Create profiles in the graphical editor

Build a check in the graphical editor. Save it once, then reuse the generated profile.

Create and edit profiles with Burp Bounty Pro's graphical editor. Configure the check in its tabs, then click OK. Pro writes the .bb file, including its JSON structure, automatically. You do not need to write JSON or enter numeric field IDs to create a profile.

The resulting file can be used by Pro or installed on Burp Bounty Server, subject to engine compatibility.

From an idea to a reusable check

Choose the editor

Open Burp Bounty Pro → Profiles and choose the appropriate table:

Table	Use it to
Active Profiles	Send modified or raw requests and evaluate the result.
Passive Response Profiles	Inspect existing HTTP responses.
Passive Request Profiles	Inspect existing HTTP request components.

Use Add for a new profile, or duplicate an existing profile and Edit the copy. Give it a unique Name so that saving does not overwrite another profile. Review the enabled state in the table after saving; saved profiles are enabled by the editor.

Create, save and use

1. Define the behavior you want to detect and a negative/control case.

2. Enter Name and Author in the editor.

3. For an active profile, configure Original Request or Raw Request, payloads and insertion points. Passive profiles inspect the captured exchange instead.

4. Configure the Grep table in Response or Request.

5. Fill in Issue and assign categories in Tags.

6. Click OK to save. Reopen with Edit to review the saved configuration.

7. Test with positive and negative examples before using the profile broadly.

For an active profile, the step buttons let you configure a sequence within the same editor. The multi-step guide explains which settings belong to each step.

Where the file goes

Pro saves profiles in the profiles subdirectory of the data directory selected in Settings, normally BurpBountyData/profiles. The saved .bb file contains the generated JSON. Back up that file before changing an existing check, and use the complete saved/exported file when sharing it.

Pro rules also use .bb, but belong in BurpBountyData/rules and use their own editor. Do not mix the two directories.

To use a profile through Server's catalogue, copy the generated profile file into its configured profile directory and verify it with list_profiles. When launching through Pro's Server Scanner, Pro sends the selected profiles with the scan.

Learning path

Start with an active profile or a passive profile, then multi-step confirmation. The option guides explain the controls by their names in the editor.

The exported field reference is for inspecting files and diagnosing integration problems. It is not the profile creation workflow. Downloadable examples can be loaded and edited in Pro; they are not replacements for the commercial catalogue.

Keep exploring

Create an active profile

Configure payloads, insertion points and response matching.

Create passive profiles

Find useful signals in captured requests and responses.