Automated CVE Scanning for Bug Bounty Programs using Nuclei - n8n Workflow

• Penetration Testers and Security Researchers.


• Bug Bounty Hunters seeking automated coverage for new vulnerabilities.


• DevOps and SecOps teams managing attack surface monitoring.


• Technical users requiring advanced custom code scripting capabilities within n8n.

This sophisticated n8n workflow provides continuous, hands-free monitoring for newly disclosed Common Vulnerabilities and Exposures (CVEs) across common bug bounty targets. By leveraging the power of Project Discovery’s public API, this n8n workflow fetches the latest Nuclei templates. A core part of this automation involves using the SSH n8n node to securely execute the powerful Nuclei scanning engine on a dedicated server environment. This setup allows the n8n automation to run intensive, highly technical security tasks without impacting the primary n8n instance. This practical application of n8n templates significantly accelerates a security team's ability to respond to emerging threats by automating the detection process.

The entire process is initiated by the Schedule Trigger n8n trigger node, allowing for daily or hourly execution.

1. Target Acquisition: The n8n workflow first retrieves the comprehensive list of public bug bounty domains via an HTTP Request n8n node.


2. Environment Preparation: The domain list is converted to a file and uploaded to the SSH environment (/tmp/nuclei/domains.txt) using an SSH n8n node.


3. Template Retrieval: An HTTP Request n8n node queries the Project Discovery API to fetch the most recent Nuclei templates.


4. Temporal Filtering: The results are processed to filter for templates created only within the last 24 hours (relative to the n8n trigger time), ensuring the n8n workflow only scans for the newest threats. Relevant data (CVE ID, score, raw template content) is extracted using a Set n8n node.


5. Execution Loop: The n8n workflow iterates through each new CVE template. Each template is uploaded to the scanner environment.


6. Nuclei Execution: A critical SSH n8n node executes the Nuclei command line tool, instructing it to run the newly uploaded templates against the established domains.txt target list.


7. Reporting: After execution, the output of the scan is captured. An If n8n node checks if the Nuclei results contain any findings. If hits are detected, the Gmail n8n node sends an immediate alert detailing the vulnerable domains and associated CVEs.

To deploy this expert n8n workflow, you must prepare both your n8n credentials and an external SSH environment.

1. Import Workflow: Import the provided n8n workflow JSON into your n8n instance.


2. Set up SSH Credentials: This n8n workflow relies heavily on the SSH n8n node to run the Nuclei scanner. Configure an SSH credential (using Password or Private Key) in n8n. This credential must provide access to a server where Nuclei is installed and running.

1. Gmail Credentials: Set up your Gmail OAuth2 credentials in n8n for the 'Send a message' n8n node.

Schedule Trigger n8n trigger: Used to run the entire security n8n workflow automatically at defined intervals.
Get All Bug Bounty Domains (HTTP Request n8n node): Fetches the up-to-date target scope list from GitHub, which is the input for the Nuclei scan.
Upload domains.txt (SSH n8n node): Securely transfers the domain list file to the remote scanning host.
GET Last CVEs (HTTP Request n8n node): Queries the Project Discovery API to retrieve recent security templates.
Date Filter (If n8n node): A critical logic step in this n8n workflow that compares the template creation date against the current timestamp to filter for new CVEs only.
Set Variables (Set n8n node): Prepares the data, extracting variables like CVE and Template content required for file naming and Nuclei command execution.
Upload Template & Convert Template to .yaml (SSH n8n node): Handles the file creation and renaming steps required to get the specific Nuclei template ready for execution on the remote system.
Execute Nuclei (SSH n8n node): The core security action n8n node, running the nuclei command with specific flags against the uploaded target list. This demonstrates advanced custom code scripting integration within an n8n workflow.
Check Results (If n8n node): Determines if the output of the nuclei command contains any hits, triggering the final alert only if a vulnerability is found.
Send a message (Gmail n8n node): The final step of the n8n workflow, delivering the vulnerability findings to the designated security inbox.