Nuclei doesn't find anything

[colosseum999]

Nuclei doesn't find anything even on vulnweb

[geeknik]

Nuclei 2.7.1 + Templates 9.0.6 works here:

root@box:~# nuclei -t nuclei-templates -nts -u http://testhtml5.vulnweb.com/

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   2.7.1

                projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.

[INF] Your current nuclei-templates v9.0.4 are outdated. Latest is v9.0.6
[INF] Downloading latest release...
[INF] Successfully updated nuclei-templates (v9.0.6) to /root/nuclei-templates. GoodLuck!
[INF] Using Nuclei Engine 2.7.1 (latest)
[INF] Using Nuclei Templates 9.0.6 (latest)
[INF] Templates added in last update: 0
[INF] Templates loaded for scan: 3401
[INF] Templates clustered: 583 (Reduced 537 HTTP Requests)
[nginx-version] [http] [info] http://testhtml5.vulnweb.com/ [nginx/1.19.0]
[tech-detect:angularjs] [http] [info] http://testhtml5.vulnweb.com/
[tech-detect:google-font-api] [http] [info] http://testhtml5.vulnweb.com/
[tech-detect:angular] [http] [info] http://testhtml5.vulnweb.com/
[tech-detect:nginx] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:strict-transport-security] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:x-frame-options] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:x-permitted-cross-domain-policies] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:referrer-policy] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:x-content-type-options] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:clear-site-data] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:cross-origin-resource-policy] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:access-control-allow-credentials] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:cross-origin-embedder-policy] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:cross-origin-opener-policy] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:access-control-max-age] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:access-control-allow-headers] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:content-security-policy] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:permission-policy] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:access-control-expose-headers] [http] [info] http://testhtml5.vulnweb.com/
[http-missing-security-headers:access-control-allow-methods] [http] [info] http://testhtml5.vulnweb.com/
[INF] Using Interactsh Server: oast.site
[txt-fingerprint] [dns] [info] http://testhtml5.vulnweb.com/ ["v=spf1 -all"]
[waf-detect:nginxgeneric] [http] [info] http://testhtml5.vulnweb.com/
^C[INF] CTRL+C pressed: Exiting
[INF] Creating resume file: /root/.config/nuclei/resume-cadl6qvqe8r2uf00000g.cfg

[ehsandeep]

@colosseum999 nuclei runs template that are configured to find specific and known vulnerabilities, you can find available templates here - https://github.com/projectdiscovery/nuclei-templates, let me know if you find any vulnerable host for available templates and still missing the results.

[colosseum999]

Seems like i didn't use it correctly. Thank you and sorry for the mistake!

[ehsandeep]

No problem, thanks for confirming.

[TahaDataAlchemy]

Nuclei always shows that the HTTP security headers are missing, even when they are present.