Create passive profiles

Create request and response detectors from captured traffic.

Passive profiles inspect existing exchanges. Configure them in Pro's passive profile editors, then click OK to generate the .bb file. They do not need active payloads or request mutation points.

Choose the exchange to inspect

Response: debug header

Configure the response profile

1. Open Profiles → Passive Response Profiles → Add.

2. Enter Name Example_Debug_Header and your Author value.

3. In Response → Grep, click Add and configure the following row.

Grep column	Enter or select
Enabled	Checked
Operator	Leave empty
Match Type	Regex
Options	Only in Headers
Value	(?im)^X-Debug-Mode:[ \t]*enabled[ \t]*\r?$

Paste the regex directly into Value. Do not surround it with JSON quotes or double its backslashes for JSON; Pro handles file serialization.

1. In Issue, enter Debug response header observed, select Information and Firm, and explain what the header reveals.

2. Leave Don't show this issue alert unchecked.

3. In Tags, add Examples, then click OK.

4. Reopen the saved profile and test an enabled header, a disabled header, and a body that merely contains header-like text. Only the intended header should match.

The preconfigured passive response example is available to load and inspect in Pro. It includes saved header-only settings. Check the actual saved behavior when adapting it for another engine; grep compatibility matters.

Request: parameter name

Configure the request profile

1. Open Profiles → Passive Request Profiles → Add.

2. Enter Name Example_Debug_Query_Parameter and your Author value.

3. In Request → Grep, click Add and configure the row below.

Grep column	Enter or select
Enabled	Checked
Operator	Leave empty
Match Type	Regex
Insertion point type	Param url name
Options	Case sensitive
Value	^debug$

Here Insertion point type selects what to inspect in the request. It does not tell the passive scanner to inject a payload.

1. In Issue, enter Debug query parameter observed, select Information and Firm, and describe the observation.

2. Leave Don't show this issue alert unchecked and add the Examples tag.

3. Click OK, reopen the profile and verify the settings.

4. Test ?debug=1 as a positive case and ?other=debug as a negative case. The second request has the text in a value rather than a parameter name.

You can also load the preconfigured passive request example and edit it in the interface.

Use the saved profiles

Run passive scanning on captured exchanges and inspect the resulting evidence. For response profiles, the input must include the response you want to analyze. A profile file does not cause Pro or Server to fetch missing responses automatically in a pure passive workflow.

Copy the generated .bb file to the Server catalogue when needed. With MCP, use mode: "passive" and supply the captured response for response checks; see the passive MCP workflow.

Keep exploring

Use a passive trigger in a rule

Connect an observation to an active check.