If you've ever found yourself repeatedly setting up the same matchers in multiple Nuclei templates, it's time to break free from that cycle. Meet global matchers, a killer feature in Nuclei that simplifies your detection workflow.

Imagine having a single template that automatically hunts for specific patterns (like private keys, sensitive tokens, or webhooks) across every HTTP response from all your other templates. That's what global matchers do — and they do it effortlessly.

In this post, we'll cover everything you need to know about global matchers, why they're a game-changer, and how to use them to make your scans smarter and more efficient.

What Exactly are Global Matchers?

At their core, global matchers are basically matchers that operate on a global level. Instead of being tied to a specific request in a single template, they automatically apply to all HTTP responses received during a scan. Whether you're scanning for misconfigurations, secrets, or vulnerabilities, global matchers let you define your logic once and reuse it across all templates.

Why Should You Care?

Imagine you're hunting for specific patterns — say, private keys or Slack webhooks. Without global matchers, you'd need to define these patterns in every template you run. Not only is that repetitive, but it's also a pain to maintain. Global matchers solve this problem by centralizing your detection logic.

Benefits

What Can You Do with Global Matchers?

Global matchers shine in scenarios where you need to:

Key Things to Know

Before diving into examples, let's go over some important details about global matchers:

Let's Build a Global Matchers Template

Say you want to hunt for:

Here's how your template might look:

This template has global-matchers: true, which tells Nuclei to apply these matchers to every HTTP response it processes during a scan. The matchers-condition: or means it'll flag a response if any of the defined patterns are found.

Running the Scan

Now that you've got your global matchers template, it's time to put it to work. Pair it with some regular templates:

Here's a sample output:

In this example, the global matchers template found an asymmetric private key in a response from http-template-1 and a Slack webhook in a response from http-template-2. Notice how the matchers didn't need to be defined in either of those templates — they're applied automatically!

Pro Tips

Advanced Use Cases

Let's explore some creative ways to use global matchers:

1. Detecting Default Configurations

Look for telltale signs of default installations or misconfigured servers:

2. Identifying Sensitive Files

Global matchers can scan for accidentally exposed files like:

3. Passive WAF Detection

Instead of actively probing for WAFs, use global matchers to detect passive indicators in HTTP responses, such as patterns in error messages.

Cloud Support - Coming Soon

We're excited about the possibilities with this new feature and plan to integrate global matchers into ProjectDiscovery Cloud workflows in an upcoming release. Until then, we'd love to hear your ideas! If you have any workflows, feature requests, or suggestions, please share them with us or drop a PR.

Wrapping Up

Global matchers are one of those “aha!” features in Nuclei that can seriously up your game. Whether you're a beginner looking to simplify your workflows or a seasoned pro hunting for advanced detection tricks, global matchers offer a powerful, flexible way to enhance your scans.

By centralizing detection logic, you save time, reduce errors, and make your templates way easier to maintain. So, why not give them a try? Build your first global matchers template today and start spotting those hidden gems in your scans!

References