Support for --chrome-ws-url (connect to external Chrome instance)

[kayra-s4e]

Summary

I would like to request a feature for Nuclei to allow connecting to an already running Chrome instance using a WebSocket debugging URL, similar to Katana's --chrome-ws-url (-cwu) parameter.

Motivation

When running headless templates in Nuclei, I often need to:

• Reuse an existing Chrome session for performance reasons (reduce overhead of starting new instances)
• Maintain session cookies, extensions, or authenticated states across multiple scans
• Run scans in environments where launching a new Chrome instance is restricted or not desired

Katana currently supports this with the --chrome-ws-url parameter:

-cwu, –chrome-ws-url string Use Chrome browser instance launched elsewhere with the debugger listening at this URL

It would be very useful to have the same parameter in Nuclei for consistency and flexibility during headless scans.

Example Usage

nuclei -t headless-templates/ -u https://target.com --chrome-ws-url ws://127.0.0.1:9222/devtools/browser/<id>

Expected Behavior

• Nuclei connects to the provided Chrome instance via WebSocket.
• Reuses the browser session instead of launching a new Chrome instance.
• Maintains compatibility with existing headless templates.

Additional Notes

• This would help in advanced scanning pipelines, CI/CD environments, and authenticated testing scenarios.
• Should work seamlessly with other headless options already present in Nuclei.

Thank you for considering this feature!

[dwisiswant0]

#5786

[Deamhan]

It'd be fantastic to have it - it's highly required if the browser are managed from the outside. Apart from that no-incognito is required to use existing browser settings & session. I use such functionality locally and it works like a charm, the only issue I faced is pages leak if some actions like navigation are failed, proposed a tested fix here 6569