Passive scanning
Find useful signals in requests and responses you have already captured.
Passive profiles inspect existing traffic. Passive Request checks inspect requests; Passive Response checks inspect captured responses. They do not inject payloads or fetch missing responses.
Manual scan
Select exchanges in Burp.
Choose Burp Bounty Pro → Local Scanner → Passive Scan.
Select all passive profiles, a request/response category, or a tag.
Review the URL selection and passive processing settings.
Inspect Scanners → Passive and Burp's issues.
For server execution choose the same category under Burp Bounty Server Scanner. Pro uploads the exchanges and chosen profiles. Remote findings populate both Burp's issue system and the extension's Passive view; repeated polling should not create duplicate entries.
Live passive scanning
Enable Live Passive Scan in Settings → General when you want to analyze observed traffic continuously. Review Only in-scope items, excluded extensions, excluded methods, Threads and Passive Concurrency. Turn it off when you no longer want automatic analysis.
These are processing controls, not an active scan RPS limit. Running passive checks on a response that was originally obtained by browsing remains passive analysis of that exchange.
Common reasons for no findings
Request-only input
Response profiles need a response.
No applicable profiles
Enabled state, scanner type and tag.
Match in the wrong component
Request name/value selection or response header/body scope.
Profile filter excludes the exchange
Status, content type and URL extension conditions.
Results retrieval failed
Inspect the error; a read failure is not an empty result set.
For agent-driven passive analysis, see the MCP examples.
Last updated