Caido Reporting,
From Replay to Report
Send Caido requests and findings into your engagement with the Neuron plugin, or import an HTTP History export. Caido reporting with request evidence already attached.
Send It Once. It Is Already in the Report.
Caido is fast, light, and built for the way modern web testers work. Reporting from it still means copying requests out of Replay and HTTP History by hand. The Neuron Caido plugin moves them for you.
Pair a Caido project with an engagement and send requests from HTTP History, Search, or Replay with a right-click or Ctrl+Shift+N. Findings from Caido and its plugins go to the Scan Issues triage queue, and every request lands with its response on the web app it belongs to.
Captured traffic without the plugin? Export HTTP History as JSON or CSV and import it with neuron import --source caido, or upload it under Import, Caido on the engagement.
$ neuron import --source caido --tag api \ acme-api-history.json✓ 486 requests, 3 web apps, 74 endpoints $ neuron import --source caido acme-portal.csv✓ 128 requests, 1 web app, 19 endpoints- 10:58 Finding IDOR on /api/v2/invoices/{id}
- 10:52 Caido Replay: GET /api/v2/invoices/1043
- 10:47 Caido 9 findings synced to Scan Issues
- 10:30 Import Caido: 486 requests, 3 web apps
Why Caido Reporting Takes So Long
Caido keeps your work in projects, which is exactly right for testing and exactly wrong for reporting. The request that proved an IDOR sits in a Replay session named something like "test 4", and the finding that flagged it sits on a Findings page the report cannot see.
Turning that into a deliverable means copying each request and response, cleaning up the formatting, redacting the bearer token, and retyping the affected URL. On a large API test, that is hours of work after the testing is done.
And Caido findings carry no severity, so someone still has to rate every one before it can go anywhere near a client.
Everything Caido Produces, On the Engagement
Send from Caido with the Neuron extension and it lands on the engagement as you test.
Requests From Replay
The exact request you were looking at in Replay, or any selection from HTTP History or Search, stored with its response on the right web app.
Hosts, Endpoints, and Parameters
Hosts, web apps, endpoints, and parameters created from the traffic, so the engagement shows the attack surface Caido saw.
Caido Findings
Findings from Caido and its plugins in the Scan Issues triage queue, one scan issue per reporter with each path as a location, arriving as Informational for you to rate.
Secrets Redacted
Bearer tokens, cookies, API keys, and authorization headers replaced with [REDACTED] before storage, by the same HTTP redaction patterns your team maintains in the Library.
A Neuron Scope in Caido
Sync scope and Caido gets a scope named Neuron, with hosts that have an in-scope web app on its allowlist and fully out-of-scope hosts on its denylist.
Back Into Replay
Send to Caido opens any stored request in a new Replay session named after it, with redacted cookies and headers filled back in from the project's history.
How to Send Caido Traffic to Neuron
- 01
Install the Neuron plugin
Download the plugin package from Tools on your own Neuron server and install it in Caido under Plugins, Install Package. Enter your Neuron server's address under Connection on the Neuron page.
- 02
Pair the Caido project
Choose Pair this project, confirm the code in Neuron, and approve it. Caido remembers the pairing per project, so switching projects switches engagements, and it offers to sync scope straight away.
- 03
Send requests and findings
Right-click requests in HTTP History, Search, or Replay and choose Send to Neuron. Sync findings sends every finding on an in-scope host, and automatic sending forwards new ones as Caido reports them.
- 04
Or import an HTTP History export
Export HTTP History from Caido as JSON or CSV and import it with --source caido, or upload it on the engagement's Import page.
$ neuron import --source caido acme-api-history.json
Your Infrastructure. Your Data.
The extension sends straight from Caido to your own Neuron server. Requests, responses, and evidence stay inside your network and never pass through a third-party cloud.
From Caidoto the Final Report
Rate the Caido findings that matter in the triage queue, then promote them into findings with the request and response already attached. Nothing is rewritten from a screenshot.
Findings Library entries supply the approved write-up for common web and API issues, and the QA pipeline reviews each finding while testing is still going, not the night before delivery.
During the retest, Send to Caido puts the original request back in Replay with your current session. Replay it and send the result to Neuron as proof the issue is fixed.
Caido Integration FAQ
The questions teams ask most about Caido and Neuron.
How do I get Caido findings into a pentest report?
Install the Neuron Caido plugin, pair your Caido project with the engagement, and sync findings. Each Caido finding lands in the Scan Issues triage queue with its affected paths, ready to rate and promote into a finding with the request evidence attached.
Can I import a Caido HTTP History export?
Yes. Export HTTP History from Caido as JSON or CSV and run neuron import --source caido on the file, or upload it under Import, Caido on the engagement. Hosts, web apps, endpoints, parameters, and the stored requests are created from it.
Why do Caido findings arrive as Informational?
Caido findings carry no severity of their own, so Neuron imports each one as Informational for a tester to rate during triage. The scan issue keeps every path the Caido finding was reported on.
Can Neuron send requests back to Caido?
Yes. Send to Caido on a stored request, or on a request in a scan issue's evidence, opens it in a new Caido Replay session named after it. The plugin fills redacted cookies and headers back in from the project's history, and Neuron tells you anything still redacted.
Does the Caido plugin sync scope?
Yes. Sync scope gives Caido a scope named Neuron, with hosts that have an in-scope web app on the allowlist and hosts whose web apps are all out of scope on the denylist. Syncing never changes Neuron.
Where does Caido traffic end up?
On your own self-hosted Neuron server, in the engagement the Caido project is paired with, with cookies and tokens redacted before storage. Nothing passes through a third-party cloud.
More Neuron Integrations
Burp Suite Reporting and Findings Import
Web TestingZAP Reporting and OWASP ZAP Alert Import
Web TestingOpenAPI and Swagger Import for API Pentests
Web TestingNuclei Scan Reporting and Import
Web Testingffuf Reporting and Content Discovery Logging
Web TestingNikto Reporting and Output Import
Web TestingAcunetix Report Import for Pentest Reports
Web TestingInvicti and Netsparker Report Import
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform