Architectural Advice: Mapping dynamic JSON test cases into Nuclei execution layer while preserving session state

[AdheeshwaranJ]

Hi everyone! I am currently building a custom Web VAPT automation platform and could use some architectural direction regarding the execution and state preservation layers.

What we are trying to achieve:
We have built an application profiling and test-case generation layer (outputting structured JSON schemas). We are now building the Execution & Validation layer to automate dynamic test cases end-to-end.

The Challenge / Where we are stuck:
We initially tried leveraging a Playwright browser-automation agent (using tools like TestZeus Hercules) to run exploits, but we are running into continuous silent failures and execution timeouts ("0 results" returned). We realize browser UI automation is too slow and fragile for raw offensive parameter fuzzing and active validation.

We want to pivot our Execution Layer to use a native, deterministic setup using Katana for creeping/state extraction and Nuclei for raw exploit execution.

My Questions for the community:

1. What is the best practice for exporting complex authentication state contexts (like session cookies and dynamic JWTs extracted from a headless browser/Katana crawl) and cleanly feeding them into Nuclei workflows programmatically?
2. Has anyone integrated the Nuclei engine directly inside an async Python runner to map dynamic JSON test cases into on-the-fly YAML templates?

Would love to hear how teams here manage state handoffs between crawling and active exploitation layers!

[mynhe]

A few concrete pointers, having wired up similar crawl -> exploit pipelines:

1. Auth / session state -> use Nuclei's -secret-file rather than piping cookies by hand. Since v3.2.0 Nuclei has first-class authenticated scans (-secret-file auth.yaml) with two models that map onto your problem. Static secrets are a fixed header/cookie/bearer token scoped with domains / domains-regex — good for a known session cookie or a long-lived API key. Dynamic secrets reference a login template that performs the auth flow and extracts the token (e.g. a JWT) at runtime, so Nuclei refreshes it itself — the right fit for short-lived JWTs, since the refresh lives with the scanner and you never hand it a stale token. This is usually cleaner than exporting a cookie jar out of the Katana/headless crawl. If you do need to inject values captured upstream, parameterize templates and pass -var key=value (and/or -H) at runtime instead of regenerating YAML.

2. Katana -> Nuclei. Run Katana with -jsonl (plus -headless/form-fill for authenticated crawling) and normalize its output into the endpoint list Nuclei consumes. For the raw parameter fuzzing / active validation you actually want (instead of Playwright), use Nuclei's DAST/fuzzing mode: Katana discovers params, Nuclei fuzzes them — katana ... | nuclei -dast with fuzzing: templates. That is the native, deterministic path that replaces the fragile browser-automation agent.

3. Driving the engine from Python. There is no official Python binding for the Nuclei engine — the embeddable SDK is Go (github.com/projectdiscovery/nuclei/v3/lib, nuclei.NewNucleiEngine(...)). Two realistic options: (a) subprocess the CLI from your async runner — nuclei -silent -jsonl ... and stream JSONL into asyncio as results arrive (simple, robust, version-agnostic); or (b) wrap the Go SDK as a gRPC/HTTP microservice if you need tight in-process control, and call it from Python. For JSON -> templates, generate YAML into a temp dir and run nuclei -t ./generated/, but push per-run variability into -var/matchers so you only regenerate when the structure changes, not every run.

Overall: keep the layers decoupled through a normalized contract — the crawler emits endpoints (URL, method, body, discovered params) as JSONL; the exploitation layer owns auth (via -secret-file) and execution. Treating auth as a scanner concern rather than a handoff artifact is what makes the session-state problem go away.

Refs: Authenticated Scans — https://docs.projectdiscovery.io/tools/nuclei/authenticated-scans · Scanning Login-Protected Targets with Nuclei v3.2 — https://projectdiscovery.io/blog/scanning-login-protected-targets-with-nuclei