**Burp Bounty Pro** is a powerful Burp Suite extension that allows security researchers and bug bounty hunters to create custom scan profiles for detecting vulnerabilities in web applications. It extends Burp Suite's scanning capabilities by letting you define custom payloads, match conditions, and detection rules — without writing any code.
### ✨ Key Features
* 🤖 **AI Scanner** — AI-powered analysis that identifies attack surfaces, correlates parameters with vulnerability types, detects technologies, and auto-launches the right scan profiles. Supports OpenAI, Anthropic, Google Gemini, OpenRouter, and local models (Ollama)
* 🎯 **Custom Active Scanning** — Define payloads and match patterns to detect vulnerabilities like XSS, SQLi, SSRF, RCE, path traversal, and more
* 👁️ **Passive Scanning with Tag-Based Launching** — Analyze requests and responses passing through Burp Suite. Launch passive scans by tag to run only the checks you need (e.g., only security headers, only secret detection)
* 🧠 **Smart Scan (Rules)** — Create IF-THEN rules that automatically trigger active scans when specific passive conditions are detected
* 🔗 **Multi-Step Profiles** — Chain multiple scanning steps together with cookie reuse and sequential execution for complex attack scenarios
* 🔀 **Global Variables** — Use dynamic variables like `{REDIRECT_DOMAIN}`, `{BC}`, `{CURRENT_HOST}` in payloads and match patterns
* 📦 **256 Default Profiles** — Ready-to-use profiles covering CVEs, common vulnerabilities, technology detection, and sensitive data exposure
* 📋 **28 Default Rules** — Pre-configured Smart Scan rules for automated vulnerability detection workflows
* 🔍 **Flexible Match Types** — Simple string, regex, payload reflection, response variations, content length differences, HTTP response codes, time-based detection, and Burp Collaborator integration
* 📍 **30+ Insertion Point Types** — URL parameters, body parameters, cookies, JSON keys/values, XML, HTTP headers, URL path components, and more
* 🔎 **Scan Scope** — Per-profile scan scope: per-URL (default) or per-host for path discovery and fixed-path CVE profiles
* ⚡ **Per-Scan Performance Settings** — Configure threads, concurrency, and requests per second independently for each scan
* ⏸️ **Pause & Resume** — True thread-safe pause/resume that preserves full scan state. Paused time is excluded from scan duration.
* 🏷️ **Tags System** — Organize profiles with tags across all profile types. Tags power the passive scan submenu and Smart Scan rule targeting.
* 📤 **Profile Import/Export** — Share and reuse profiles across teams with JSON-based `.bb` profile files
### 🆕 What's New in v3.1.0
* 🤖 **AI Scanner** — AI-powered reconnaissance that analyzes parameters, detects technologies, identifies attack surfaces, and auto-launches the right scan profiles. Supports OpenAI, Anthropic, Google Gemini, OpenRouter, and local models (Ollama). Includes programmatic response analysis for reflection context detection and customizable prompts.
* 🔎 **Scan Scope (per-host)** — New `scanScope` field in active profiles. Per-URL (default) scans every URL; per-host scans once per host:port, ideal for path discovery and fixed-path CVE profiles.
* 📊 **Redesigned Scanners Tab** — The Scanner tab is now split into dedicated sub-tabs: **Active**, **Passive**, **Smart**, **AI**, and **Live**, each with its own results table, entry controls, and request/response viewers.
* ⚡ **Context-Aware Scanner Settings** — The URL Filter popup now adapts its settings based on the scan type (Active, Smart, Passive, AI Scanner), showing only relevant options for each.
* 📨 **Passive & Smart Scanner Tabs** — Dedicated tabs for monitoring passive scan results and Smart Scan rule matches with real-time entry tracking.
### What's New in v3.0.0
* 🔗 Multi-step scanning for complex attack chains
* 🔀 Global variables system with user-configurable values
* ⏱️ Time-based vulnerability detection engine
* ⚡ **Per-scan scanner settings** (threads, concurrency, RPS) in the scan popup
* ⏸️ **Pause/resume** with PausableThreadPoolExecutor — true zero-loss state management
* 🏷️ **Tag-based passive scan launching** with Request/Response submenus and profile counts
* 🏷️ **Tags column and Set New Tag** on all profile tables (Active, Passive Request, Passive Response)
* 🎯 Stop-on-first-match optimization for single-step profiles
* 🪟 Non-modal dialogs, profile duplication, payload/grep markers
* 🔗 URL filtering for all scan types
* 🛡️ 30-redirect loop protection and scan timeout detection (with paused time excluded)
### 🚀 Getting Started
Head to the [Installation](/getting-started/installation) guide to set up Burp Bounty Pro, or jump straight to the [Quick Start](/getting-started/quick-start) guide to run your first scan.
### 📚 Documentation Overview
| Section | Description |
| ------------------------------------------------------------- | --------------------------------------------------- |
| 🚀 [Quick Start](/getting-started/quick-start) | Run your first scan in 5 minutes |
| 🖥️ [Interface Overview](/getting-started/interface-overview) | Understand all tabs and controls |
| 🎯 [Active Scan](/scanning/active-scan) | Active scanning with custom payloads |
| 👁️ [Passive Scan](/scanning/passive-scan) | Passive analysis with tag-based launching |
| 🧠 [Smart Scan](/scanning/smart-scan) | Automated scanning with IF-THEN rules |
| 🤖 [AI Scanner](/scanning/ai-scan) | AI-powered analysis and auto-scanning |
| ⚙️ [Scan Control](/scanning/scan-control) | Pause/resume, per-scan settings, performance tuning |
| 📝 [Profiles](/profiles/overview) | Creating and managing scan profiles |
| 🏷️ [Tags](/profiles/tags) | Organizing profiles with tags |
| 📋 [Rules](/rules/overview) | Creating Smart Scan rules |
| 🔀 [Variables](/variables/global-variables) | Global variable reference |
| ⚙️ [Settings](/options/settings) | Configuration options |
| 📦 [Default Profiles](/reference/default-profiles) | 256 built-in profiles reference |
| 📋 [Default Rules](/reference/default-rules) | 28 built-in rules reference |
| ❓ [FAQ](/appendix/faq) | Frequently asked questions |
# Installation
## 📋 Prerequisites
Before installing Burp Bounty Pro, ensure you have the following:
* ✅ **Burp Suite Professional** installed on your system (Community Edition has limited scanning capabilities)
* ✅ **Java Runtime Environment (JRE)** version 14 or above
## 🔧 Installation Steps
### 1️⃣ Download the Extension
Obtain the latest version of Burp Bounty Pro from the official website at [bountysecurity.ai](https://bountysecurity.ai) or from your purchase confirmation email.
### 2️⃣ Launch Burp Suite
Open Burp Suite Professional.
### 3️⃣ Add the Extension
1. Navigate to the **Extensions** tab (formerly called "Extender")
2. Click on the **Installed** sub-tab
3. Click the **Add** button
### 4️⃣ Configure the Extension
In the dialog that appears:
1. Select **Java** as the extension type
2. Click **Select file...** and choose the `BurpBountyPro.jar` file you downloaded
3. Click **Next** to proceed with the installation
### 5️⃣ Verify Installation
Ensure that:
* ✅ The extension is listed in the **Installed** extensions list with the checkbox ticked
* ✅ No errors appear in the extension output panel
* ✅ The **Burp Bounty Pro** tab appears in the main Burp Suite tab bar
### 6️⃣ Start Using Burp Bounty Pro
Access the newly added **Burp Bounty Pro** tab in the Burp Suite interface. You're ready to begin configuring your profiles and start your security testing! 🎉
## 🚀 First Launch
When Burp Bounty Pro loads for the first time, it will:
1. 📦 **Auto-load default profiles** — 254 pre-configured scanning profiles are loaded from the bundled `BurpBountyData` directory
2. 📋 **Auto-load default rules** — 27 Smart Scan rules are loaded for automated vulnerability detection
3. 🔀 **Initialize default variables** — Global variables like `{REDIRECT_DOMAIN}` are set to their default values
A new **Burp Bounty Pro** tab will appear in the main Burp Suite interface with sub-tabs for Dashboard, Scanner, Profiles, Rules, Options, Variables, License, and About.
## 🔑 License Activation
1. Navigate to the **Burp Bounty Pro** tab
2. Click the **License** sub-tab
3. Enter your license key
4. Click **Activate**
## ✅ Verifying Installation
After installation, verify that:
* ✅ The **Burp Bounty Pro** tab appears in the main Burp Suite window
* ✅ The **Dashboard** sub-tab shows the scan control buttons (Pause All, Resume All, Stop, Clear Issues)
* ✅ The **Profiles** sub-tab lists loaded profiles across all three tables:
* 🎯 **Active Profiles** — with columns: Enabled, Profile Name, Tags, Author's Twitter
* 📨 **Passive Request Profiles** — with columns: Enabled, Profile Name, Tags, Author's Twitter
* 📩 **Passive Response Profiles** — with columns: Enabled, Profile Name, Tags, Author's Twitter
* ✅ The **Rules** sub-tab shows the 27 default rules
## 📌 Post-Installation
After installing Burp Bounty Pro, you may want to:
* 📦 **Review Default Profiles** — Familiarize yourself with the 254 default profiles provided and adjust them to fit your testing needs. Use the tag dropdown to browse by category (XSS, SQLi, CVEs, etc.)
* 🚀 **Explore the Quick Start** — Follow the [Quick Start](/getting-started/quick-start) guide to run your first scan in under 5 minutes
* 🔀 **Configure Variables** — Set your `{REDIRECT_DOMAIN}` and `{ATTACKER_DOMAIN}` in the Variables tab
* 🔄 **Check for Updates** — Check for updates regularly to ensure you have the latest features and fixes
## 🔄 Updating
Burp Bounty Pro has a built-in update checker that detects new versions of both the extension and the profiles.
### Check For Updates
1. Go to the **Burp Bounty Pro** tab > **About** sub-tab
2. Click the **Check For Updates** button
3. The extension will check for:
* 🆕 **New versions of Burp Bounty Pro** — If a new version is available, you'll be notified and can download it
* 📦 **New versions of the profiles** — Updated and new scanning profiles are downloaded and installed automatically
> 💡 **Tip:** Check for updates regularly to get the latest vulnerability detection profiles and bug fixes.
> 📝 **Note:** Your existing profiles, rules, and settings are preserved across updates.
## 🔗 Resources
| Resource | Link |
| ------------------ | ---------------------------------------------------------------------------------- |
| 📖 Documentation | [burpbounty.bountysecurity.ai](https://burpbounty.bountysecurity.ai/burp-bounty/) |
| 🎥 Video Tutorials | [YouTube Channel](https://www.youtube.com/channel/UCSq4R2o9_nGIMHWZ4H98GkQ/videos) |
| 🌐 Main Website | [bountysecurity.ai](https://bountysecurity.ai) |
| 🐦 Twitter | [@BountySecurity](https://x.com/BountySecurity) |
| 📧 Support | |
## ❓ Need Help?
If you encounter any issues during the installation or have questions about using Burp Bounty Pro, please:
* 📖 Check the [FAQ](/appendix/faq) for common solutions
* 📧 Contact our support team at ****
# Quick Start
This guide walks you through running your first scan with Burp Bounty Pro in under 5 minutes.
## Step 1️⃣ — Browse to a Target
1. Configure your browser to use Burp Suite as a proxy
2. Browse to the target web application
3. Ensure the target appears in Burp Suite's **Target** > **Site Map**
## Step 2️⃣ — Select Profiles
1. Go to the **Burp Bounty Pro** tab > **Profiles** sub-tab
2. Review the three profile categories:
* 🎯 **Active Profiles** — Profiles that send payloads to test for vulnerabilities
* 📨 **Passive Request Profiles** — Profiles that analyze outgoing requests
* 📩 **Passive Response Profiles** — Profiles that analyze incoming responses
3. Each table shows: Enabled, Profile Name, **Tags**, and Author's Twitter
4. Enable or disable profiles using the **Enabled** checkbox in each profile row
5. All default profiles are enabled by default
> 💡 **Tip:** Use the tag dropdown at the top to filter profiles by category (XSS, SQLi, CVEs, etc.) and focus on what matters for your target.
## Step 3️⃣ — Enable Smart Scan Rules *(Optional)*
1. Go to the **Rules** sub-tab
2. Review the available rules — these define IF-THEN conditions that automatically trigger active scans when passive matches are found
3. Enable the rules you want (most are enabled by default)
## Step 4️⃣ — Launch an Active Scan
1. In Burp Suite, right-click on target URLs in **Target** > **Site Map**, **Proxy History**, or **Repeater**
2. Select **Active Scan** from the Burp Bounty Pro context menu
3. The **URL Filter popup** appears — review the URLs, configure **Scanner Settings** (Threads, Concurrency, RPS), and click OK
4. Burp Bounty Pro launches the scan with your per-scan settings 🎯
> 💡 **Tip:** For fast targets, increase threads to 20. For rate-limited targets, decrease to 3 and set RPS to 2.
## Step 5️⃣ — Launch a Passive Scan
Passive scanning can run in two ways:
### 🔄 Automatic (Live Passive Scan)
1. In the **Dashboard** tab, toggle **Live Passive Scan on**
2. All traffic passing through Burp Suite is automatically analyzed
### 🏷️ Manual (Tag-Based)
1. Right-click on one or more requests
2. Select **Passive Scan** from the context menu
3. Choose the scope from the tag-based submenu:
* **All** — Run all passive profiles
* **Passive Request** > **Tag** — Run only request profiles with a specific tag
* **Passive Response** > **Tag** — Run only response profiles with a specific tag
## Step 6️⃣ — Launch an AI Scan *(Optional)*
The AI Scanner uses AI to automatically identify attack surfaces and launch the right profiles:
1. Right-click on one or more requests
2. Select **AI Scanner** from the Burp Bounty Pro context menu
3. Configure the URL filter and click **OK**
4. The AI analyzes each request's parameters, detects reflection contexts, fingerprints technologies, and recommends profiles
5. If **Auto-scan** is enabled, recommended active profiles are launched automatically
> 💡 **Tip:** Configure your AI provider and API key first in **Scanners** > **AI** > **Settings**.
## Step 7️⃣ — Monitor and Control Results
1. Go to the **Burp Bounty Pro** tab > **Dashboard** sub-tab
2. The dashboard shows:
* 📊 **Scanner progress** — Active tasks, completed scans, and queue status
* 🐛 **Issues found** — Detected vulnerabilities with severity, confidence, and details
3. Use the control buttons:
* ⏸️ **Pause All** — Pause all scans without losing progress
* ▶️ **Resume All** — Resume paused scans from where they left off
* ⏹️ **Stop** — Stop all scans
## Step 8️⃣ — Review Findings
Each issue reported includes:
* 📛 **Issue Name** — The vulnerability type (e.g., "XSS", "SQLi", "CORS Misconfiguration")
* 🔴🟠🟡🔵 **Severity** — High, Medium, Low, or Information
* 🎯 **Confidence** — Certain, Firm, or Tentative
* 📝 **Detail** — The payload used and the grep pattern that matched
Issues also appear in Burp Suite's **Dashboard** > **Issue activity** for integrated review.
