Determining the Time for Scanning

[secfb]

Describe your feature request

I generally use the Nuclei tool for SAST and DAST tests. I only sometimes want to automatically scan the scan tests outside of working hours. When I examine the features of the tool in general, it would be nice to have this feature. For example, when I start a scan and the scan is not finished, the scans should pause between 8:30-17:30 (during business hours). It should continue scanning outside these hours. In addition, it would be great if we could set a setting such as scanning on weekends (Saturday and Sunday).

The event I am talking about is actually exactly as follows. It would be great if we could create a scan time for scans.

https://www.acunetix.com/support/docs/wvs/configuring-excluded-hours/

Describe the use case of the feature

In this way, the nuclei scans will be performed at the specified time.

Describe alternatives you've considered

This time and day specification feature should be added to the config file.

Additional context

https://www.acunetix.com/support/docs/wvs/configuring-excluded-hours/

[ehsandeep]

Hey @secfb,

Thanks for the suggestion, but this is out of scope for the project. Nuclei is designed to be a scanner, not a scan manager or scheduler. This kind of logic should be handled outside of Nuclei. For example, you can use a cron job or similar setup to control when scans run.

Closing this issue since we don’t plan to add this feature to Nuclei.

[secfb]

I think you were upset by my use of Acunetix and its commercial product. But this feature I mentioned would be used by many people. Or maybe you want to keep it for your Claud version.

[secfb]

I gave Acunetix just as an example. What I'm saying is actually something simple. When we start the scan, if the scan is not finished within working hours, I actually want it to pause itself. Then, when these working hours are over, I want it to continue where it left off.

[dwisiswant0]

You can achieve that by spawning the scan using something like a cron job as @ehsandeep mentioned, at a specific time, saving the process PID, and then terminating it at a defined hour. Then you can just pass the -resume flag to pick up from where it left off.

[secfb]

Isn't that simple? For example, if you scan 10,000 URLs on the internal network, the process will take a long time to complete. For example, if it takes four days, it wouldn't make much sense to stop and restart the process every time. I was just asking for a simple feature, and I don't understand why you're being so harsh. I don't understand why you're making such a big deal because it's a commercial product.