Course 3 - Mastering Nuclei for Bug Bounty | Episode 2: Controlling Scans, Traffic Tuning, and Custom Template Development

In this lesson, you’ll learn about:Controlling Nuclei template selection — include templates by tags (e.g., xss, tech, enginex), severity (info, low, medium, high, critical), or author; and exclude specific templates/tags/severity with exclusion flags to avoid noisy results.Performance tuning & safe scanning — tune rate-limit (requests/sec), bulk-size (parallel hosts per batch), and -C (concurrency for templates) to avoid overwhelming targets or triggering WAFs; prefer conservative defaults for bug‑bounty targets.Request identification & tracking — add custom HTTP headers with -H / --header to tag traffic (useful for program owners and triage).Persistent configuration — use config.yaml to store default flags (targets, template lists, exclusions, headers) so runs are consistent and reproducible.Debugging & visibility — use -debug and -v to print the exact HTTP requests and responses Nuclei sends/receives; essential to understand why a match fired (status codes, regexes, extractors).Template structure & components — YAML template building blocks: id, info (name, severity, author, tags), requests (method, path, payload), matchers (status code, regex, words), and extractors (capture and display matched data).Filtering & extraction rules — craft matchers for precise detection (e.g., status: 200, regex capture); use extractors to pull versions or identifiers into the output.Custom template development — how to modify/create templates (example: PHP version detection), validate YAML with linters (YAML Lint), and test locally with -debug before wide runs.Operational best practices — limit templates to relevant categories, exclude info severity when noisy, validate custom templates, document headers/flags used for each engagement, and always respect scope/authorization.You can listen and download our episodes for free on more than 10 different platforms:https://linktr.ee/cybercode_academy