Raw HTTP requests

Use the request editor for a fixed endpoint or a specific HTTP structure.

Use Raw Request in the active profile editor for a fixed diagnostic endpoint or a specific HTTP message structure.

1. Select the step to configure.

2. Change Request type from Original Request to Raw Request.

3. Open the Raw Request tab and enter the complete HTTP message.

4. Configure Response matching and Issue reporting for that step.

5. Click OK to save. Pro handles the JSON string and escaping in the .bb file.

For example, the request editor can contain:

GET /health HTTP/1.1
Host: {CURRENT_HOST}
Connection: close

Include a terminating blank line. In Response → Grep, add a precise condition for the expected diagnostic, such as a Simple String row with example diagnostic marker. Do not use a generic 200 response as proof of a vulnerability.

Construct a valid message

The transmitted message needs a request line, CRLF header lines and a terminating blank line. For a body, verify framing and Content-Type. Confirm authentication and other required headers: a raw template does not automatically reproduce every header from the original exchange.

For a non-default port, construct the appropriate Host header. The service/protocol comes from the scan input; a Host header is not an HTTPS selector.

Use only supported tokens. Earlier documentation listed {PAYLOAD} and {PAYLOAD_URL} as general raw-request placeholders; they are not a verified shared runtime contract. Do not assume an arbitrary token is substituted or that every payload row creates the intended raw request.

Scope and portability

Pro's Once per host scan scope can reduce repeated fixed-path checks. Standalone Server callers must choose representative requests themselves. MCP confines generated requests to explicit service origins. Raw requests are incompatible with Server's exclusive $BBOUNTY$ selection because they replace more than the selected span.

Inspect the final request in both engines when distributing a raw-request profile. Confirm path, method, headers, body, dynamic values, redirects and matched response. The exported requestType and rawRequest fields are described in the file reference.