> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro-rules/examples.md).

# Examples

Start with small automation patterns and verify the requests they launch.

## Minimal learning example

The [debug-to-reflection rule](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/examples/rules/rule_Example_Debug_To_Reflection.bb) has one exact passive trigger and one active action. It is suitable for learning the format with the provided fixtures; it does not claim that a `debug` parameter is a vulnerability.

## SQL injection candidates from the reviewed pack

The pack's `SQLi_Rule` uses this trigger/action selection:

```json
{
  "match": ["true,,Passive Request,SQLi_Parameters"],
  "execute": [
    "true,Profile,SQLi,All Matches",
    "true,Profile,SQLi_Timebased_Encoded_Space,All Matches"
  ]
}
```

This is a rule fragment, not a complete profile. Parameter names are a heuristic for selecting tests, not evidence of SQL injection. Confirm the resulting request scope and findings.

## Technology detection

A passive response profile can identify an application technology and trigger a specific active check. Prefer the narrowest useful selection, especially when a technology tag contains many historical CVEs. Detecting WordPress does not establish that every WordPress plugin is present.

The `Wordpress_Rule` action now references the exact installed profile name, `Easy_wp_smtp_listing_enabled`. Names are case-sensitive: keep the rule and profile together when updating the pack.

## Multiple conditions

For request and response rows connected by `And`, both profiles must match the same exchange. Test an exchange matching only the request condition, one matching only the response condition, and one matching both. Only the last should queue the action. See [grouping and action scope](/burp-bounty-pro-rules/reference.md).

## Broad tag actions

```
true,Tag,All,All Matches
```

This action can select a large set of enabled active profiles. The reviewed pack includes disabled broad scanning rules for this reason. Keep broad rules disabled unless their scope and traffic are deliberate. Changing a tag's membership also changes the selected work.

For the full current pack listing, see [default rules](/burp-bounty-pro-rules/default-rules.md).