Variables
Keep profiles reusable with context values, custom tokens and interaction IDs.
Profiles can include tokens that are substituted at runtime. Configure Pro's custom values in Settings → Variables. When Pro dispatches a REST scan, it sends its custom variables as the scan's tokens map.
Request-derived tokens
{CURRENT_URL}
Original request URL.
{CURRENT_PROTOCOL}
HTTP or HTTPS service protocol.
{CURRENT_HOST}
Original request host.
{CURRENT_PORT}
Service port.
{CURRENT_PATH}
URL path.
{CURRENT_METHOD}
Original HTTP method.
{CURRENT_QUERY}
URL query string, not arbitrary POST body data.
{CURRENT_FILE}
Different semantics: Pro uses the URL file component (path plus query); Server uses the path basename.
{CURRENT_SUBDOMAIN}
Pro's hostname-label derivation; not public-suffix-aware and not a Server template token.
{CURRENT_USER_AGENT}
Original User-Agent value.
{CURRENT_REFERER}
Referer value when available.
{CURRENT_ORIGIN}
Origin value when available.
{CURRENT_CONTENT_TYPE}
Content-Type; normalization can differ between engines.
{CURRENT_ACCEPT}
Accept value.
{CURRENT_ACCEPT_LANGUAGE}
Accept-Language value.
{CURRENT_ACCEPT_ENCODING}
Accept-Encoding value.
{CURRENT_CONTENT_LENGTH}
Original header value, not a calculation of a future payload length.
{CURRENT_COOKIES}
Pro cookie-header substitution in supported paths; not a Server template token.
{CURRENT_INSERTION_POINT_NAME}
Pro's insertion context. Server currently uses the selected entrypoint text for both name/value token variants; do not assume it yields a parameter name.
{CURRENT_INSERTION_POINT_VALUE}
Insertion context value; verify name-mutation and explicit-selection behavior.
{RANDOM}
Generated identifier; do not expect identical values across separate requests/engines.
Header-dependent tokens need the header to exist. Inspect unresolved tokens in the final request rather than assuming a missing value will be synthesized. Server additionally recognizes {CURRENT_INDEX} and {CURRENT_INSERTION_POINT}; these are not general Pro tokens.
Callback and email values
{BC} is Pro's Collaborator token. Server converts it to {BH} and requires a configured blind-host provider to create/poll interactions. A scan can be Finished with a warning or skipped callback-dependent checks.
{EMAIL} is shown in Pro's variable reference, but do not assume a configured address exists automatically. Provide a deliberate custom value for workflows that need it. Server's ordinary modifier list does not automatically configure an email provider.
Pack defaults
{REDIRECT_DOMAIN}
bountysecurity.ai
{ATTACKER_DOMAIN}
yourdomain.com (placeholder)
{XXE_FILE}
/etc/passwd
{XXE_GREP}
root:x
{XXE_FILE_B64}
ZmlsZTovLy9ldGMvcGFzc3dk
{XXE_GREP_B64}
cm9vdD
{XXE_WIN_FILE}
c:/boot.ini
{XXE_WIN_GREP}
boot loader
{XXE_WIN_FILE_B64}
ZmlsZTovLy9jOi9ib290LmluaQ==
{RCE_FILE}
/etc/passwd
{RCE_COMMAND}
id
Defaults are test inputs, not confirmation that a callback domain or target file is appropriate. Update paired payload/grep variables consistently.
Server custom values
REST accepts a map in the configuration file:
Server MCP has no equivalent per-call map parameter. Use deliberate configured values or supplied profiles rather than inventing an MCP argument. Custom tokens inside regex greps are treated as literal values; they are not a way to inject arbitrary regex syntax.
$BBOUNTY$ is different: it is a literal marker placed in a Server scan request to select a span, not a profile variable or a callback token.
Last updated