Invicti Reporting,
Proof of Concept Included
Invicti report import for current JSON and legacy Netsparker XML exports. Every vulnerability lands with its proof of concept, request, and response, ready to triage.
Import Once. Report From One Place.
Invicti, formerly Netsparker, backs many of its findings with a proof of concept. That proof is the most valuable thing in the report and the first thing lost when results are copied into a document. Neuron imports it intact.
The current JSON export and the legacy Netsparker XML are both read. Each vulnerability type becomes one scan issue with its name, severity, CVSS 3.1 score, CWE, description, impact, remedy, and references, and every affected URL and vulnerable parameter keeps its own proof of concept, certainty, raw request, and raw response.
Each scanned target becomes a web app with its host and port, and affected URLs become endpoints and params. Minimum Severity and Minimum Certainty decide what reaches the queue.
$ neuron import --source invicti \ acme-portal-invicti.json --tag web Importing into Acme Web App Q4 invicti: 1 web app, 48 endpoints, 22 params✓ 31 scan issues queued for triage- 10:55 Finding Boolean-Based SQL Injection in /search (q)
- 10:38 Import Invicti: 1 web app, 31 scan issues
- 10:37 Command neuron import --source invicti acme-portal-invicti.json
- 09:14 Import Acunetix: 1 web app, 29 scan issues
Why Invicti Reporting Takes So Long
Invicti reports are thorough and long. The same vulnerability type on twenty URLs is twenty entries, each with its own request and response, and the certainty score that separates a confirmed issue from a probable one is easy to skim past.
Legacy Netsparker exports make it harder, with HTML embedded straight into the XML that trips up most quick conversion scripts.
So the proof gets screenshotted, the request gets pasted as an image, and the retest means opening the scanner again to work out what changed.
Everything Invicti Produces, On the Engagement
Import Invicti output from the browser or with neuron import, and it lands the moment the import finishes.
Web Apps, Endpoints, and Params
Each scanned target as a web app with host and port, and each affected URL and vulnerable parameter as an endpoint and param.
One Issue per Vulnerability Type
Every vulnerability grouped by its Invicti type, with each affected URL and parameter listed as its own resource.
Proof of Concept
The proof of concept Invicti produced for each affected resource, kept as the evidence for that row.
Request and Response
The raw HTTP request and response for every affected resource, one click away under Show evidence.
Certainty and Confirmation
Invicti's certainty percentage and confirmed flag, kept as attributed scanner detail so triage knows what the scanner itself proved.
CVSS, CWE, and References
The CVSS 3.1 base score where present, CWE IDs, and the external and remedy reference links from the report.
How to Import Invicti Results
- 01
Export the scan report
Export the finished scan as JSON from current Invicti, or as XML from an older Netsparker install. Both keep the proof of concept, request, and response for every vulnerability.
- 02
Import it in the browser
In the engagement, choose Import, then Invicti. Set Minimum Severity and Minimum Certainty, choose whether to create web apps and hosts and ports, and click Start Import.
- 03
Or import it from the terminal
Pass the file to neuron import with --source invicti. The Invicti importer works out whether it is JSON or XML on its own.
$ neuron import --source invicti acme-portal-invicti.json --tag web - 04
Triage against the proof
Open each issue, read the proof of concept, request, and response under each affected URL, then confirm it and promote it into a finding.
Your Infrastructure. Your Data.
Neuron is self-hosted. Import Invicti results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
From Invictito the Final Report
Each promoted Invicti issue carries the affected URLs, the vulnerable parameters, and the proof of concept into the finding, so the client sees exactly how it was exploited.
Findings Library language replaces the scanner's generic remedy text with remediation your team has approved, and the finding goes through the same QA pipeline as everything else on the engagement.
For the retest, rescan and import the new report. Vulnerabilities that no longer appear are marked Fixed, and a report imported by mistake can be rolled back from Import Jobs.
Invicti Integration FAQ
The questions teams ask most about Invicti and Neuron.
How do I import Invicti results into a pentest report?
Export the Invicti scan as JSON, or as XML from an older install, and import it into the Neuron engagement from the Import page or with neuron import --source invicti. Each vulnerability becomes a scan issue with its proof of concept, request, and response attached.
Can Neuron import Netsparker exports?
Yes. Invicti was formerly Netsparker, and Neuron reads the legacy Netsparker XML, the rebranded Invicti XML, and the current Invicti JSON export, including XML with HTML embedded in its descriptions.
Which Invicti export format should I use?
The JSON export from current Invicti releases. Legacy XML from Netsparker or older Invicti installs works too. Either way the proof of concept, raw request, and raw response come across.
What does Minimum Certainty do on an Invicti import?
Invicti scores each vulnerability from 0 to 100 for how certain it is. Minimum Certainty drops anything below the score you set, so probable findings can stay out of the queue until you want them.
Does the Invicti request and response come across?
Yes. Every affected URL and parameter keeps the raw HTTP request and response along with the proof of concept. Show evidence opens them under the resource in the Scan Issues queue.
Where do Invicti results live?
In your own self-hosted Neuron server, on the engagement they belong to. Nothing passes through a third-party cloud.
More Neuron Integrations
Burp Suite Reporting and Findings Import
Web TestingZAP Reporting and OWASP ZAP Alert Import
Web TestingCaido Reporting and HTTP History Import
Web TestingOpenAPI and Swagger Import for API Pentests
Web TestingNuclei Scan Reporting and Import
Web Testingffuf Reporting and Content Discovery Logging
Web TestingNikto Reporting and Output Import
Web TestingAcunetix Report Import for Pentest Reports
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform