Pentest Tool Integrations,
Straight into the Report
31 integrations across C2, phishing, Active Directory, network, vulnerability, web, cloud, mobile, external intelligence, and ticketing. Just test. The timeline writes itself.
Every Tool. One Engagement.
However a tool connects, its results land on the same engagement, next to every command you ran from the recording shell, attributed and timestamped.
Collectors
$ neuron collector mythicStream a C2 or phishing server into the engagement for as long as it runs. Every task, callback, capture, and credential lands on the timeline the moment it happens.
Run Through neuron
$ neuron nmap -sV 10.20.0.0/24Put neuron in front of a tool and it runs exactly as before. When it finishes, the results import and the command lands on the timeline. Add --ssh to run it on a jumpbox.
Imports
$ neuron import *.nessusImport scanner output from the browser or the CLI. Hosts, ports, and web apps are created, and every reported issue lands in one triage queue, ready to promote into a finding.
Extensions and Ticketing
Send requests straight from Burp Suite, ZAP, and Caido as you test, and push approved findings into ServiceNow and Jira when the report is done.
C2 Frameworks Integrations
Stream every task, callback, credential, and file from your C2 into the engagement timeline while the operation runs.
Mythic C2 Reporting and Activity Logging
Log every Mythic task, callback, credential, and file to your engagement timeline as it happens. Red team reporting from Mythic without exporting a single C2 log.
Sliver C2 Reporting and Activity Logging
Stream Sliver sessions, beacons, beacon tasks, credentials, and loot into your engagement timeline as they happen. Sliver red team reporting with the activity log already built.
Metasploit Reporting and Session Logging
Stream Metasploit module runs, sessions, credentials, and loot into your engagement timeline. Metasploit reporting with the evidence already in place when testing ends.
Phishing Integrations
Capture campaign results, submitted credentials, and stolen sessions the moment they happen, matched to the people you targeted.
GoPhish Reporting and Campaign Tracking
Stream GoPhish campaign events into your engagement: emails sent, opened, clicked, reported, and credentials submitted. Phishing campaign reporting without the CSV exports.
Evilginx Reporting and Session Capture Logging
Stream Evilginx lure visits, captured credentials, and captured session tokens into your engagement timeline. Adversary-in-the-middle phishing reporting with the evidence already collected.
Active Directory Integrations
Run your AD tooling through neuron and the hosts, shares, credentials, and attack paths it finds land in the engagement.
NetExec (nxc) Reporting and Logging
Run NetExec through the Neuron CLI and every host, share, user, and credential it finds lands in your engagement. NetExec reporting without scraping terminal output.
Certipy AD CS Reporting and ESC Findings
Run Certipy through the Neuron CLI and certificate authorities, vulnerable templates, and ESC conditions land in your engagement ready to become findings. AD CS reporting from the scan you already ran.
BloodHound Reporting and Attack Path Import
BloodHound reporting with the graph inside the engagement. Import SharpHound or AzureHound data and every engagement keeps its own attack graph, paths, and findings.
Network Discovery Integrations
Hosts, ports, and services from your discovery scans land in the engagement the moment the scan finishes.
Nmap Reporting: Nmap XML to Pentest Report
Run Nmap through the Neuron CLI or import Nmap XML, and hosts, services, OS matches, and NSE results land in your engagement. Nmap reporting with no copy and paste.
Masscan Reporting and Masscan XML Import
Run Masscan through the Neuron CLI or import its XML, and every open port it finds lands on the engagement, ready for follow-up. Masscan output to report, no parsing.
PCAP Import: Hosts and Services From Captures
Import a Wireshark or tcpdump capture and Neuron extracts the internal hosts, MAC addresses, hostnames, and services it saw. PCAP import for passive recon, no scanning.
Vulnerability Scanners Integrations
Every scanner result lands in one triage queue, ready to confirm and promote into a finding your client will read.
Nessus Reporting and .nessus File Import
Import .nessus files into Neuron and every plugin result lands in one triage queue, grouped across hosts. Nessus reporting that ends in findings, not spreadsheets.
Qualys Report Import for Pentest Reporting
Import a Qualys VMDR scan report and every QID lands in your engagement as a scan issue, with hosts and result evidence attached. Qualys report import for pentests.
OpenVAS Reporting and Greenbone Report Import
Import OpenVAS and Greenbone GMP XML reports into Neuron. Every NVT lands as a scan issue with QoD, CVEs, and per-host evidence. OpenVAS reporting your client can read.
Nexpose and InsightVM Report Import
Nexpose report import for Rapid7 Nexpose and InsightVM XML exports. Every vulnerability lands as a scan issue with its hosts, CVEs, and exploit flag, ready to triage.
Web Testing Integrations
Send traffic from your proxy, scan, and fuzz, and every result lands against the web app it belongs to.
Burp Suite Reporting and Findings Import
Send Burp Suite requests and Scanner issues straight into your engagement, with request and response evidence attached. Burp Suite reporting without copy and paste.
ZAP Reporting and OWASP ZAP Alert Import
Send OWASP ZAP requests and alerts into your engagement with the Neuron ZAP add-on, or import a HAR export. ZAP reporting with every alert in one triage queue.
Caido Reporting and HTTP History Import
Send Caido requests and findings into your engagement with the Neuron plugin, or import an HTTP History export. Caido reporting with request evidence already attached.
OpenAPI and Swagger Import for API Pentests
Import an OpenAPI or Swagger spec and every endpoint, method, and parameter lands in your engagement as API pentest scope, mapped before the first request is sent.
Nuclei Scan Reporting and Import
Run Nuclei through the Neuron CLI and every result lands in your engagement as a scan issue, ready to promote into a finding. Nuclei reporting without a conversion script.
ffuf Reporting and Content Discovery Logging
Run ffuf through the Neuron CLI and every hit lands in your engagement against the web app it belongs to. Content discovery reporting without copying terminal output.
Nikto Reporting and Output Import
Import Nikto XML or JSON output into Neuron and every finding lands against the host, port, and path it hit, ready to triage. Nikto output to report, no copy and paste.
Acunetix Report Import for Pentest Reports
Import Acunetix XML reports into Neuron and every vulnerability lands with the request and response that prove it, mapped to its endpoint. Acunetix report import.
Invicti and Netsparker Report Import
Invicti report import for current JSON and legacy Netsparker XML exports. Every vulnerability lands with its proof of concept, request, and response, ready to triage.
Cloud and Mobile Integrations
Cloud posture and mobile app scan results land in the same triage queue as the rest of the engagement.
Prowler Reporting and Cloud Scan Import
Prowler reporting straight from its own output. Every failed check lands in one triage queue with its affected resources, remediation code, and compliance mappings.
ScoutSuite Report Import and Reporting
ScoutSuite report import that keeps every flagged rule and resource. Load the scoutsuite_results file and triage AWS, Azure, and GCP issues in one queue.
MobSF Report Import for Mobile Pentests
MobSF report import for mobile app pentests. Load the MobSF JSON report and code, manifest, network, and binary issues land in one triage queue with files attached.
External Intelligence Integrations
Internet-facing hosts and services from external search engines land in the engagement before you send a packet.
Shodan Export to Pentest Report Import
Import a Shodan export and every banner becomes a host and service in your engagement, with weak TLS and bad certificates queued for triage. Shodan results, reported.
Censys Export Import and Attack Surface Report
Import a Censys export and every host, service, and certificate weakness lands on your engagement. Censys external attack surface reporting without the spreadsheet.
Ticketing Integrations
Push approved findings into the system your client tracks remediation in, with your own field mapping.
ServiceNow Pentest Findings Integration
Push approved pentest findings to ServiceNow as Incident, Problem, or Vulnerability Response records, with your own field mapping, evidence images, and no duplicates.
Jira Pentest Findings Integration
Push approved pentest findings to Jira Cloud or Jira Data Center as issues in the project you choose, with your field mapping, evidence screenshots, and no duplicates.
Integrations FAQ
Which pentest and red team tools does Neuron integrate with?
Neuron integrates with Mythic, Sliver, Metasploit, GoPhish, Evilginx, NetExec, Certipy, BloodHound, Nmap, Masscan, PCAP, Nessus, Qualys, OpenVAS, Nexpose, Burp Suite, ZAP, Caido, OpenAPI, Nuclei, ffuf, Nikto, Acunetix, Invicti, Prowler, ScoutSuite, MobSF, Shodan, Censys, ServiceNow, and Jira. Anything else you run inside the Neuron recording shell is logged to the engagement timeline with its output.
What is the difference between a collector, an import, and running a tool through neuron?
A collector streams a long-running server, such as a C2 framework or phishing platform, into the engagement for as long as it runs. Running a tool through neuron wraps a single command and imports its results when it finishes. An import takes a file a tool already wrote, from the browser or with neuron import.
Where do imported scanner results go?
Hosts, ports, web apps, and endpoints are created or updated on the engagement. Anything a scanner reported as a problem lands in the Scan Issues queue, where a tester triages it and promotes confirmed issues into findings.
Does any of my tool data leave our network?
No. Neuron is self-hosted. The CLI, the extensions, and the importers all send to your own Neuron server, inside your infrastructure, and nothing passes through a third-party cloud.
Can Neuron push findings into our ticketing system?
Yes. Workflow Integrations push approved findings into ServiceNow and Jira with your own field mapping, routing rules, and evidence attachments. Later pushes update the same record instead of creating a duplicate.
What if I use a tool that is not listed here?
Run it inside the Neuron recording shell and every command and its output is logged to the engagement timeline, attributed and timestamped. If it writes a file in a supported format, the shell offers to import it.
Ready to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform