Insertion points

Select the request locations your active profile is allowed to mutate.

In the active profile editor, select the step, choose Original Request, and check the insertion point controls for the locations you want to mutate. For example, select Param url value for query values or Param json value for JSON values. Leave unrelated controls unchecked.

The exported IDs below are a reference for inspecting saved files. Pro writes them automatically; choose the named controls in the interface.

Location / editor choice	Exported ID
URL parameter value / name	0 / 34
Form body parameter value / name	1 / 35
Cookie value / name	2 / 21
XML element value / name	3 / 31
XML attribute value / name	4 / 41
Multipart attribute value / name	5 / 51
JSON value / name	6 / 61
URL path folder / filename	33 / 37
Entire body	80
Pro editor's All flag; Server maps this ID to entire body. See below.	18
Entire XML body	36
Entire JSON body	81
Entire multipart body	82
User-provided selection; not “all parameters”	64
Multiple / single path discovery	65 / 66
User-Agent	70
Referer	71
Origin	72
Host	73
Content-Type	74
Accept	75
Accept-Language	76
Accept-Encoding	77
New headers named in NewHeaders	78

Selecting Param url value, Param body value and Param json value tests those values where present. Url path folder is a separate choice.

The All checkbox selects individual controls and saves their IDs alongside its editor flag, 18. The local finder uses the individual IDs, while Server maps 18 to entire body. For a narrow, portable detector, select the required controls individually. Use Entire body only when replacing the whole body is intended.

Choose narrowly

A selected type must exist in the request or be created by its finder. A JSON-value profile does not automatically turn a form body into JSON. A name mutation tests a different behavior from a value mutation. Avoid entire-body points for a single-value detector unless that larger mutation is intended.

For a new header, use Add beside the New HTTP Header Name table and enter a name such as X-Example-Probe. Add further rows only for headers the detector needs. Pro records their names and the relevant insertion type when saving.

Path discovery points replace a path suffix: multiple path discovery (65) creates candidates at successive slash positions, while single path discovery (66) starts at the first slash. These are different from mutating an existing folder (33) or filename (37).

Local user-provided points

Pro's local finder recognizes paired § delimiters when User provided is selected, for example id=§1§. Use a copy of the request and a profile restricted to the intended user-provided point. This legacy local mechanism is separate from Server's $BBOUNTY$ mode; do not send one engine's marker expecting the other engine's behavior.

Selection versus scope

• URL filters select source requests.

• Profile points select mutation locations.

• Pro Scan scope → Once per host reduces repeated per-host profile work.

• MCP services and approval settings govern destinations.

• Server $BBOUNTY$ selects one exclusive span in an individual request.

These controls are not interchangeable. For exact parameter selection from an agent, follow the Server marker guide, rather than assuming the local User provided choice selects an arbitrary parameter on Server.