Shodan Reporting,
Recon That Reaches the Report
Import a Shodan export and every banner becomes a host and service in your engagement, with weak TLS and bad certificates queued for triage. Shodan results, reported.
Import Once. Report From One Place.
Shodan has already scanned your client's perimeter. Its banners show what the internet sees before you have sent a packet, and on an external test that view belongs in the engagement from the first hour, not in a browser tab.
Import a Shodan JSON export and every banner lands as a host and port: IP, hostnames, OS, transport, product, version, and the raw banner. Where Shodan recorded TLS, deprecated protocol versions, weak ciphers, self-signed certificates, and expired certificates become scan issues.
Import from the engagement's Import page or with neuron import --source shodan. Hosts already on the engagement are matched by IP, so Shodan data merges with your own scans instead of duplicating them.
$ shodan download acme-ext net:203.0.113.0/24 Saved 124 results into file acme-ext.json.gz $ gunzip -c acme-ext.json.gz | jq -s . > acme.json$ neuron import --source shodan acme.json✓ Shodan: 31 hosts, 112 ports, 6 scan issues- 08:47 Finding TLS 1.0 enabled on vpn.acme.example
- 08:41 Import Shodan: 31 hosts, 112 ports
- 08:39 Command shodan download acme-ext net:203.0.113.0/24
- 08:37 Command shodan info
Why Shodan Reporting Takes So Long
Shodan answers the first question of every external test, what is exposed, faster than any sweep. The trouble is what happens next: results copied from the web interface into a spreadsheet, filtered by hand, and pasted into the report as a screenshot.
Search results come back one banner per service, so one IP with eight open ports is eight records. Folding them into one host, reconciling hostnames, and spotting the TLS 1.0 endpoint among them is slow and easy to get wrong.
And when the client asks what was exposed last quarter, the answer depends on whether someone kept that export.
Everything Shodan Produces, On the Engagement
Import Shodan output from the browser or with neuron import, and it lands the moment the import finishes.
One Host per IP
However many banners Shodan returned for an address, they fold into one host, with every hostname merged and the OS where Shodan identified one.
Services and Banners
Port, transport, product, and version for each service, with the raw banner kept on the port. When a port appears twice, the latest banner wins.
TLS Scan Issues
Supported SSLv2, SSLv3, TLS 1.0, and TLS 1.1, weak negotiated ciphers such as RC4 or 3DES, and self-signed or expired certificates, each raised for triage.
External Exposure
Dangerous ports on internet-facing addresses are flagged by exposure analysis as soon as the import finishes, along with likely high-value targets.
Service Checklists
Ports that arrive with a service pick up the todos from your Service Checklists, so the external test plan starts from the export.
Merged With Your Scans
Existing hosts are matched by IP. Empty fields fill in, banners refresh, and the import job records every change so it can be rolled back.
How to Import Shodan Results
- 01
Pull the results from Shodan
Run the search with the Shodan CLI and save it with shodan download, or call the Shodan search API, whose matches array Neuron reads as it is.
$ shodan download acme-ext net:203.0.113.0/24 - 02
Turn a download into one JSON array
shodan download writes one banner per line, gzipped. Slurp it into a single array with jq so the importer can read the whole file.
$ gunzip -c acme-ext.json.gz | jq -s . > acme.json - 03
Choose your options
On the Import page, Shodan imports every port by default, skips hosts with no ports, and turns TLS weaknesses into scan issues. Add tags or an assessment to keep external results apart.
- 04
Import the file
Upload or paste it on the engagement's Import page, or name the source on the CLI. Shodan JSON is not auto-detected, so --source shodan is required.
$ neuron import --source shodan --tag external acme.json
Your Infrastructure. Your Data.
Neuron is self-hosted. Import Shodan results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
From Shodanto the Final Report
The external attack surface section starts from what the internet already indexed. Every exposed service is on the engagement with its banner as evidence, so the report shows what an outside attacker would see first.
TLS issues wait in Scan Issues. Confirm the TLS 1.0 endpoint against the live host, then promote it into a finding with every affected host and port attached and the approved wording from your Findings Library.
Your own scans then confirm or correct Shodan. Nmap and Masscan results merge into the same hosts, so stale banners are replaced and the final report reflects what you tested, not only what was indexed.
Shodan Integration FAQ
The questions teams ask most about Shodan and Neuron.
How do I import Shodan results into a pentest report?
Export the results as JSON, then upload them on the engagement's Import page under Shodan, or run neuron import --source shodan with the file. Each banner becomes a host and port in the engagement, and TLS weaknesses become scan issues you can promote into findings.
Which Shodan export format does Neuron accept?
Shodan JSON in three shapes: an array of banner records, a search response with a matches array as the Shodan API returns it, or a single banner record. Output from shodan download is newline-delimited, so combine it into one array with jq -s first.
Does Neuron import the vulns list from Shodan?
No, deliberately. Shodan infers those CVEs from version strings rather than testing for them, so Neuron keeps them out of the triage queue. It does raise the TLS problems Shodan actually observed, such as deprecated protocols, weak ciphers, and self-signed or expired certificates.
What happens to hosts already on the engagement?
They are matched by IP. A Shodan import fills in an empty OS, adds new hostnames, refreshes banners, and sets product and version only where they were blank. Every change is recorded on the import job, so it can be rolled back.
Why does neuron import need --source shodan?
Shodan JSON carries no marker that sets it apart from other JSON, and the CLI never guesses at a format. Naming the source with --source shodan sends the file to the right importer.
Does Neuron send our queries or API key to Shodan?
No. Neuron never calls Shodan. You run the search with your own key, and the export is imported into your self-hosted Neuron server, where it stays.
More Neuron Integrations
Censys Export Import and Attack Surface Report
External IntelligenceBloodHound Reporting and Attack Path Import
Active DirectoryPCAP Import: Hosts and Services From Captures
Network DiscoveryNessus Reporting and .nessus File Import
Vulnerability ScannersQualys Report Import for Pentest Reporting
Vulnerability ScannersOpenVAS Reporting and Greenbone Report Import
Vulnerability ScannersNexpose and InsightVM Report Import
Vulnerability ScannersOpenAPI and Swagger Import for API Pentests
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform