Skip to content

Working Along With Nuclei


Learning Points

  • How to use list-transform feature.
  • How to use Nuclei along with Mihari.

Problem Statement

Try to create a Nuclei template that meets all of the following conditions:

  • HTTP status equals to 200.
  • Headers have x-conference:JSAC2024.
  • HTML body has an ISO 8601 format datetime.



list-transform Basics

list-transform command is for listing/searching data with transformation. More specifically, you can transform data with Jbuilder.

For example, the following command outputs artifacts data as a top-level array.

mihari artifact list-transform -t "json.array!"

More practically, the following Jbuilder template combines an IP and its associated ports.


ip_ports = do |artifact| do |port|

json.array! ip_ports
mihari artifact list-transform -t /path/to/ip_port.json.jbuilder

The output can be used for passing data into Nuclei.


With great power comes great responsibility.

Jbuilder can execute anything with the same privilege Mihari has. Do not use untrusted template.

Nuclei Basics


For example, let's scan the Hello World Rack application.

# Start Rack application
# Open another terminal
echo "localhost:9292" | nuclei -t nuclei/hello_world.yaml

list-transform + Nuclei

The following command passes ip:port formatted data (targets) to Nuclei.

# Confirm before scanning
$ mihari artifact list-transform "{HONEYPOT_RULE_ID}" -t ip_port.json.jbuilder | jq -r ".[]"
# Scan if the output looks good
$ mihari artifact list-transform "{HONEYPOT_RULE_ID}" -t ip_port.json.jbuilder | | jq -r ".[]" |  nuclei -t /path/to/template


Please use a rule I give in Slack if you are unable to complete the previous exercise.