> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-server/insertion-selection.md).

# Single insertion point selection

Use $BBOUNTY$ to focus a Server scan on one selected request span.

Server supports **exclusive** request selection using literal `$BBOUNTY$` markers. Check that `server_info.insertion_selection` advertises `exclusive: true`, marker `$BBOUNTY$`, paired-value support and one span per request.

## Preserve the original value

```http
GET /item?id=$BBOUNTY$1$BBOUNTY$&language=en HTTP/1.1
Host: app.example.test

```

{% hint style="info" %}
**What the marker selects**

The pair selects only the value `1`; `language` remains outside the selected insertion span. Use a complete CRLF request and an explicit service when submitting through MCP.
{% endhint %}

| Profile operation, payload `TEST` | Result                                               |
| --------------------------------- | ---------------------------------------------------- |
| Replace                           | `id=TEST&language=en`                                |
| Append                            | `id=1TEST&language=en`                               |
| Insert                            | Insert at the middle of the selected original value. |

A single token selects an empty span. `id=$BBOUNTY$` receives the payload at that location. `id=1$BBOUNTY$` preserves `1` as an unselected prefix, then inserts the payload. Prefer paired markers when the original value matters to controls or append behavior.

## MCP example

```json
{
  "requests": ["GET /item?id=$BBOUNTY$1$BBOUNTY$&language=en HTTP/1.1\r\nHost: app.example.test\r\n\r\n"],
  "services": ["https://app.example.test:443"],
  "profile_names": ["Example_Marker_Reflection"],
  "rps": 10,
  "concurrency": 5
}
```

## Placement and restrictions

* Select one span in a path/query, a header value (including Cookie), or a body such as JSON, XML, form or multipart data.
* Keep syntax around it intact: for JSON strings, keep the quotes outside the selected value.
* Two tokens enclose one selection; they do not select two independent parameters. For multiple independent selections, submit separate requests.
* Each active step remains on that selection, even if its profile lists other points, new headers or `insertionPoint: "any"`.
* Raw-request profiles, method conversion and match/replace are rejected in exclusive mode. They can change bytes outside the selected span.
* Tokens are removed before baselines and probes are sent. Body Content-Length is recalculated.
* Baselines and configured redirects can still produce additional requests; exclusivity concerns the mutation point, not an exact one-request count.

Use the literal case-sensitive token, never `$GBOUNTY$` or `%24BBOUNTY%24`. Malformed/structural selections are errors. Do not remove the marker and silently scan all parameters after a rejection.

{% hint style="info" %}
**Server active scans only**

This facility belongs to the Server active engine, through both MCP and REST input. Passive analysis treats data literally. It does not configure Pro's **Local Scanner**, and the token is not a reusable profile payload variable.
{% endhint %}