> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/insertion-points.md).

# Insertion points

Select the request locations your active profile is allowed to mutate.

In the active profile editor, select the step, choose **Original Request**, and check the insertion point controls for the locations you want to mutate. For example, select **Param url value** for query values or **Param json value** for JSON values. Leave unrelated controls unchecked.

The exported IDs below are a reference for inspecting saved files. Pro writes them automatically; choose the named controls in the interface.

| Location / editor choice                                              | Exported ID |
| --------------------------------------------------------------------- | ----------- |
| URL parameter value / name                                            | `0` / `34`  |
| Form body parameter value / name                                      | `1` / `35`  |
| Cookie value / name                                                   | `2` / `21`  |
| XML element value / name                                              | `3` / `31`  |
| XML attribute value / name                                            | `4` / `41`  |
| Multipart attribute value / name                                      | `5` / `51`  |
| JSON value / name                                                     | `6` / `61`  |
| URL path folder / filename                                            | `33` / `37` |
| Entire body                                                           | `80`        |
| Pro editor's All flag; Server maps this ID to entire body. See below. | `18`        |
| Entire XML body                                                       | `36`        |
| Entire JSON body                                                      | `81`        |
| Entire multipart body                                                 | `82`        |
| User-provided selection; not “all parameters”                         | `64`        |
| Multiple / single path discovery                                      | `65` / `66` |
| User-Agent                                                            | `70`        |
| Referer                                                               | `71`        |
| Origin                                                                | `72`        |
| Host                                                                  | `73`        |
| Content-Type                                                          | `74`        |
| Accept                                                                | `75`        |
| Accept-Language                                                       | `76`        |
| Accept-Encoding                                                       | `77`        |
| New headers named in `NewHeaders`                                     | `78`        |

Selecting **Param url value**, **Param body value** and **Param json value** tests those values where present. **Url path folder** is a separate choice.

The **All** checkbox selects individual controls and saves their IDs alongside its editor flag, 18. The local finder uses the individual IDs, while Server maps 18 to entire body. For a narrow, portable detector, select the required controls individually. Use **Entire body** only when replacing the whole body is intended.

## Choose narrowly

A selected type must exist in the request or be created by its finder. A JSON-value profile does not automatically turn a form body into JSON. A name mutation tests a different behavior from a value mutation. Avoid entire-body points for a single-value detector unless that larger mutation is intended.

For a new header, use **Add** beside the **New HTTP Header Name** table and enter a name such as `X-Example-Probe`. Add further rows only for headers the detector needs. Pro records their names and the relevant insertion type when saving.

Path discovery points replace a path suffix: multiple path discovery (65) creates candidates at successive slash positions, while single path discovery (66) starts at the first slash. These are different from mutating an existing folder (33) or filename (37).

## Local user-provided points

Pro's local finder recognizes paired `§` delimiters when **User provided** is selected, for example `id=§1§`. Use a copy of the request and a profile restricted to the intended user-provided point. This legacy local mechanism is separate from Server's `$BBOUNTY$` mode; do not send one engine's marker expecting the other engine's behavior.

## Selection versus scope

* URL filters select source requests.
* Profile points select mutation locations.
* Pro **Scan scope → Once per host** reduces repeated per-host profile work.
* MCP `services` and approval settings govern destinations.
* Server `$BBOUNTY$` selects one exclusive span in an individual request.

These controls are not interchangeable. For exact parameter selection from an agent, follow [the Server marker guide](/burp-bounty-server/insertion-selection.md), rather than assuming the local User provided choice selects an arbitrary parameter on Server.