Default rule inventory
Inspect the reviewed Smart Scan rules and their profile dependencies.
The pack reviewed on 2026-10-04 contains 28 rules: 24 enabled, 4 disabled. Rules belong to Pro's Smart Scan and are stored as .bb arrays in BurpBountyData/rules.
Read the current rule semantics and limitations before treating multi-row And or First Match as hard execution constraints. The tables preserve the pack's references and do not assert that every dependency resolves.
Unresolved references
Wordpress_Rule→ execute referenceeasy_wp_smtp_listing_enabledis absent from this pack.
These are documented dependencies to review; the documentation generator does not modify rules or profiles.
Inventory
Artica_Web_Proxy_Auth_bypass
Yes
Artica_Web_Request; Artica_Web
Profile / CVE-2020-17506_Artica_Web_Proxy_Auth_Bypass / All Matches
Cisco_Rule
Yes
Cisco_ASA_Device_Found; Cisco_Request_Detected
Profile / CVE-2020-3452_Cisco_ASA_LFI / All Matches; Profile / CVE-2019-1653_Cisco_Wan_VPN_disclosure / All Matches
Citrix_Rule
Yes
Citrix_Detection
Profile / CVE-2019-19781_Citrix_ADC_Directory_Traversal / All Matches; Profile / CVE-2020-8209_Citrix_XenMobile_PathTraversal / All Matches; Profile / CVE-2020-8982_Citrix_ShareFile_File_Read / All Matches
CouchDB_Admin_Exposure
Yes
CouchDB_Request; CouchDB_Response
Profile / CouchDB_Admin_Exposure / All Matches
Drupal_Rule
Yes
Drupal_Response
Profile / Drupal_User_Enum / All Matches; Profile / Drupal_User_Enum_Redirect / All Matches
Firebase Database Rule
Yes
Firebase DB detected
Profile / Open Firebase Database / First Match
Fortinet_Fortigate
Yes
Fortinet_Request; Fortinet_Panel
Profile / CVE-2018-13379_FortiOS_Creds_Disclosure / All Matches
Jira_Rule
Yes
Jira_Request
Profile / CVE-2020-14179_Jira_Info_Exposure / All Matches; Profile / CVE-2020-14181_Jira_User_Enum / All Matches; Profile / CVE-2017-9506_Jira_SSRF / All Matches; Profile / CVE-2019-8442_Jira_Path_Traversal / All Matches; Profile / CVE-2019-8449_Jira_Unauthenticated_Sensitive_Info / All Matches; Profile / Jira_unauthenticated_Info / All Matches
Kubernetes_Rule
Yes
Kubernetes_Response
Profile / Kubernetes_API_Exposed / All Matches
LFI_Rule
Yes
LFI_RFI_Parameters; URL_Path_as_a_Value
Profile / PathTraversal_Linux / All Matches; Profile / PathTraversal_Windows / All Matches
MAGMI_Remote_Auth
Yes
MAGMI_Request; MAGMI_Response
Profile / CVE-2020-5777_MAMGI_Auth_Bypass / All Matches
Netsweeper_CodeInjection
Yes
Netsweeper_Request; Netsweeper_Response
Profile / CVE-2020-13167_Netsweeper_code_injection / All Matches
OpenRedirect_SSRF_Rule
Yes
OpenRedirect_SSRF_Parameters; URL_as_a_Value; URL_Path_as_a_Value
Profile / OpenRedirect / All Matches; Profile / OpenRedirect_SSRF_Collaborator / All Matches; Profile / Openredirect_to_XSS / All Matches; Profile / OpenRedirect_to_Account_Takeover / All Matches; Profile / SSRF-Collaborator / All Matches; Profile / SSRF-URLScheme / All Matches; Profile / SSRF_Collaborator_HTTP1_0 / All Matches; Profile / SSRF_Collaborator_HTTP0_9 / All Matches; Profile / OpenRedirect-ParameterPollution / All Matches; Profile / OpenRedirect-ParameterPollution_Path / All Matches
RCE_Rule
Yes
RCE_Parameters
Profile / RCE_Linux / All Matches; Profile / Blind_RCE_Linux / All Matches; Profile / Blind_RCE_Windows / All Matches; Profile / Echo_RCE / All Matches; Profile / Expect_RCE / All Matches; Profile / PHP_RCE / All Matches; Profile / RCE_Windows / All Matches
Scan all requests with all Profiles
No
All_Requests_And_Parameters
Tag / All / All Matches
Scan all requests with log4shell profiles
No
All_Requests_And_Parameters
Profile / CVE-2021-44228_RCE_Log4j / All Matches; Profile / CVE-2021-44228_RCE_Log4j_GETPOST / All Matches; Profile / CVE-2021-44228_RCE_Log4j_urlEncode / All Matches
Scan all requests with Open redirect profiles
No
All_Requests_And_Parameters
Tag / Open Redirect / All Matches
Scan all requests with SSRF
No
All_Requests_And_Parameters
Tag / SSRF / All Matches
Solarwinds
Yes
Solarwinds_Orion_Request; Solarwinds_Orion_Response
Profile / Solarwinds_default_admin / All Matches
SpringBoot_Rule
Yes
Springboot_Requests
Profile / Spring_Boot_Actuators / All Matches
SQLi_Rule
Yes
SQLi_Parameters
Profile / SQLi / All Matches; Profile / SQLi_Timebased_Encoded_Space / All Matches
SSTI_Rule
Yes
SSTI_Parameters
Profile / SSTI / All Matches
Symfony_Rule
Yes
Symfony_Response
Profile / Symfony_Debug / All Matches
Traefik_Rule
Yes
Traefik_Response
Profile / CVE-2020-15129_Traefik_Open_Redirect / All Matches
Weblogic_Rule
Yes
Weblogic_Request
Profile / CVE-2020-2551_Oracle_WebLogic / All Matches
Wordpress_Rule
Yes
Wordpress detection
Profile / Wordpress_user_enum_oembed / First Match; Profile / Wordpress_users_enum_yoastseo / First Match; Profile / Wordpress_user_enum_json / First Match; Profile / Wordpress_directory_listing / First Match; Profile / Woody_Wordpress_RCE / First Match; Profile / CVE-2020-24312_File_Manager_Wordpress_Backups / First Match; Profile / Wordpress_Path_Traversal / First Match; Profile / Wordpress_Config_Accessible / First Match; Profile / easy_wp_smtp_listing_enabled / First Match; Profile / CVE-2020-11738_Wordpress_Duplicator_Plugin_LFI / First Match
XSS_Rule
Yes
XSS_Parameters
Profile / XSS / All Matches; Profile / XSS_URLEncode / All Matches; Profile / XSS_HtmlUrlEncode / All Matches; Profile / XSS_GETPOST / All Matches; Profile / XSS_HTML_Tag_Context / All Matches; Profile / XSS_HTML_Attribute_Context / All Matches; Profile / XSS_JavaScript_Context / All Matches
XXE_Rule
Yes
XML_Content_Detected; XML_Response_Detected
Tag / XXE / All Matches
For exact enabled-row flags, operators, scopes, comments and filenames, download the inventory JSON. This metadata does not replace the rule files or their required profiles.
Last updated