Profile catalogue

Install saved profiles and confirm what the running server can discover.

Create and maintain profiles in Burp Bounty Pro's graphical editor. Save the profile there, then install the generated .bb file in this catalogue. Server consumes those files; it does not provide the Pro profile editor.

Choose the correct directory

BurpBountyData/
├── profiles/  ← --profiles-dir points here
│   ├── check-one.bb
│   └── check-two.bb
└── rules/     ← Pro rules, not a Server profile catalogue

The catalogue reader loads .bb files directly in the configured directory. It does not descend into subdirectories or unpack ZIP files. Use an absolute path to avoid launching from the wrong working directory.

Pro's data-directory control selects the parent BurpBountyData; Server's catalogue flag selects its profiles child. A path on your Mac is not a path on a VPS or in a container.

Startup checks

When --profiles-dir is specified, startup checks that it can read catalogue metadata and find profile entries. A wrong directory, zero entries, malformed JSON or invalid metadata reports an error and prevents startup. This is not a complete detector validation: a syntactically valid profile can still have an unusable payload, regex or detection strategy. See profile validation.

The catalogue is reread when listing/selecting profiles. Updating files in the same directory does not require changing the server configuration. Changing the configured path requires restarting the server.

Discover before scanning

Call list_profiles with a tag and scanner type, for example:

{"tag": "SQLi", "scanner": 1}

The result describes names, files, scanner types, tags, enabled state and severity. Scanner IDs are 1 active, 2 passive response, 3 passive request; omit scanner or use 0 for all.

An empty filtered result means that selection found nothing. Try an unfiltered listing before concluding the entire catalogue is empty. Disabled profiles can appear in discovery but do not execute.

Select exact returned names with profile_names, or any of the requested tags with profile_tags. A file containing multiple profiles does not cause unselected neighbors to execute. Keep names unique across the catalogue.

Supplied profiles

MCP profiles accepts a .bb array serialized as a JSON string. REST accepts an uploaded profiles archive. These inputs do not install files into the catalogue and do not require --profiles-dir.

If discovery fails, repair the catalogue rather than inventing a replacement detector just to make a scan start. The authoring guide is for deliberate creation of new checks.