> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro/installation.md).

# Installation and licensing

Load the extension, activate your license and connect the data pack.

Use Burp Suite Professional for the complete scanning and persistent-project workflow. Load the extension with the Java runtime used by Burp; you do not need to install a separate native JNA library for the current packaged JAR.

A Pro subscription is for **one individual user** and includes Server access. Its **10 registered activations are shared across Pro and Server**. See [users, products and activations](/licensing.md).

## Install the extension

1. Download the Burp Bounty Pro release JAR and its data pack from your distribution channel.
2. In Burp, open **Extensions → Installed → Add**.
3. Select **Java**, choose the supplied JAR and finish loading it. Development builds are named `BurpBountyPro-4.0.0-jar-with-dependencies.jar`.
4. Confirm that the **Burp Bounty Pro** tab appears and inspect extension errors if loading fails.
5. An existing activation on the same computer and user account is detected automatically when its saved data is available. For a first installation, open the **License** tab, enter your key and activate it. Check the status and expiration date.

![Adding a Java extension in Burp Suite](https://710436228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0ure45w5tAMFDkq49ZN%2Fuploads%2Fgit-blob-9a9706b131d4785294ea47ed53d59051b7c34759%2Finstallation-add-dialog.png?alt=media)

## Configure the data pack

Extract the release with `BurpBountyData` next to the JAR, preserving this layout:

```
BurpBountyPro-4.0.0-jar-with-dependencies.jar
BurpBountyData/
  profiles/
    example.bb
  rules/
    rule_example.bb
```

{% hint style="info" %}
**Choose the pack root**

On a new installation, Pro validates and copies the adjacent pack into your user storage directory. The source pack is retained. A previously configured data directory takes precedence and is kept in place, preserving custom profiles and rules.

To use another pack, open **Settings → General**, use **Directory** to select the **base `BurpBountyData` directory**, then **Reload**. Pro locates its `profiles` and `rules` subdirectories. This differs from Server's `--profiles-dir`, which points directly to `BurpBountyData/profiles`.
{% endhint %}

Check the three profile tables and the Rules table. The catalogue is supplied as files; it is not a catalogue to extract from the extension JAR. Counts vary by pack and by enabled state; see the [reviewed pack inventory](/creating-profiles/default-profiles.md).

The legacy name `BurpBountyData_3.0` is recognized. If a saved directory with that name was renamed to `BurpBountyData` in the same parent directory, Pro detects the new name. Other moves require selecting the new location. An absent or invalid pack produces an error; an empty directory does not count as an installed catalogue.

## Persistent user storage

Pro stores its configuration in `settings.json`: profile-directory selection, license key, Burp Bounty Servers, AI provider/API key/model/endpoint, custom AI prompts, custom variables, proxy settings and live scanner preferences. LicenseSpring manages its activation cache in `BurpBountyPro_license.key`. The storage directory is independent of the JAR filename and release version:

| System  | Default directory                                                              |
| ------- | ------------------------------------------------------------------------------ |
| macOS   | `~/Library/Application Support/BurpBountyPro/`                                 |
| Windows | `%LOCALAPPDATA%\BurpBountyPro\`                                                |
| Linux   | `$XDG_DATA_HOME/BurpBountyPro/`, or `~/.local/share/BurpBountyPro/` when unset |

Existing Burp preferences and known legacy license-file locations are imported automatically. Previous files remain available for rollback. Server entries retain their names, addresses, ports, credentials and enabled state; connection status is checked again after loading. Removing a server or variable, clearing a filter or API key, and disabling an option are also persisted. Old Burp preferences do not restore values that you deliberately removed. Migration preserves saved custom AI prompts exactly; it does not replace them based on their contents.

### When changes are saved

General and live scanner controls save automatically after a short pause in editing, or when you press Enter or leave a field. Invalid numeric input is marked and is not saved. Variable edits save when you commit the table cell; additions and removals save immediately. AI connection settings use **Save**, and the prompt editor has its own **Save** button. Closing Burp is not required to retain committed changes.

If saving fails, Pro displays an error instead of reporting success. Fix the storage problem before editing further. Related AI settings and proxy settings are written together to avoid partially updated credentials or endpoints.

### Restricted computers and custom locations

No administrator privileges or write access beside the JAR are required. In **Settings → Storage**, choose an empty writable storage directory and then unload/reload the extension before making further changes. This copies the stored settings and license cache; existing profile directories remain at their configured locations. The Storage tab is available even when licensing cannot write its cache.

For managed installations, set `BURPBOUNTYPRO_HOME` to an **absolute directory path before starting Burp**. A Java system property, `-Dburpbountypro.home=/absolute/path`, is also supported. The precedence is: Java property, environment variable, saved Burp location, saved default-location pointer, platform default. An explicit override must be changed outside the extension.

If the default location cannot save a pointer to your custom directory, Pro reports that limitation and saves the selection in Burp preferences. Use the environment variable or Java property to make that custom location independent of those preferences too. No credentials are silently moved to a temporary directory.

Profiles on a read-only filesystem can be loaded and scanned. Choose a writable copy before editing profiles/rules or updating the pack. A bundled pack can be read in place if importing it fails; the error explains that it must be retained beside the JAR until writable storage is configured.

Settings use atomic replacement, a previous-version `settings.json.bak`, and file locking. Changes to unrelated settings can coexist across Burp instances. A conflicting edit to the same setting or configuration group is rejected. Reload the extension before repeating a conflicting AI, variable or general-setting edit. For server entries, the latest saved list is loaded automatically; repeat the edit against that list. Filesystems that cannot provide atomic replacement report an error instead of risking a partial settings file. Secret-bearing files use owner-only permissions on POSIX and an owner ACL where supported on Windows. API keys and proxy passwords are stored in readable form inside these protected files, not encrypted. Treat `settings.json`, its backup, and storage-directory backups as secrets.

If `settings.json` is corrupt, Pro can read its previous backup but refuses to overwrite the corrupt original. Close the extension, retain a copy of the damaged file and restore `settings.json.bak` as `settings.json` before editing settings again. Do not restore a backup while another Burp instance is using the same storage.

Moving a JAR on the same machine does not require a new activation. Moving to another computer remains subject to the license activation policy. A failed license check, including a connection failure, does not automatically trigger another activation or delete the local cache.

## Updating and rollback

Keep the previous JAR, a copy of your data directory and any custom profiles/rules before replacing a release. Use the update controls in **About** to check available packages. Treat data-pack updates as file changes: compare your customizations before replacing them.

Unload the old extension and load the intended new JAR. Keep the user storage directory: its profile selection, license, server list and other saved preferences are reused automatically. Check the complete path in Burp's Installed extensions table; a similarly named JAR on the Desktop may be an older build. Avoid keeping duplicate versions loaded.

## Apple Silicon and license errors

The packaged build includes the JNA native support used by licensing and initializes it for Burp's class-loading environment. If `Unable to locate JNA native support library` appears, first verify the JAR path and reload the current complete build. Preserve the full extension error for diagnosis; repeatedly activating a license will not repair a missing native library.

A license activation problem and a native-library loading problem are different failures. For server startup and header authentication, use the [Server licensing guide](/burp-bounty-server/installation.md).