Overview

Capture traffic, run focused scans and investigate findings inside Burp Suite.

Burp Bounty Pro is the Burp Suite extension. It combines a profile editor, local active and passive scanners, rule-based Smart Scan, AI-assisted analysis, and remote execution through Burp Bounty Server.

Typical workflow

1. Install the extension, activate the license and select the BurpBountyData directory.

2. Capture representative requests in Burp, including authentication and any response needed for passive analysis.

3. Enable the profiles relevant to the application, or create your own.

4. Right-click a request and choose Burp Bounty Pro → Local Scanner or Burp Bounty Server Scanner.

5. Review the selected URLs and performance limits before starting.

6. Inspect scan progress and findings in Burp; verify the evidence before reporting a vulnerability.

Which scanner should I use?

Scanner	Purpose
Active Scan	Inject payloads from selected enabled profiles.
Passive Scan	Analyze existing requests/responses without active probe requests.
Smart Scan	Use passive detections to select active checks through Pro rules. It can send traffic.
AI Scanner	Ask a configured model to analyze a request/response and optionally launch local active profiles.
Live scanners	Apply the configured workflow to traffic observed while enabled.
Burp Bounty Server Scanner	Execute active or passive work on one or more configured servers.

Smart Scan and the built-in AI Scanner remain Pro features. Connecting an external agent to the Server MCP does not expose the Pro interface, Burp's proxy history or Burp's project automatically. A separate Burp Suite MCP connection is a different service.

For a tour of the tabs and menus, see the interface guide.

Keep exploring

Run your first scan

Follow a request from selection to finding.

Connect a server

Add execution capacity while working in Burp.