nuclei will want to pull its template repo on first launch — run once before scanning:

nuclei -update-templates

Login bruteforce

for NixOS

set seclists /run/current-system/sw/share/seclists

ffuf -w $seclists/Passwords/Leaked-Databases/rockyou.txt \
	-u https://your-app.com/api/auth/login \
	-X POST \
	-H "Content-Type: application/json" \
	-d '{"login":"admin","password":"FUZZ"}' \
	-fc 401