Crossfyre vs Nuclei
A template-based vulnerability scanner vs a distributed recon-to-authz pipeline.
Nuclei (by ProjectDiscovery) is a fast, free, template-driven scanner for checking known issues, and Crossfyre stays compatible with its templates. But Crossfyre is a wider layer: the distributed recon that maps your attack surface, then its own from-scratch engine (cortex) that confirms every finding by reproducing it before reporting, plus active injection fuzzing and API authorization testing (BOLA/BFLA/BOPLA) that templates do not cover. You get the template corpus and a confirm-before-report pipeline, without wiring five tools together.
Nuclei
- Free and open source; large community template library for known issues
- Excellent at fast, templated checks once you know what to scan
- You provide the targets; recon and surface discovery are separate
- Single-tool by design; distribution, scheduling, and history are yours to build
- Reports what matches a template; no authorization testing, correlation on you
Crossfyre
- Maps the attack surface first: subdomains (voyage), ports (pulse), content (mach)
- cortex confirms every finding (reproduce-before-report) and fuzzes for injection; Nuclei-template compatible
- API authorization testing (BOLA/BFLA/BOPLA) and authenticated scanning that templates cannot do
- Distributes work across your nodes with crash-safe, schedulable runs
- Streams findings into a dashboard with history, teams, and exports
The honest take
If all you want is a templated scanner, Nuclei is great and free, and Crossfyre runs its templates too. Choose Crossfyre when you want the distributed recon around your scanning plus a confirm-before-report engine and authorization testing that a template runner does not provide.
Frequently asked
Does Crossfyre do vulnerability scanning like Nuclei?
Yes, and more. cortex is a from-scratch engine that stays Nuclei-template compatible but adds active injection fuzzing and a non-bypassable confirm-before-report pipeline (every finding is reproduced before it is emitted). It also runs API authorization testing (BOLA/BFLA/BOPLA), which templates do not cover. The curated pack is newer and smaller than Nuclei's corpus; the discipline and the authz engine are the difference.
Can I use my Nuclei templates with Crossfyre?
A supported subset works as-is: matchers, status/word/regex/dsl conditions, and payload fuzzing. cortex also ships its own built-ins that always run and a curated starter pack, so you are not starting from an empty engine.