Automating Your Nuclei Recon Pipeline

Automating Your Nuclei Recon Pipeline

🛡️ Important: Nuclei should only be used for ethical purposes, such as authorized security testing, bug bounty programs, or educational research. Never run recon tools like Nuclei against systems you don’t own or have explicit permission to test. This guide assumes you’re using Nuclei responsibly and legally.

Now that you’ve learned how to run scans, rotate IPs, and trigger Discord alerts — let’s automate the whole recon flow. This script ties everything together into a repeatable, single-command bug bounty recon pipeline using subfinder, httpx, nuclei, NordVPN, and Discord alerts.

What This Script Does

• Enumerates subdomains using subfinder
• Probes for live hosts using httpx
• Rotates your NordVPN IP between each target
• Runs Nuclei with tuned templates and filters
• Sends results to Discord if any vulnerabilities are found

Full Bash Script

Save this as nuclei-recon.sh and make it executable with chmod +x nuclei-recon.sh.

#!/bin/bash

# Setup
DATE=$(date +"%Y-%m-%d_%H-%M-%S")
BASE_OUTDIR="nuclei_run_$DATE"
mkdir -p "$BASE_OUTDIR"

DISCORD_WEBHOOK="https://discord.com/api/webhooks/XXX/YYY"  # replace this

while read -r DOMAIN; do
  CLEAN=$(echo "$DOMAIN" | sed 's/*\.//g')
  OUTDIR="$BASE_OUTDIR/$CLEAN"
  mkdir -p "$OUTDIR"

  echo "[*] Rotating VPN..."
  nordvpn disconnect
  sleep 2
  nordvpn connect
  sleep 6
  curl -s ifconfig.me > "$OUTDIR/ip.txt"

  echo "[*] Subdomain scan on $CLEAN"
  subfinder -d "$CLEAN" -silent > "$OUTDIR/subs.txt"

  echo "[*] Probing live hosts"
  httpx -l "$OUTDIR/subs.txt" -silent -timeout 5 -threads 100 > 
  "$OUTDIR/live.txt"

  echo "[*] Running nuclei scan"
  nuclei -l "$OUTDIR/live.txt" \
    -t cves/,exposed-panels/,misconfiguration/,files/ \
    -tags rce,xss,unauth,exposure \
    -severity high,critical \
    -rate-limit 25 -retries 3 -timeout 10 \
    -o "$OUTDIR/findings.json" -v -debug

  if [[ -s "$OUTDIR/findings.json" ]]; then
    COUNT=$(jq length "$OUTDIR/findings.json")
    FIRST=$(jq -r '.[0] | "\(.info.severity | ascii_upcase) - \(.templateID) on \
(.matched)"' "$OUTDIR/findings.json")

    curl -s -H "Content-Type: application/json" \
      -X POST -d "{
        \"username\": \"Nuclei Bot\",
        \"content\": \"🚨 **$COUNT finding(s)** for \`$CLEAN\`\nFirst hit: $FIRST\nIP: \
`$(cat $OUTDIR/ip.txt)\`\nFile: $OUTDIR/findings.json\"
      }" "$DISCORD_WEBHOOK"
  else
    echo "[*] No findings for $CLEAN"
  fi

done < h1_scopes.txt

echo "[✔] Recon complete. All results in $BASE_OUTDIR"

./nuclei-recon.sh