Hello and welcome to this lesson in this
lesson. We are going to understand how you can rate limit
your request when you are using this powerful tool like
nuclei.
It could be overwhelming sometimes when you are
scanning a lot of host and running a lot of templates on a Target.
Due to which the target might go unnecessarily down or
if there is a WAFF it might also block you.
Due to which you would not be able to further perform any testing on
that Target until the cooling of period has been
loaded.
Now to avoid that you can also tune nuclei
Aspire choice.
As you can see over here. There are three different options
of flags that you can use in nuclear to tune
your request. The first is
the rate limit which controls the number of requests that
you want to send per second to any specific given Target.
The second is bulk size which controls the number of parallel host
that you want to run simultaneously?
For example, if you have a list of subdomains, let's say hundred
you control the parallel number of
hosts that you want to test with nuclei.
This would avoid the target to be getting overwhelmed
for all the subdomains coming the request
from your IP address, which would avoid blocking.
The third one is the C flag, which is the concurrent templates
that you want to run onto a Target.
Is the Practical name and let's see how we can use
these options practically.
So I went to the official repository of nuclei and I'm going to first quickly
search for rate limit.
So you can see over here in the rate limit option we can
see.
The rate limit flag says the maximum number of requests to
be sent per second is default 150.
You can tune this to be more or less as
well.
The next option is bulk size before doing
that. Let's run rate limit on our
Target.
So this time I'm going to specify that. I want to run a
severity low. And also I want
to rate limit my request to
50 only and hit enter.
You can see over here. It has started scanning but this
would take more time as I have rate limited the request
per second that needs to be
sent to the Target.
This can be useful if the target is unable
to handle a lot of requests that you are sending at once
to that specific Target.
Let us see the next flag, which is
bulk size
Which is the maximum number of host that you want to analyze in
peril?
Per template by default is 25
you can increase that count as well.
So I'm going to specify bulk size as
2 and hit enter
now, let's see the third option which is the concurrency.
Concurrency can be super useful for you if you
want to execute.
A lot of templates on a Target in parallel. Definitely.
Yes, this can be much faster
for nuclei to complete
the scan and give you output quickly, but
it could also send a huge request
on that Target by default nucleus only
executes 25 templates in
parallel, but you can tune that as well.
So I'm going to specify hyphen C
and I'm going to say execute 50 templates in parallel.
This could be much faster and I would be getting
the scan completed very quickly.
Let us specify this to 500 and
it entered.
Keep in mind that this concurrency would
consume much more system resources.
So do not specify
very high number of concurrency for your
scan or it would consume a
lot of resources in your system.
I hope you guys understood. Thank you.