# 0xKayala/NucleiFuzzer

NucleiFuzzer is a robust automation tool that efficiently detects web application vulnerabilities, including XSS, SQLi, SSRF, and Open Redirects, leveraging advanced scanning and URL enumeration techniques

Repository: https://github.com/0xKayala/NucleiFuzzer
Canonical: https://ross.abutalabs.com/products/nucleifuzzer
Homepage: https://nucleifuzzer.0xkayala.com
Language: Python
License Family: other
Topics: nuclei, nuclei-templates, fuzzing-templates, nucleifuzzer, gauplus, hakrawler, katana, paramspider, uro, waybackurls, nuclei-fuzzer
Last push: 2026-04-17T14:33:41+00:00

## Health v2 (maintenance only)
Score: 66/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 77, release rhythm 40, longevity 85
- inputs: {"age_days": 1199, "days_push": 138, "days_rel": 603, "gap_med": 4, "n_releases_24m": 2}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1862, forks 259 (observed 2026-08-28T04:05:45.457870+00:00)

## What it is
NucleiFuzzer is a Python-based automation tool that combines URL discovery tools (ParamSpider, Waybackurls, Gauplus, Hakrawler, Katana) with Nuclei fuzzing templates to detect web application vulnerabilities like XSS, SQLi, SSRF, and Open Redirects. It handles deduplication with uro, HTTP filtering with httpx, rate limiting, and JSON/HTML reporting for security testing workflows.

## Use cases
- find xss vulnerabilities in a web application
- scan a domain for sqli and ssrf bugs
- enumerate hidden endpoints and parameters for bug bounty
- automate nuclei fuzzing scans across multiple domains
- discover urls from wayback machine and crawl them for vulnerabilities
- batch scan a list of domains for open redirects

## When to choose
- you are a bug bounty hunter or pentester wanting an automated recon-plus-scan pipeline
- you already use nuclei and want broader URL/parameter coverage
- you need batch domain scanning with deduplication and severity-grouped reports

## When to avoid
- you need a GUI or managed vulnerability management platform
- you cannot install the required external tools (nuclei, paramspider, httpx, uro, etc.)
- you need authenticated or complex multi-step application testing rather than fuzzing templates

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, web-scraping, cli, fuzzing
- domain: security, penetration-testing, web-development, developer-tools
- platform: windows, cli, python
- tags: vulnerability-scanning, bug-bounty, nuclei, url-discovery, recon, xss, sqli, ssrf, open-redirect, automation, linux, macos

## Member repositories
- 0xKayala/NucleiFuzzer (main) score 66

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:45.457870+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:15:40.973926+00:00, confidence not recorded.
  - readme: https://github.com/0xKayala/NucleiFuzzer (fetched 2026-08-28T04:05:45.457870+00:00, sha 362c4715136f)
  - homepage: https://nucleifuzzer.0xkayala.com (fetched 2026-08-29T10:54:50.298693+00:00, sha 82466a66afdb)
- Data as of 2026-08-30T08:39:29.467469+00:00.