> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro/active-scan.md).

# Active scanning

Choose profiles, send probes and review the evidence behind each finding.

An active scan creates modified requests from enabled profiles and sends them to the application. Each profile defines payloads, insertion points, transformations and the evidence needed for a match.

## Launch locally

Select requests, then choose **Burp Bounty Pro → Local Scanner → Active Scan → tag**. Review filters and set **Concurrency** and **Requests per second**. The budget applies across the requests selected for that local batch, not independently at full speed for every URL.

Use the [Server Scanner](/burp-bounty-pro/remote-scanning.md) menu to move execution to server machines. The HTTP service associated with the original Burp message is carried with the request, preserving HTTP/HTTPS and the port.

## Payload strategy

The **Burp Bounty Server Scanner** dialog selects **Show one success payload for insertion point** by default. This allows early stopping after a match where the profile workflow supports it. **Show all success payloads for insertion point** continues testing payloads and can produce more requests and findings. Local active scans also stop after a match for each applicable profile and insertion point. Multi-step checks and asynchronous Collaborator checks have additional execution requirements; do not infer exact traffic from the number of issues shown.

## Scope and insertion points

A profile's insertion points decide what is mutated. URL filters decide which source requests are included. These are separate choices.

For Pro's per-host profiles (`scanScope: 1`), planning avoids repeatedly applying the same profile to every URL of the same service. The service includes protocol, host and port. This planning also applies when Pro dispatches work to Server; standalone Server callers must plan their own per-host work.

For an agent scanning only one parameter through Server, use [exclusive insertion selection](/burp-bounty-server/insertion-selection.md). `$BBOUNTY$` is not a local Pro scanner switch.

## Understand the count

The initial total is a work estimate. Later steps depend on earlier matches; controls, baseline requests, redirects, unavailable prerequisites and early stopping can change actual work. Local and Server engines need not produce identical totals for the same tag. Compare the selected profiles, input service, payload strategy, warnings and final evidence before treating a difference as lost coverage.

## Review findings

Inspect the complete request/response chain, affected parameter, match scope and confidence. Reflection alone is not proof of XSS; a slow response alone is not proof of time-based SQL injection. Use an appropriate control and the [profile validation workflow](/creating-profiles/validation.md).