Payloads and positioning

Add probe values, choose where they go and preserve useful controls.

Open an active profile, select the step, and use Original Request → Payloads to configure the values the scanner will inject.

Add and maintain payloads

• Add creates a row. Enter the payload in Value and check Enabled.

• Paste adds clipboard lines; Load File reads a payload list.

• Uncheck Enabled to keep a payload in the profile without executing it.

• Remove deletes selected rows; Clear empties the table.

Enter the payload itself, such as BB_MARKER. The editor generates the saved enabled/value representation. Do not type a JSON array or an enabled flag into the Value cell.

Empty rows are omitted when the current editor saves. An imported profile may contain an intentional empty control payload, so verify such a control after editing and saving it. Do not assume a blank row in the editor produces an unchanged-request probe.

Choose Payload position

Choice	Operation	Original abcd, payload X
Replace	Replace the selected value	X
Append	Add to the end	abcdX
Insert	Insert at the middle	abXcd

These operations act on the chosen point. An entire-body or header point can replace much more than a query value. Path-discovery and raw-request workflows need their own inspection of the resulting request.

Variables and transformations

Insert supported variables directly in the payload text where needed. Configure Payload Encoding and Match and Replace through their editor controls, then inspect final bytes. An already encoded payload can be encoded again.

After loading a payload list, verify its rows are present and save the profile with OK. Distribute the generated file containing the rows, rather than relying on the source list's local path being available on Server.

Execution strategy

The scan-launch strategy decides whether eligible payload testing stops after a successful match or continues through all payloads. It is not a substitute for a correct confirmation step. Profiles requiring unavailable out-of-band infrastructure can be skipped; zero requests must not be interpreted as a negative vulnerability test.

The exported field reference explains how the editor stores payloads and positioning for integration troubleshooting.