Scan live hosts against a library of vulnerability templates

nuclei tests targets against a large library of community and custom templates, each describing one check in a simple YAML DSL. Because the logic lives in templates rather than code, coverage grows with the community and you can write checks for your own findings in minutes. It is fast, low on false positives, and built to run at scale.

On Trickest it is the testing stage of a recon-to-results pipeline. Point it at live hosts from httpx, filter by tags or severity to keep runs focused, and emit JSONL so every finding becomes a row you can triage, route, or alert on. Run targeted template sets per workflow rather than everything at once.

With 160 inputs, nuclei covers protocol selection, rate limiting, proxying, and headless browser checks, so one node fits both a quick severity sweep and a deep, scoped scan. Scheduled behind discovery, it turns continuous recon into continuous testing.