Censys Reporting,
From Index to Finding
Import a Censys export and every host, service, and certificate weakness lands on your engagement. Censys external attack surface reporting without the spreadsheet.
Import Once. Report From One Place.
Censys sees your client's internet-facing hosts from the outside, along with every service and certificate it can reach. On an external test or an attack surface review, that is the inventory you want on the engagement before testing starts.
Import a Censys JSON export and each host lands with its IP, DNS name, and operating system, and each service with its port, transport, service name, software, version, and banner. Where the record includes TLS, a deprecated negotiated version, a weak cipher, a self-signed leaf certificate, or one past its expiry date becomes a scan issue.
Import from the browser or with neuron import --source censys, and hosts already on the engagement are matched rather than created twice.
$ censys search 'ip: 203.0.113.0/24' \ --pages -1 -o acme-censys.json $ neuron import --source censys \ --tag perimeter acme-censys.json✓ Censys: 27 hosts, 64 ports imported- 15:14 Finding Expired certificate on mail.acme.example
- 15:09 Import Censys: 1 host, 3 ports, 2 scan issues
- 15:03 Command censys view 203.0.113.25 -o mail.json
- 14:58 Import Censys: 27 hosts, 64 ports
Why Censys Reporting Takes So Long
Censys records far more about each service than fits in a screenshot: software identification, TLS negotiation, the certificate chain. Most of it is lost the moment results are copied into a report by hand.
Attack surface reviews also repeat. Each quarter the same perimeter is searched again, exported again, and checked against last quarter's spreadsheet line by line to find the new host or the certificate that lapsed.
Meanwhile the hosts Censys indexed and the hosts your team scanned live in separate places, so nobody can say which exposed service was actually tested.
Everything Censys Produces, On the Engagement
Import Censys output from the browser or with neuron import, and it lands the moment the import finishes.
Hosts and DNS Names
Each host by IP, with its DNS name kept as an alternate hostname and the operating system Censys identified, where it identified one.
Services and Software
Port, transport protocol, service name, software product, and version for every service. Closed and filtered entries can be dropped with Only Import Open Ports.
Latest Banners
The service banner stored on the port and refreshed on every Censys import, so the port always shows the most recent response.
Certificate and TLS Issues
Deprecated TLS versions, weak ciphers, self-signed leaf certificates, and expired certificates raised as scan issues against the exact host and port.
Perimeter Exposure
When the import finishes, exposure analysis flags dangerous services on internet-facing addresses and scores likely high-value targets.
Subnets and Checklists
New hosts drop into the engagement subnets they belong to, and new ports with a recognised service collect the todos from your Service Checklists.
How to Import Censys Results
- 01
Search Censys
Query the hosts you are authorised to assess with the Censys CLI and write the hits to a JSON file. --pages -1 takes every page of results.
$ censys search 'ip: 203.0.113.0/24' --pages -1 -o acme-censys.json - 02
Pull full records for key hosts
censys view writes a single host record with its complete service detail, including TLS where Censys recorded it. Neuron imports single records as well as search results.
$ censys view 203.0.113.25 -o mail.json - 03
Set the import options
On the Import page, Censys imports every service by default, skips hosts with no services, and creates scan issues from TLS data. Tag the import so perimeter hosts are easy to filter.
- 04
Import the files
Upload them on the engagement's Import page, or name the source on the CLI, since Censys JSON is not detected automatically.
$ neuron import --source censys --tag perimeter acme-censys.json mail.json
Your Infrastructure. Your Data.
Neuron is self-hosted. Import Censys results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
From Censysto the Final Report
An attack surface report is only as good as its inventory. With every Censys host and service on the engagement, the report lists what is exposed, host by host, with the software and banner that identify each service.
Certificate and TLS issues are triaged before anyone writes about them. Confirm the expired certificate against the live service, then promote it with every affected host attached and your library's approved remediation text.
Nmap and Masscan results merge into the same host records, so a finding can cite both the Censys observation and the scan that confirmed it, and the client sees which exposures were verified.
Censys Integration FAQ
The questions teams ask most about Censys and Neuron.
How do I import Censys results into a pentest report?
Save the results as JSON with the Censys CLI or API, then upload the file on the engagement's Import page under Censys, or run neuron import --source censys. Hosts and services land on the engagement, and TLS and certificate weaknesses become scan issues you can promote into findings.
Which Censys export formats does Neuron accept?
Censys host JSON: an array of hosts as written by censys search -o, an object with a hits or results array, or a single host record from censys view. Older Censys exports that list ports or protocols instead of services are read too.
Does Neuron turn Censys certificate data into findings?
Into scan issues first. A self-signed or expired leaf certificate, a deprecated negotiated TLS version, or a weak cipher becomes a candidate in Scan Issues, and a tester promotes it into a finding after confirming it against the live service.
Can I import Censys and Shodan results into the same engagement?
Yes. Both importers match hosts already on the engagement, so an address that Censys and Shodan both indexed becomes one host with services from each. Your own Nmap and Masscan results merge into the same records.
Why do I need --source censys on the CLI?
Censys JSON has nothing in it the CLI can reliably tell apart from other JSON, so neuron import asks you to name the importer rather than risk the wrong one. Add --source censys and the files go to the Censys importer.
Where does Censys data end up?
On your own self-hosted Neuron server, inside the engagement you imported it to. Neuron does not query Censys or hold your Censys API credentials, so nothing about the search passes through Neuron or a third-party cloud.
More Neuron Integrations
Shodan Export to Pentest Report Import
External IntelligenceBloodHound Reporting and Attack Path Import
Active DirectoryPCAP Import: Hosts and Services From Captures
Network DiscoveryNessus Reporting and .nessus File Import
Vulnerability ScannersQualys Report Import for Pentest Reporting
Vulnerability ScannersOpenVAS Reporting and Greenbone Report Import
Vulnerability ScannersNexpose and InsightVM Report Import
Vulnerability ScannersOpenAPI and Swagger Import for API Pentests
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform