Documentation / PAC Attacks

Custom Nuclei

Custom Nuclei Templates & Workflows

Run your own Nuclei templates and workflows alongside Prancer's built-in scans. If Nuclei can run it, PAC can orchestrate it.

Tip: use Nuclei when you want fast, signature-style checks (CVE matchers, header checks, exposed endpoints). Use custom add-ons for deeper logic-based scans.

Before you start

Step 1 — Create the repo layout

attacktemplate
├── custom-nuclei-templates
│   └── hello.yaml
├── metadata.yaml
└── workflow-templates
    ├── template
    │   └── test.yaml
    └── workflow.yaml

| Path | Holds |

| ------ | ------- |

| metadata.yaml | Tells Prancer how to run Nuclei. |

| custom-nuclei-templates/ | Standalone templates. |

| workflow-templates/ | Workflow definitions. |

| workflow-templates/template/ | Templates referenced by workflows. |

| workflow-templates/workflow.yaml | The workflow itself. |

Step 2 — Configure metadata.yaml

Name: Nuclei
Technology: standalone
Type: active
Engine: golang
Description: run nuclei
UploadEnabled: true
UploadSource: nuclei-results/nuclei-results.json
IgnoreOutput: true
ScanType: nuclei
DefaultTemplate: true
WorkflowTemplate: true
CustomTemplate: true
TemplatePaths:
  - custom-nuclei-templates
  - workflow-templates
UploadFileFormats:
  - json
Charset: UTF-8
Tags:
  cloud: nuclei,api
  Type: Blackbox, Webscan
Params:
  Target: '{{.Target}}'
  Command: ''

Configurable items

| Item | Description | Values |

| ------ | ------------- | -------- |

| DefaultTemplate | Use Nuclei's default templates. | true / false |

| WorkflowTemplate | Use workflow templates. | true / false |

| CustomTemplate | Use your custom templates. | true / false |

| TemplatePaths | Directories Prancer should scan. | List of paths |

| Tags | Categorization for filtering / auto-load. | Key-value pairs |

| Params.Target | Target placeholder injected at runtime. | '{{.Target}}' |

| Params.Command | Custom Nuclei CLI flags. | Empty for defaults |

Tip: start with DefaultTemplate: true plus your own templates. Disable defaults only if you want a tightly focused scan.

Step 3 — Write a template

id: custom-header-check
info:
  name: Custom Security Header Check
  author: Your Name
  severity: medium
  description: Checks for the presence of a custom security header

requests:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Custom-Security-Header"
        part: header

Save as .yaml under custom-nuclei-templates/.

Step 4 — Reference from your PAC file

The Nuclei add-on plugs in via the same CVE / Connector mechanism as any other custom add-on — see Custom Add-ons.

Best practices

  • Organize templates into subfolders by category (CVE, headers, exposures).
  • Name them clearly — id is what shows up in the findings.
  • Comment templates so future-you remembers why they exist.
  • Test locally with the Nuclei CLI before wiring into PAC.
  • Refresh regularly — new CVEs and template updates land daily.
Warning: templates with high request volume can slow scans dramatically. Profile them locally before flipping them on in production runs.

Next steps