> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/payloads.md).

# Payloads and positioning

Add probe values, choose where they go and preserve useful controls.

Open an active profile, select the step, and use **Original Request → Payloads** to configure the values the scanner will inject.

## Add and maintain payloads

* **Add** creates a row. Enter the payload in **Value** and check **Enabled**.
* **Paste** adds clipboard lines; **Load File** reads a payload list.
* Uncheck **Enabled** to keep a payload in the profile without executing it.
* **Remove** deletes selected rows; **Clear** empties the table.

Enter the payload itself, such as `BB_MARKER`. The editor generates the saved enabled/value representation. Do not type a JSON array or an enabled flag into the Value cell.

Empty rows are omitted when the current editor saves. An imported profile may contain an intentional empty control payload, so verify such a control after editing and saving it. Do not assume a blank row in the editor produces an unchanged-request probe.

## Choose Payload position

| Choice  | Operation                  | Original `abcd`, payload `X` |
| ------- | -------------------------- | ---------------------------- |
| Replace | Replace the selected value | `X`                          |
| Append  | Add to the end             | `abcdX`                      |
| Insert  | Insert at the middle       | `abXcd`                      |

These operations act on the chosen point. An entire-body or header point can replace much more than a query value. Path-discovery and raw-request workflows need their own inspection of the resulting request.

## Variables and transformations

Insert [supported variables](/creating-profiles/global-variables.md) directly in the payload text where needed. Configure [Payload Encoding](/creating-profiles/payload-encoding.md) and [Match and Replace](/creating-profiles/match-and-replace.md) through their editor controls, then inspect final bytes. An already encoded payload can be encoded again.

After loading a payload list, verify its rows are present and save the profile with **OK**. Distribute the generated file containing the rows, rather than relying on the source list's local path being available on Server.

## Execution strategy

The scan-launch strategy decides whether eligible payload testing stops after a successful match or continues through all payloads. It is not a substitute for a correct confirmation step. Profiles requiring unavailable out-of-band infrastructure can be skipped; zero requests must not be interpreted as a negative vulnerability test.

The [exported field reference](/creating-profiles/field-reference.md) explains how the editor stores payloads and positioning for integration troubleshooting.