> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/default-profiles.md). # Default profile inventory Browse the reviewed pack by profile type, enabled state, tags and severity. This is a metadata inventory of the local pack reviewed on **2026-10-04**: **261 profiles**, of which **256 are enabled** and **5 disabled**. It describes this pack, not the contents of an arbitrary running server or every future release. | Type | Profiles | | ---------------- | -------- | | Active | 130 | | Passive response | 90 | | Passive request | 41 | Use MCP `list_profiles` to discover the actual server catalogue, including disabled state and exact names. Pro's tables show the loaded local files. The [machine-readable inventory](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/reference/catalogue.json) also contains rule dependencies and a content fingerprint. The inventory records available checks, not a claim that every detector is valid on every application. Review [compatibility](/creating-profiles/compatibility.md) and test customizations. The supplied files stay in `BurpBountyData/profiles`; installing the documentation alone does not install the commercial pack. {% tabs %} {% tab title="Active profiles" %} ## Active profiles | Name | Enabled | Tags | Severity | | ----------------------------------------------------- | ------- | -------------------------------------------------- | ----------- | | Blind\_RCE\_Linux | Yes | All, RCE, Per-URL | High | | Blind\_RCE\_Windows | Yes | All, RCE, Per-URL | High | | Blind\_XSS | Yes | All, XSS, Blind XSS, Per-URL | Medium | | Blind\_XXE | Yes | All, XXE, Per-URL | High | | CORS Misconfiguration | Yes | All, CORS, Per-URL | Low | | CouchDB\_Admin\_Exposure | Yes | All, CVEs, Per-Host | Medium | | CRLF | Yes | All, CRLF, Per-URL | Medium | | CVE-2017-9506\_Jira\_SSRF | Yes | All, CVEs, Per-Host | Medium | | CVE-2018-1271\_Spring\_MVC\_Path\_Traversal | Yes | All, CVEs, Per-Host | High | | CVE-2018-13379\_FortiOS\_Creds\_Disclosure | Yes | All, CVEs, Per-Host | High | | CVE-2019-11510\_Pulse\_Secure | Yes | All, CVEs, Per-Host | High | | CVE-2019-11580\_Atlassian\_Crowd\_RCE | No | CVEs, Per-Host, Manual-Review | High | | CVE-2019-1653\_Cisco\_Wan\_VPN\_disclosure | Yes | All, CVEs, Per-Host | High | | CVE-2019-19781\_Citrix\_ADC\_Directory\_Traversal | Yes | All, CVEs, Per-Host | Medium | | CVE-2019-3799\_Spring\_Cloud\_Path\_Traversal | Yes | All, CVEs, Per-Host | High | | CVE-2019-5418\_Ruby on Rails | Yes | All, CVEs, Per-URL | High | | CVE-2019-5418\_Ruby on Rails - WAF bypass | Yes | All, CVEs, Per-URL | High | | CVE-2019-8442\_Jira\_Path\_Traversal | Yes | All, CVEs, Per-Host | Medium | | CVE-2019-8449\_Jira\_Unauthenticated\_Sensitive\_Info | Yes | All, CVEs, Per-Host | Medium | | CVE-2020-11738\_Wordpress\_Duplicator\_Plugin\_LFI | Yes | All, CVEs, Wordpress, Per-Host | High | | CVE-2020-13167\_Netsweeper\_code\_injection | No | CVEs, Per-Host, Manual-Review | Information | | CVE-2020-13379\_Grafana\_SSRF | Yes | All, CVEs, Per-URL | High | | CVE-2020-14179\_Jira\_Info\_Exposure | Yes | All, CVEs, Per-Host | Medium | | CVE-2020-14181\_Jira\_User\_Enum | Yes | All, CVEs, Per-Host | Medium | | CVE-2020-14815\_XSS | Yes | All, XSS, Per-Host | Medium | | CVE-2020-15129\_Traefik\_Open\_Redirect | Yes | All, CVEs, Per-URL | Medium | | CVE-2020-17506\_Artica\_Web\_Proxy\_Auth\_Bypass | Yes | All, CVEs, Per-Host | Information | | CVE-2020-24312\_File\_Manager\_Wordpress\_Backups | Yes | All, CVEs, Wordpress, Per-Host | High | | CVE-2020-2551\_Oracle\_WebLogic | Yes | All, CVEs, Per-Host | Information | | CVE-2020-3452\_Cisco\_ASA\_LFI | Yes | All, CVEs, Per-Host | Medium | | CVE-2020-5410\_Path\_Traversal\_Spring\_Cloud | Yes | All, CVEs, Per-Host | Medium | | CVE-2020-5412\_Spring\_Cloud\_Netflix | Yes | All, CVEs, Per-Host | High | | CVE-2020-5777\_MAMGI\_Auth\_Bypass | Yes | All, CVEs, Per-Host | Information | | CVE-2020-5902\_F5-BigIP | Yes | All, CVEs, Per-Host | High | | CVE-2020-8209\_Citrix\_XenMobile\_PathTraversal | Yes | All, CVEs, Per-Host | High | | CVE-2020-8982\_Citrix\_ShareFile\_File\_Read | Yes | All, CVEs, Per-Host | Medium | | CVE-2020-9484\_Tomcat\_Groovy | Yes | All, CVEs, Per-URL | Information | | CVE-2021-26086\_PathTraversal\_Atlassian\_Jira | Yes | All, CVEs, Per-Host | Medium | | CVE-2021-40438\_Apache\_mod\_proxy\_SSRF | Yes | All, CVEs, Per-URL | High | | CVE-2021-40539\_Zoho\_ManageEngine\_ADSelfService | Yes | All, CVEs, Per-Host | High | | CVE-2021-43798\_Grafana\_LFI | Yes | All, CVEs, Per-Host | High | | CVE-2021-44228\_RCE\_Log4j | Yes | All, RCE, CVEs, Per-URL | High | | CVE-2021-44228\_RCE\_Log4j\_GETPOST | Yes | All, RCE, CVEs, Per-URL | High | | CVE-2021-44228\_RCE\_Log4j\_urlEncode | Yes | All, RCE, CVEs, Per-URL | High | | CVE-2022-1388\_F5\_Big\_IP\_RCE | Yes | CVEs, RCE, All, Per-Host | High | | CVE-2022-26134\_Confluence\_RCE | Yes | CVEs, RCE, All, Per-Host | High | | CVE-2022-31474\_BackupBuddy\_LFI | Yes | CVEs, All, Per-Host | Medium | | CVE-2022-32276\_Grafana\_8.4.3 | Yes | CVEs, All, Per-Host | Information | | CVE-2022-32276\_Grafana\_8.4.3\_poc2 | Yes | CVEs, All, Per-Host | Information | | CVE-2022-42889\_Text4Shell | Yes | All, CVEs, Per-URL | High | | CVE-2023-24488\_Citrix\_XSS | Yes | All, Per-Host | Low | | CVE-2025-55182\_React2Shell\_RCE | Yes | All, RCE, CVEs, React/Next.js, Per-Host | High | | CVE-2025-55182\_React2Shell\_RCE\_OOB | Yes | All, RCE, React/Next.js, CVEs, Per-Host | High | | CVE-2025-55182\_React2Shell\_RCE\_Windows | Yes | All, RCE, CVEs, React/Next.js, Per-Host | High | | CVE-2025-68613\_n8n\_Vulnerable\_Version | Yes | All, CVEs, RCE, n8n, Per-Host | High | | Drupal\_User\_Enum | Yes | All, Drupal, Per-Host | Information | | Drupal\_User\_Enum\_Redirect | Yes | All, Drupal, Per-Host | Medium | | DWR\_enpoints | Yes | All, DRWuzz, Per-Host | Information | | Easy\_wp\_smtp\_listing\_enabled | Yes | All, Wordpress, Per-Host | High | | Echo\_RCE | Yes | All, RCE, Per-URL | High | | Expect\_RCE | Yes | All, RCE, Per-URL | High | | GitFinder | Yes | All, Fuzzing Files, Per-Host | Low | | GraphQL Alias Overloading | Yes | All, GraphQL, Per-URL | Information | | GraphQL Batching | Yes | All, GraphQL, Per-URL | Information | | GraphQL Circular Queries | Yes | All, GraphQL, Per-URL | Information | | GraphQL Directives Overloading | Yes | All, GraphQL, Per-URL | Information | | GraphQL Field Duplication | Yes | All, GraphQL, Per-URL | Information | | Graphql Introspection | Yes | All, Introspection, Per-URL | Low | | Host\_Header\_Injection | Yes | All, Per-URL | High | | Jira\_unauthenticated\_Info | Yes | All, CVEs, Per-Host | Medium | | Kubernetes\_API\_Exposed | Yes | All, Per-Host | Medium | | Open Firebase Database | Yes | All, Per-Host | Information | | OpenRedirect | Yes | All, Open Redirect, Per-URL | Medium | | OpenRedirect-ParameterPollution | Yes | All, Open Redirect, Per-URL | Medium | | OpenRedirect-ParameterPollution\_Path | Yes | All, Open Redirect, Per-Host | Medium | | OpenRedirect\_SSRF | Yes | SSRF, Open Redirect, All, Per-URL | High | | OpenRedirect\_SSRF\_Collaborator | Yes | All, SSRF, Open Redirect, Per-URL | Medium | | OpenRedirect\_SSRF\_Collaborator\_HTTP0\_9 | Yes | All, Per-URL | Medium | | OpenRedirect\_SSRF\_Collaborator\_HTTP1\_0 | Yes | All, Per-URL | Medium | | OpenRedirect\_to\_Account\_Takeover | Yes | All, Per-URL | Low | | Openredirect\_to\_XSS | Yes | All, XSS, Per-URL | Medium | | Password-Reset-Headers | No | Forgot Password, Per-URL, Manual-Review | Information | | Password-Reset-Params | No | Forgot Password, Per-URL, Manual-Review | Information | | Password-Reset-URL | No | Forgot Password, Per-URL, Manual-Review | Information | | PathTraversal\_Linux | Yes | All, Path Traversal, Per-URL | High | | PathTraversal\_Windows | Yes | All, Path Traversal, Per-URL | High | | PHP\_RCE | Yes | All, RCE, Per-URL | High | | RCE\_Linux | Yes | All, RCE, Per-URL | High | | RCE\_Windows | Yes | All, RCE, Per-URL | High | | Solarwinds\_default\_admin | Yes | All, Per-Host | Information | | Source\_code | Yes | All, Per-URL | Information | | Spring\_Boot\_Actuators | Yes | All, Spring, Per-Host | Low | | SQLi | Yes | All, SQLi, Per-URL | Low | | SQLi\_Collaborator | Yes | All, SQLi, Per-URL | High | | SQLi\_ContentLength | Yes | SQLi\_ContentLength, All, BugBounty, SQLi, Per-URL | Medium | | SQLi\_StausCode | Yes | All, SQLi\_StatusCode, SQLi, Per-URL | High | | SQLi\_Timebased | Yes | All, SQLi\_TimeBased, SQLi, Per-URL | High | | SQLi\_Timebased\_Encoded\_KeyCharacter | Yes | All, SQLi\_TimeBased, SQLi, Per-URL | High | | SQLi\_Timebased\_Encoded\_Space | Yes | All, SQLi\_TimeBased, SQLi, Per-URL | High | | SSRF-Collaborator | Yes | All, SSRF, Per-URL | Medium | | SSRF-URLScheme | Yes | All, SSRF, Per-URL | High | | SSRF\_Collaborator\_HTTP0\_9 | Yes | All, SSRF, Per-URL | Medium | | SSRF\_Collaborator\_HTTP1\_0 | Yes | All, SSRF, Per-URL | Medium | | SSTI | Yes | All, SSTI, Per-URL | High | | SVNFinder | Yes | All, Fuzzing Files, Per-Host | Low | | Swagger-Finder | Yes | All, Fuzzing Files, Per-Host | Information | | Symfony\_Debug | Yes | All, Per-Host | Medium | | Test\_XSS\_discover | Yes | All, XSS, Per-URL | Low | | Woody\_Wordpress\_RCE | Yes | All, Wordpress, Per-Host | Information | | Wordpress\_Config\_Accessible | Yes | All, Wordpress, Per-Host | High | | Wordpress\_directory\_listing | Yes | All, Wordpress, Per-Host | Low | | Wordpress\_Path\_Traversal | Yes | All, Wordpress, Per-Host | High | | Wordpress\_user\_enum\_json | Yes | All, Wordpress, Per-Host | Low | | Wordpress\_user\_enum\_oembed | Yes | All, Wordpress, Per-Host | Information | | Wordpress\_users\_enum\_yoastseo | Yes | All, Wordpress, Per-Host | Information | | Wordpress\_XMLRPC\_ListMethods | Yes | All, Wordpress, Per-Host | Information | | Wordpress\_XMLRPC\_Pingback | Yes | All, Wordpress, Per-Host | Low | | X-Headers-Collaborator | Yes | All, X-Headers-Collab, Per-URL | Medium | | XSS | Yes | All, XSS, Per-URL | Information | | XSS\_DOM\_Context | Yes | XSS, DOM\_Context, All, Per-URL | Information | | XSS\_GETPOST | Yes | All, XSS, Per-URL | Information | | XSS\_HTML\_Attribute\_Context | Yes | XSS, HTML\_Attribute, All, Per-URL | Information | | XSS\_HTML\_Comment\_Context | Yes | XSS, HTML\_Comment, All, Per-URL | Information | | XSS\_HTML\_Tag\_Context | Yes | XSS, HTML\_Tag, All, Per-URL | Information | | XSS\_HtmlUrlEncode | Yes | All, XSS, Per-URL | Information | | XSS\_JavaScript\_Context | Yes | XSS, JavaScript\_Context, All, Per-URL | Information | | XSS\_URL\_Context | Yes | XSS, URL\_Context, All, Per-URL | Low | | XSS\_URLEncode | Yes | All, XSS, Per-URL | Information | | XXE\_Linux | Yes | All, XXE, Per-URL | High | | XXE\_Windows | Yes | All, XXE, Per-URL | High | | {% endtab %} | | | | {% tab title="Passive response profiles" %} ## Passive response profiles | Name | Enabled | Tags | Severity | | --------------------------------------------------- | ------- | ---------------------------- | ----------- | | AccessToken | Yes | All, Secrets | Information | | AI-Specific-Header-Disclosure | Yes | AI, All | Information | | Amazon\_AWS\_Url | Yes | All, Cloud | Information | | Amazon\_MWS\_Auth\_Token | Yes | All, Secrets | Information | | AmazonAWS | Yes | All, Cloud | Information | | Android\_WebView\_JS | Yes | All, Technology | Information | | ApiKeyResponse | Yes | All, Secrets | Information | | Artica\_Web | Yes | All, Technology | Information | | Artifactory\_API\_Token | Yes | All, Secrets | Information | | Authorization\_Bearer | Yes | All, Secrets | Information | | AWS\_Access\_Key\_ID | Yes | All, Secrets | Information | | AWS\_Client\_Secret | Yes | All, Secrets | Information | | AWS\_Creds\_File | Yes | All, Secrets | Information | | AWS\_EC2\_Url | Yes | All, Cloud | Information | | AWS\_Region | Yes | All, Cloud | Information | | Azure\_Blob\_Discovered | Yes | All, Cloud | Information | | Basic\_Auth\_Credentials | Yes | All, Secrets | Information | | Bitcoin\_Address | Yes | All, Secrets | Information | | Cache-Control | Yes | All, Security\_Headers | Information | | CDN\_Detected | Yes | All, Technology | Information | | Cisco\_ASA\_Device\_Found | Yes | All, Technology | Low | | Citrix\_Detection | Yes | All, Technology | Information | | CMS\_Found | Yes | All, Technology | Information | | Content-Security-Policy | Yes | All, Security\_Headers | Information | | CookieFlag-HttpOnly | Yes | All, Cookie\_Security | Low | | CookieFlag-SameSite | Yes | All, Cookie\_Security | Information | | CookieFlag-Secure | Yes | All, Cookie\_Security | Low | | CouchDB\_Response | Yes | All, Technology | Information | | Debug Pages | Yes | All, Information\_Disclosure | Information | | Debug\_variables | Yes | All, Information\_Disclosure | Information | | DefaultRDP | Yes | All, Information\_Disclosure | Information | | DigitalOcean\_Space\_Discovered | Yes | All, Cloud | Information | | DirectoryListing | Yes | All, Information\_Disclosure | Information | | Docker\_API\_Response | Yes | All, Technology | Information | | DomainTakeOver\_Strings | Yes | All, Vulnerabilities | Information | | Drupal\_Response | Yes | All, Technology | Information | | DWREndpoints | Yes | All, Technology | Information | | EndpointsExtractor | Yes | All, Information\_Disclosure | Information | | Env\_Vars | Yes | All, Information\_Disclosure | Information | | Facebook\_Client\_ID | Yes | All, Secrets | Information | | Facebook\_OAuth | Yes | All, Secrets | Information | | Fortinet\_Panel | Yes | All, Technology | Information | | Gateway-Fingerprinting | Yes | AI, All | Information | | GCP\_Service\_Account | Yes | All, Secrets | Information | | GCP\_Urls | Yes | All, Cloud | Information | | Gmail\_Oauth\_2.0 | Yes | All, Secrets | Information | | Google\_Cloud\_Buckets | Yes | All, Cloud | Information | | Health-Status-Metadata-Exposure | Yes | AI, All | Information | | Hidden Parameters | Yes | All, Information\_Disclosure | Information | | Interesting\_Keyworks | Yes | All, Information\_Disclosure | Information | | Java\_De-Serialization | Yes | All, Vulnerabilities | Information | | Jenkins\_Response | Yes | All, Technology | Information | | Joomla detection | Yes | All, Technology | Information | | Joomla-CVE-2015-7297 | Yes | All, Vulnerabilities | Information | | JS\_Variables | Yes | All, Information\_Disclosure | Information | | Kubernetes\_Response | Yes | All, Technology | Information | | LinkedIn\_Secret | Yes | All, Secrets | Information | | MAC\_Address | Yes | All, Information\_Disclosure | Information | | MAGMI\_Response | Yes | All, Technology | Information | | Netsweeper\_Response | Yes | All, Technology | Information | | NoSQL\_Session\_Token | Yes | All, Secrets | Information | | NuGet\_Api\_Key | Yes | All, Secrets | Information | | Octopus\_API\_Key | Yes | All, Secrets | Information | | OpenAI-Compatible-API-Fingerprinting | Yes | AI, All | Information | | Outlook\_Team | Yes | All, Information\_Disclosure | Information | | Paypal\_Braintree\_access\_token | Yes | All, Secrets | Information | | Picatic\_API\_Key | Yes | All, Secrets | Information | | Private\_SSH\_Key | Yes | All, Secrets | Information | | RateLimit-Headers-Disclosure | Yes | AI, All | Information | | Reflected\_values\_greater\_than\_three\_characters | Yes | All, Information\_Disclosure | Information | | ServerBannerResponse | Yes | All, Technology | Information | | Software\_Version | Yes | All, Technology | Information | | Solarwinds\_Orion\_Response | Yes | All, Technology | Information | | SonarQube\_API\_Key\_Docs | Yes | All, Secrets | Information | | SQL\_Message\_Detected | Yes | All, Vulnerabilities | Information | | StackHawk\_API\_Key | Yes | All, Secrets | Information | | Strict-Transport-Security | Yes | All, Security\_Headers | Information | | Subdomain\_takeover | Yes | All, Vulnerabilities | Information | | Swagger\_found | Yes | All, Technology | Information | | Symfony\_Response | Yes | All, Technology | Information | | Tomcat\_Response\_Detection | Yes | All, Technology | Information | | Traefik\_Response | Yes | All, Technology | Information | | vBulletin\_Response | Yes | All, Technology | Information | | WAF\_Found | Yes | All, Technology | Information | | Wordpress detection | Yes | All, Technology | Information | | Wordpress-SensitiveDirectories | Yes | All, Vulnerabilities | Information | | WP\_Config | Yes | All, Information\_Disclosure | Information | | X-Content-Type-Options | Yes | All, Security\_Headers | Information | | X-Frame-Options | Yes | All, Security\_Headers | Information | | XML\_Response\_Detected | Yes | All, Technology, XML | Information | | {% endtab %} | | | | {% tab title="Passive request profiles" %} ## Passive request profiles | Name | Enabled | Tags | Severity | | -------------------------------- | ------- | --------------------- | ----------- | | Action\_parameters | Yes | All, Parameters | Information | | All\_Requests\_And\_Parameters | Yes | All, Parameters | Information | | AmazonAWSRequest | Yes | All, Technology | Information | | Api\_path | Yes | All, API | Information | | ApiKeyRequest | Yes | All, Secrets | Information | | Artica\_Web\_Request | Yes | All, Technology | Information | | AuthorizationBearerToken | Yes | All, Secrets | Information | | Cisco\_Request\_Detected | Yes | All, Technology | Information | | CouchDB\_Request | Yes | All, Technology | Information | | Debug\_Logic\_Parameters | Yes | All, Parameters | Information | | ErrorPages-JobApps | Yes | All, Parameters | Information | | Firebase DB detected | Yes | All, Parameters | Information | | Fortinet\_Request | Yes | All, Technology | Information | | GraphQL\_Endpoint | Yes | All, API | Information | | Health-Status-Endpoint-Discovery | Yes | AI, All | Information | | IDOR\_parameters | Yes | All, Vuln\_Parameters | Information | | Jira\_Request | Yes | All, Technology | Information | | Key\_Parameters | Yes | All, Parameters | Information | | LFI\_RFI\_Parameters | Yes | All, Vuln\_Parameters | Information | | MAGMI\_Request | Yes | All, Technology | Information | | Netsweeper\_Request | Yes | All, Technology | Information | | OAuth\_parameters | Yes | All, Secrets | Information | | OpenRedirect\_SSRF\_Parameters | Yes | All, Vuln\_Parameters | Information | | RCE\_Parameters | Yes | All, Vuln\_Parameters | Information | | RegisterUser\_parameters | Yes | All, Vuln\_Parameters | Information | | Secret-keywords-SecLists | Yes | All, Secrets | Information | | Secrets\_Request | Yes | All, Secrets | Information | | Solarwinds\_Orion\_Request | Yes | All, Technology | Information | | Springboot\_Requests | Yes | All, API | Information | | SQLi\_Parameters | Yes | All, Vuln\_Parameters | Information | | SSTI\_Parameters | Yes | All, Vuln\_Parameters | Information | | Swagger\_Request | Yes | All, API | Information | | Token\_Parameters | Yes | All, Parameters | Information | | URL\_as\_a\_Value | Yes | All, Parameters | Information | | URL\_Path\_as\_a\_Value | Yes | All, Parameters | Information | | UserEnum\_parameters | Yes | All, Vuln\_Parameters | Information | | UUID\_Request | Yes | All, Parameters | Information | | Weblogic\_Request | Yes | All, Technology | Information | | WeblogicServer-UDDI\_Explorer | Yes | All, Technology | Information | | XML\_Content\_Detected | Yes | All, Technology, XML | Information | | XSS\_Parameters | Yes | All, Vuln\_Parameters | Information | | {% endtab %} | | | | | {% endtabs %} | | | |