> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/creating-passive-profile.md).

# Create passive profiles

Create request and response detectors from captured traffic.

Passive profiles inspect existing exchanges. Configure them in Pro's passive profile editors, then click **OK** to generate the `.bb` file. They do not need active payloads or request mutation points.

## Choose the exchange to inspect

{% tabs %}
{% tab title="Response: debug header" %}

### Configure the response profile

1. Open **Profiles → Passive Response Profiles → Add**.
2. Enter **Name** `Example_Debug_Header` and your **Author** value.
3. In **Response → Grep**, click **Add** and configure the following row.

| Grep column | Enter or select                              |
| ----------- | -------------------------------------------- |
| Enabled     | Checked                                      |
| Operator    | Leave empty                                  |
| Match Type  | Regex                                        |
| Options     | Only in Headers                              |
| Value       | `(?im)^X-Debug-Mode:[ \t]*enabled[ \t]*\r?$` |

Paste the regex directly into **Value**. Do not surround it with JSON quotes or double its backslashes for JSON; Pro handles file serialization.

4. In **Issue**, enter `Debug response header observed`, select **Information** and **Firm**, and explain what the header reveals.
5. Leave **Don't show this issue alert** unchecked.
6. In **Tags**, add `Examples`, then click **OK**.
7. Reopen the saved profile and test an enabled header, a disabled header, and a body that merely contains header-like text. Only the intended header should match.

The [preconfigured passive response example](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/examples/profiles/passive-response.bb) is available to load and inspect in Pro. It includes saved header-only settings. Check the actual saved behavior when adapting it for another engine; [grep compatibility](/creating-profiles/grep-options.md) matters.
{% endtab %}

{% tab title="Request: parameter name" %}

### Configure the request profile

1. Open **Profiles → Passive Request Profiles → Add**.
2. Enter **Name** `Example_Debug_Query_Parameter` and your **Author** value.
3. In **Request → Grep**, click **Add** and configure the row below.

| Grep column          | Enter or select |
| -------------------- | --------------- |
| Enabled              | Checked         |
| Operator             | Leave empty     |
| Match Type           | Regex           |
| Insertion point type | Param url name  |
| Options              | Case sensitive  |
| Value                | `^debug$`       |

Here **Insertion point type** selects what to inspect in the request. It does not tell the passive scanner to inject a payload.

4. In **Issue**, enter `Debug query parameter observed`, select **Information** and **Firm**, and describe the observation.
5. Leave **Don't show this issue alert** unchecked and add the `Examples` tag.
6. Click **OK**, reopen the profile and verify the settings.
7. Test `?debug=1` as a positive case and `?other=debug` as a negative case. The second request has the text in a value rather than a parameter name.

You can also load the [preconfigured passive request example](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/examples/profiles/passive-request.bb) and edit it in the interface.
{% endtab %}
{% endtabs %}

## Use the saved profiles

Run passive scanning on captured exchanges and inspect the resulting evidence. For response profiles, the input must include the response you want to analyze. A profile file does not cause Pro or Server to fetch missing responses automatically in a pure passive workflow.

Copy the generated `.bb` file to the Server catalogue when needed. With MCP, use `mode: "passive"` and supply the captured response for response checks; see [the passive MCP workflow](/burp-bounty-server/mcp-workflows.md).

## Keep exploring

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Use a passive trigger in a rule</strong></td><td>Connect an observation to an active check.</td><td><a href="/burp-bounty-pro-rules/creating-rules.md">Create and validate a rule</a></td></tr></tbody></table>