler that injects as it walks. jaeles runs your chosen detection rules against known targets.

faq

jaeles questions

Point --url at the target and --signs at a selector (for example common/.*). On Trickest, set the url and signatures inputs on the node instead of typing the CLI flags.

Run jaeles yourself

A URL list is probed by httpx, then jaeles runs its signatures against the live hosts and writes the findings folder for triage.

Run jaeles in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url

STRING

--url

URL of the target to scan.

urls

FILE

--urls

File of target URLs for bulk scanning.

raw

FILE

--raw

Raw request exported from Burp, used as the origin request.

signatures

STRING

--signs

Signature selector for the rules to run. Multiple selectors are accepted.

exclude

STRING

--exclude

Exclude a signature selector. Multiple flags are accepted.

level

STRING

--level

Filter signatures by level so only rules at or above the threshold run (default 1).

json

BOOLEAN

--json

Store output as JSON.

html

BOOLEAN

--html

Generate an HTML report after the scan finishes.

Name

Type

Flag

Description

raw

FILE

--raw

Raw request from Burp for origin

url

STRING

--url

URL of target

html

BOOLEAN

--html

Generate an HTML report after the scan finishes

json

BOOLEAN

--json

Store output as JSON

urls

FILE

--urls

URLs file of target

chunk

BOOLEAN

--chunk

Enable chunk running against big input

debug

BOOLEAN

--debug

Enable debug output

delay

STRING

--delay

Delay time between requests

found

STRING

--found

Run a host OS command when a vulnerability is found

level

STRING

--level

Filter signature by level (default 1)

local

BOOLEAN

--local

Enable local analyze (accept input as a local path)

no-db

BOOLEAN

--no-db

Disable the database

proxy

STRING

--proxy

HTTP proxy to route requests through

quiet

BOOLEAN

--quiet

Quiet output

retry

STRING

--retry

HTTP retry count

title

STRING

--title

Report title name

config

FILE

--config

Config file (default is $HOME/.jaeles/config.yaml)

inline

STRING

--inline

Inline detections

params

STRING

--params

Custom params -p='foo=bar' (multiple -p flags are accepted)

report

STRING

--report

Report name

scanID

STRING

--scanID

Scan ID

single

BOOLEAN

--single

Disable parallel mode (use this when a signature needs single-threaded logic)

exclude

STRING

--exclude

Exclude signature selector (multiple flags are accepted)

headers

STRING

--headers

Custom headers (e.g: -H 'Referer: {{.BaseURL}}') (multiple flags are accepted)

passive

BOOLEAN

--passive

Turn on passive detections

refresh

STRING

--refresh

Refresh time for background task (default 10)

rootDir

FOLDER

--rootDir

Root project (default "~/.jaeles/")

signDir

FOLDER

--signDir

Folder containing default signatures (default "~/.jaeles/base-signatures/")

threads

STRING

--threads

Set the concurrency level inside a single signature (default 10)

timeout

STRING

--timeout

HTTP timeout (default 20)

verbose

BOOLEAN

--verbose

Verbose output

base-url

BOOLEAN

--ba

Shortcut to take raw input as {{.BaseURL}}

save-raw

BOOLEAN

--save-raw

Save the raw request

chunk-dir

STRING

--chunk-dir

Temp directory to store the chunk directory

no-output

BOOLEAN

--no-output

Do not store output

chunk-size

STRING

--chunk-size

Chunk size (default 20000)

signatures

STRING

--signs

Signature selector (multiple -s flags are accepted)

always-true

BOOLEAN

--at

Enable Always True detection to observe the response

chunk-limit

STRING

--chunk-limit

Limit size to trigger a chunk run (default 200000)

concurrency

STRING

--concurrency

Set the concurrency level (default 20)

local-proxy

BOOLEAN

--lc

Shortcut for '--proxy http://127.0.0.1:8080'

quietFormat

STRING

--quietFormat

Format for quiet output (default "{{.VulnURL}}")

format-input

BOOLEAN

--format-input

Enable special input format

selectorFile

FILE

--selectorFile

Signature selector from a file

chunk-threads

STRING

--chunk-threads

Number of chunk threads (default 2)

no-background

BOOLEAN

--no-background

Do not run background task (default true)

store-verbose

BOOLEAN

--sverbose

Store verbose info in the summary file

filtering-mode

BOOLEAN

--fi

Enable filtering mode (to use Diff() detection)

passive-selector

STRING

--sp

Selector for passive detections (default "*")

disable-replicate-request

BOOLEAN

--dr

Shortcut to disable replicate request (avoid sending many requests to timeout)

[*] Loaded 1042 signatures[*] Start scanning 37 URLs from live-urls.txt[High][GET] Spring Boot Actuator env exposure - https://api.example.com/actuator/env[Medium][GET] Open Redirect - https://app.example.com/out?url=//198.51.100.24[Low][GET] Exposed .git directory - https://staging.example.com/.git/config[*] Done. 3 findings written to jaeles-report/[*] HTML report: jaeles-report/index.html

Run custom signatures against live web targets

What jaeles does

Where jaeles fits

Run custom signatures against a target

Replay authenticated Burp requests

Scan a large surface in chunks

Produce a report for the writeup

jaeles inputs and flags

Run jaeles

Choosing jaeles

nuclei

nikto

wapiti

jaeles questions

More Scanners tools

airixss

cmseek

joomscan

nikto

nomore403

nuclei

Run jaeles yourself

Run custom signatures against live web targets

What jaeles does

Where jaeles fits

Run custom signatures against a target

Replay authenticated Burp requests

Scan a large surface in chunks

Produce a report for the writeup

jaeles inputs and flags

Run jaeles

Choosing jaeles

nuclei

nikto

wapiti

jaeles questions

More Scanners tools

airixss

cmseek

joomscan

nikto

nomore403

nuclei

Run jaeles yourself