Is there a support of openapi spec?

[navzen2000]

Can Nuclei be run against OpenAPI spec endpoint and all the listed templates be tested? If not, can this be added as a new feature?

[princechaddha]

Hi @navzen2000, Thank you for taking the time to create this thread.

Nuclei is a customizable vulnerability scanner based on simple YAML-based templates and not an automated application security testing tool, so it won't be useful to scan OpenAPI spec and API endpoints in general. Current templates are primarily written with the root URL in mind. However, it would be very useful once nuclei adds HTTP request fuzzing and crawling functionality. The url fuzzing part is currently being worked on at projectdiscovery/nuclei#2679 and probably after that we can work on supporting this as well.