Single insertion point selection

Use $BBOUNTY$ to focus a Server scan on one selected request span.

Server supports exclusive request selection using literal $BBOUNTY$ markers. Check that server_info.insertion_selection advertises exclusive: true, marker $BBOUNTY$, paired-value support and one span per request.

Preserve the original value

GET /item?id=$BBOUNTY$1$BBOUNTY$&language=en HTTP/1.1
Host: app.example.test

What the marker selects

The pair selects only the value 1; language remains outside the selected insertion span. Use a complete CRLF request and an explicit service when submitting through MCP.

Profile operation, payload TEST	Result
Replace	id=TEST&language=en
Append	id=1TEST&language=en
Insert	Insert at the middle of the selected original value.

A single token selects an empty span. id=$BBOUNTY$ receives the payload at that location. id=1$BBOUNTY$ preserves 1 as an unselected prefix, then inserts the payload. Prefer paired markers when the original value matters to controls or append behavior.

MCP example

{
  "requests": ["GET /item?id=$BBOUNTY$1$BBOUNTY$&language=en HTTP/1.1\r\nHost: app.example.test\r\n\r\n"],
  "services": ["https://app.example.test:443"],
  "profile_names": ["Example_Marker_Reflection"],
  "rps": 10,
  "concurrency": 5
}

Placement and restrictions

• Select one span in a path/query, a header value (including Cookie), or a body such as JSON, XML, form or multipart data.

• Keep syntax around it intact: for JSON strings, keep the quotes outside the selected value.

• Two tokens enclose one selection; they do not select two independent parameters. For multiple independent selections, submit separate requests.

• Each active step remains on that selection, even if its profile lists other points, new headers or insertionPoint: "any".

• Raw-request profiles, method conversion and match/replace are rejected in exclusive mode. They can change bytes outside the selected span.

• Tokens are removed before baselines and probes are sent. Body Content-Length is recalculated.

• Baselines and configured redirects can still produce additional requests; exclusivity concerns the mutation point, not an exact one-request count.

Use the literal case-sensitive token, never $GBOUNTY$ or %24BBOUNTY%24. Malformed/structural selections are errors. Do not remove the marker and silently scan all parameters after a rejection.

Server active scans only

This facility belongs to the Server active engine, through both MCP and REST input. Passive analysis treats data literally. It does not configure Pro's Local Scanner, and the token is not a reusable profile payload variable.