> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro-rules/default-rules.md). # Default rule inventory Inspect the reviewed Smart Scan rules and their profile dependencies. The pack reviewed on **2026-10-04** contains **28 rules**: **24 enabled**, **4 disabled**. Rules belong to Pro's Smart Scan and are stored as `.bb` arrays in `BurpBountyData/rules`. Read the [rule semantics](/burp-bounty-pro-rules/reference.md) for same-exchange And conditions and per-session First Match actions. The tables preserve the pack's exact profile references; dependency checks are listed below. ## Unresolved references All referenced profile names and tags were found in this snapshot. ## Inventory | Rule | Enabled | Passive references | Active actions | | --------------------------------------------- | ------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Artica\_Web\_Proxy\_Auth\_bypass | Yes | Artica\_Web\_Request; Artica\_Web | Profile / CVE-2020-17506\_Artica\_Web\_Proxy\_Auth\_Bypass / All Matches | | Cisco\_Rule | Yes | Cisco\_ASA\_Device\_Found; Cisco\_Request\_Detected | Profile / CVE-2020-3452\_Cisco\_ASA\_LFI / All Matches; Profile / CVE-2019-1653\_Cisco\_Wan\_VPN\_disclosure / All Matches | | Citrix\_Rule | Yes | Citrix\_Detection | Profile / CVE-2019-19781\_Citrix\_ADC\_Directory\_Traversal / All Matches; Profile / CVE-2020-8209\_Citrix\_XenMobile\_PathTraversal / All Matches; Profile / CVE-2020-8982\_Citrix\_ShareFile\_File\_Read / All Matches | | CouchDB\_Admin\_Exposure | Yes | CouchDB\_Request; CouchDB\_Response | Profile / CouchDB\_Admin\_Exposure / All Matches | | Drupal\_Rule | Yes | Drupal\_Response | Profile / Drupal\_User\_Enum / All Matches; Profile / Drupal\_User\_Enum\_Redirect / All Matches | | Firebase Database Rule | Yes | Firebase DB detected | Profile / Open Firebase Database / First Match | | Fortinet\_Fortigate | Yes | Fortinet\_Request; Fortinet\_Panel | Profile / CVE-2018-13379\_FortiOS\_Creds\_Disclosure / All Matches | | Jira\_Rule | Yes | Jira\_Request | Profile / CVE-2020-14179\_Jira\_Info\_Exposure / All Matches; Profile / CVE-2020-14181\_Jira\_User\_Enum / All Matches; Profile / CVE-2017-9506\_Jira\_SSRF / All Matches; Profile / CVE-2019-8442\_Jira\_Path\_Traversal / All Matches; Profile / CVE-2019-8449\_Jira\_Unauthenticated\_Sensitive\_Info / All Matches; Profile / Jira\_unauthenticated\_Info / All Matches | | Kubernetes\_Rule | Yes | Kubernetes\_Response | Profile / Kubernetes\_API\_Exposed / All Matches | | LFI\_Rule | Yes | LFI\_RFI\_Parameters; URL\_Path\_as\_a\_Value | Profile / PathTraversal\_Linux / All Matches; Profile / PathTraversal\_Windows / All Matches | | MAGMI\_Remote\_Auth | Yes | MAGMI\_Request; MAGMI\_Response | Profile / CVE-2020-5777\_MAMGI\_Auth\_Bypass / All Matches | | Netsweeper\_CodeInjection | Yes | Netsweeper\_Request; Netsweeper\_Response | Profile / CVE-2020-13167\_Netsweeper\_code\_injection / All Matches | | OpenRedirect\_SSRF\_Rule | Yes | OpenRedirect\_SSRF\_Parameters; URL\_as\_a\_Value; URL\_Path\_as\_a\_Value | Profile / OpenRedirect / All Matches; Profile / OpenRedirect\_SSRF\_Collaborator / All Matches; Profile / Openredirect\_to\_XSS / All Matches; Profile / OpenRedirect\_to\_Account\_Takeover / All Matches; Profile / SSRF-Collaborator / All Matches; Profile / SSRF-URLScheme / All Matches; Profile / SSRF\_Collaborator\_HTTP1\_0 / All Matches; Profile / SSRF\_Collaborator\_HTTP0\_9 / All Matches; Profile / OpenRedirect-ParameterPollution / All Matches; Profile / OpenRedirect-ParameterPollution\_Path / All Matches | | RCE\_Rule | Yes | RCE\_Parameters | Profile / RCE\_Linux / All Matches; Profile / Blind\_RCE\_Linux / All Matches; Profile / Blind\_RCE\_Windows / All Matches; Profile / Echo\_RCE / All Matches; Profile / Expect\_RCE / All Matches; Profile / PHP\_RCE / All Matches; Profile / RCE\_Windows / All Matches | | Scan all requests with all Profiles | No | All\_Requests\_And\_Parameters | Tag / All / All Matches | | Scan all requests with log4shell profiles | No | All\_Requests\_And\_Parameters | Profile / CVE-2021-44228\_RCE\_Log4j / All Matches; Profile / CVE-2021-44228\_RCE\_Log4j\_GETPOST / All Matches; Profile / CVE-2021-44228\_RCE\_Log4j\_urlEncode / All Matches | | Scan all requests with Open redirect profiles | No | All\_Requests\_And\_Parameters | Tag / Open Redirect / All Matches | | Scan all requests with SSRF | No | All\_Requests\_And\_Parameters | Tag / SSRF / All Matches | | Solarwinds | Yes | Solarwinds\_Orion\_Request; Solarwinds\_Orion\_Response | Profile / Solarwinds\_default\_admin / All Matches | | SpringBoot\_Rule | Yes | Springboot\_Requests | Profile / Spring\_Boot\_Actuators / All Matches | | SQLi\_Rule | Yes | SQLi\_Parameters | Profile / SQLi / All Matches; Profile / SQLi\_Timebased\_Encoded\_Space / All Matches | | SSTI\_Rule | Yes | SSTI\_Parameters | Profile / SSTI / All Matches | | Symfony\_Rule | Yes | Symfony\_Response | Profile / Symfony\_Debug / All Matches | | Traefik\_Rule | Yes | Traefik\_Response | Profile / CVE-2020-15129\_Traefik\_Open\_Redirect / All Matches | | Weblogic\_Rule | Yes | Weblogic\_Request | Profile / CVE-2020-2551\_Oracle\_WebLogic / All Matches | | Wordpress\_Rule | Yes | Wordpress detection | Profile / Wordpress\_user\_enum\_oembed / First Match; Profile / Wordpress\_users\_enum\_yoastseo / First Match; Profile / Wordpress\_user\_enum\_json / First Match; Profile / Wordpress\_directory\_listing / First Match; Profile / Woody\_Wordpress\_RCE / First Match; Profile / CVE-2020-24312\_File\_Manager\_Wordpress\_Backups / First Match; Profile / Wordpress\_Path\_Traversal / First Match; Profile / Wordpress\_Config\_Accessible / First Match; Profile / Easy\_wp\_smtp\_listing\_enabled / First Match; Profile / CVE-2020-11738\_Wordpress\_Duplicator\_Plugin\_LFI / First Match | | XSS\_Rule | Yes | XSS\_Parameters | Profile / XSS / All Matches; Profile / XSS\_URLEncode / All Matches; Profile / XSS\_HtmlUrlEncode / All Matches; Profile / XSS\_GETPOST / All Matches; Profile / XSS\_HTML\_Tag\_Context / All Matches; Profile / XSS\_HTML\_Attribute\_Context / All Matches; Profile / XSS\_JavaScript\_Context / All Matches | | XXE\_Rule | Yes | XML\_Content\_Detected; XML\_Response\_Detected | Tag / XXE / All Matches | For exact enabled-row flags, operators, scopes, comments and filenames, download the [inventory JSON](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/reference/catalogue.json). This metadata does not replace the rule files or their required profiles.