> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro/quick-start.md).

# Quick start

Go from a captured request to a finding you can inspect.

## 1. Pick a representative request

Capture a request to your test application with working authentication. In **Profiles → Active Profiles**, enable a small relevant set and check its tags.

## 2. Choose a scanner and a budget

Right-click the request in Proxy, Repeater or the site map. Choose **Burp Bounty Pro → Local Scanner → Active Scan → your tag**, then review the URL filter.

{% hint style="info" %}
**A starting point:** Concurrency **5**, Requests per second **10**. Concurrency limits simultaneous requests; RPS limits their start rate. Neither guarantees a particular scan duration.
{% endhint %}

## 3. Follow the scan and inspect the evidence

Start the scan and follow **Scanners → Active** and the Dashboard. Open each reported issue and compare the payload, response and matched evidence.

## Try a different workflow

{% tabs %}
{% tab title="Passive analysis" %}
Choose **Local Scanner → Passive Scan**, then the request/response category and tag. Response checks need a captured response. Results appear in **Scanners → Passive** and matching findings are also registered as Burp issues. A passive check does not send attack payloads.
{% endtab %}

{% tab title="Server execution" %}

1. [Start a Burp Bounty Server](/burp-bounty-server/installation.md).
2. [Add it in Settings → Burp Bounty Servers](/burp-bounty-pro/remote-scanning.md).
3. Wait for **Healthy**.
4. Choose **Burp Bounty Server Scanner → Active Scan** or **Passive Scan**.
5. Select a server or all eligible servers, set the budget scope and start.

Pro sends the chosen profiles with the scan. A server-side profile catalogue is needed for MCP name/tag discovery, not for these extension uploads.
{% endtab %}
{% endtabs %}

## Before increasing coverage

Confirm that the expected insertion point was mutated, authentication still works, and the signal distinguishes a positive case from a control. Increase the profile set and request budget gradually. A status of **Finished** means processing ended; it is not proof that every vulnerability class had the prerequisites it needed.

## Keep exploring

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Understand scan states</strong></td><td>Read counters, pause work and interpret completion.</td><td><a href="/burp-bounty-pro/scan-control.md">Scan control and performance</a></td></tr><tr><td><strong>Create your own check</strong></td><td>Turn an observation into a reusable profile.</td><td><a href="/creating-profiles/overview.md">Create profiles in the graphical editor</a></td></tr></tbody></table>