> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/creating-active-profile.md).

# Create an active profile

Build a marker-reflection check using the controls in the Pro editor.

This walkthrough configures a marker-reflection check through Burp Bounty Pro. Treat a reflected marker as an informational observation, not proof of XSS.

## 1. Open the editor

1. Open **Burp Bounty Pro → Profiles → Active Profiles → Add**.
2. Enter a unique **Name**, such as `Example_Marker_Reflection`, and **Author**.
3. Keep **Step 1** selected and set **Request type** to **Original Request**.
4. Choose **All URLs** in **Scan scope** for this request-specific example.

You can also load the [preconfigured active example](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/examples/profiles/active-reflection.bb), select it in the table and use **Edit**, or duplicate it under a new name. Imported profiles can contain saved matching settings as well as the visible table rows; preserve those settings when adapting an example.

## 2. Configure Original Request

| Control                | Example setting            |
| ---------------------- | -------------------------- |
| Payloads → Add → Value | `BB_PROFILE_MARKER`        |
| Payload row Enabled    | Checked                    |
| Payload position       | Append                     |
| Insertion point        | Param url value            |
| Other insertion points | Unchecked for this example |
| Payload Encoding       | Leave empty initially      |
| Change HTTP Method     | Unchecked                  |
| Match and Replace      | No rows for this example   |

{% hint style="info" %}
**What goes in the Value cell**

Enter just the payload text in **Value**. Pro saves the enabled flag and the serialized row for you. With a query value `hello`, Append is intended to produce `helloBB_PROFILE_MARKER`.
{% endhint %}

## 3. Configure Response

In **Response → Grep**, click **Add** and fill in the row:

| Grep column | Enter or select           |
| ----------- | ------------------------- |
| Enabled     | Checked                   |
| Operator    | Leave the first row empty |
| Match Type  | Simple String             |
| Options     | Case sensitive            |
| Value       | `BB_PROFILE_MARKER`       |

Review **Redirections** and set a finite **Max redirections** appropriate to the check. See [grep options](/creating-profiles/grep-options.md) for header/body matching and compatibility. The downloadable example includes a saved body-only restriction; do not assume every new row has that restriction automatically.

## 4. Configure Issue and Tags

1. In **Issue**, set **Issue Name** to `Probe marker reflected`.
2. Select **Information** severity and **Firm** confidence for the observation.
3. Describe the reflected marker in **Issue Detail** and explain that reflection alone does not establish exploitable impact.
4. Leave **Don't show this issue alert** unchecked so a match can be reported.
5. In **Tags**, use **New Tag** to create `Examples` if needed, then add it to the profile.
6. Click **OK**. Pro generates and saves the `.bb` file; confirm the profile appears in the table and review whether it should remain enabled.

## 5. Validate the saved profile

Reopen it with **Edit** and check the selected points, payload, grep, issue text and tags. Test a response containing the marker and one without it. If the detector must be body-only, also test a marker appearing only in a header and verify that it does not match.

Inspect the actual request and finding in the scanner. Repeat validation on Server before treating the exported profile as equivalent there. Use [validation and distribution](/creating-profiles/validation.md) to install the same generated file on a server.

## Keep exploring

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Add a confirmation step</strong></td><td>Build a sequence with a probe and a control.</td><td><a href="/creating-profiles/multi-step-profiles.md">Multi-step profiles</a></td></tr><tr><td><strong>Validate and share</strong></td><td>Test and distribute the generated file.</td><td><a href="/creating-profiles/validation.md">Validate and distribute saved profiles</a></td></tr></tbody></table>