## 📌 Next Steps
* 🖥️ [Interface Overview](/getting-started/interface-overview) — Learn about all the tabs and controls
* 📝 [Creating Active Profiles](/profiles/creating-active-profile) — Create your own vulnerability detection profiles
* 🧠 [Smart Scan](/scanning/smart-scan) — Set up automated scanning workflows with Rules
* 🤖 [AI Scanner](/scanning/ai-scan) — AI-powered analysis and auto-scanning
* ⚙️ [Scan Control](/scanning/scan-control) — Learn about pause/resume, per-scan settings, and performance tuning
* 🏷️ [Tags](/profiles/tags) — Organize profiles and launch targeted passive scans
* 🔀 [Global Variables](/variables/global-variables) — Configure variables like `{REDIRECT_DOMAIN}` and `{BC}`
# Interface Overview
Burp Bounty Pro adds a **Burp Bounty Pro** tab to the main Burp Suite interface. This tab contains several sub-tabs for managing scans, profiles, rules, and settings.
## 📑 Main Tabs
### 📊 Dashboard
The Dashboard is your primary view for monitoring scan activity and reviewing results.
**Scanner Progress Table:**
* Shows active scan tasks with their status (🟢 Running, 🟡 Paused, ✅ Completed, ❌ Failed)
* Displays the profile name, target URL, and progress information
* Real-time updates as scans execute
**Issues Table:**
* Lists all vulnerabilities and findings detected by Burp Bounty Pro
* Columns: Issue Name, Severity, Confidence, Host, Path
* Click on an issue to view its full details including the payload used and grep match
**Control Buttons:**
* ⏸️ **Pause All** — Pauses all running scans using PausableThreadPoolExecutor. Threads block at a safe point and resume exactly where they left off. No scan progress is lost.
* ▶️ **Resume All** — Resumes all paused scans instantly
* ⏹️ **Stop** — Stops all scans and clears the task queue
* 🗑️ **Clear Issues** — Clears the issues table
* 🔄 **Live Passive Scan** — Toggle button to enable/disable automatic passive scanning of all HTTP traffic. When enabled, the "Scope Only" checkbox restricts scanning to in-scope targets.
### 🔎 Scanners
The Scanners tab is organized into dedicated sub-tabs for each scan type:
#### 🎯 Active
The Active sub-tab provides detailed per-request logging of active scan activity.
* Shows every HTTP request made by active scan profiles
* Includes request/response pairs for debugging and analysis
* Displays the profile name, payload, and result for each request
* Highlights in blue when new scan activity starts from Smart Scan or AI Scanner
#### 👁️ Passive
The Passive sub-tab shows results from passive scanning.
* Lists each passive scan entry with host, method, URL, parameter count, and findings summary
* Tracks matched profiles for each scanned request
* Includes request/response viewers
#### 🧠 Smart
The Smart sub-tab tracks Smart Scan rule evaluations and triggered scans.
* Shows matched rules for each request
* Displays which active profiles were launched and scan count
* Links to the triggered active scans
#### 🤖 AI
The AI sub-tab manages AI Scanner entries and results.
* Results table with status (Analyzing, Complete, Error), findings summary, and parameter count
* Detail panel with request/response viewers and full AI JSON response
* Entry controls: Pause, Resume, Cancel, Remove, Clear
* Settings button for configuring AI provider, API key, model, endpoint, and prompts
See [AI Scanner](/scanning/ai-scan) for full documentation.
#### 📡 Live
The Live sub-tab shows real-time passive scan activity from the Live Passive Scan feature.
### 📝 Profiles
The Profiles tab manages all scanning profiles, organized into three categories:
🎯 **Active Profiles:**
* Profiles that actively send payloads to test for vulnerabilities
* Columns: Enabled, Profile Name, **Tags**, Author's Twitter
* Actions: Add, Edit (double-click), Delete, Duplicate, Enable/Disable, Set New Tag, Import, Export
📨 **Passive Request Profiles:**
* Profiles that analyze HTTP requests passing through Burp Suite
* Columns: Enabled, Profile Name, **Tags**, Author's Twitter
* Actions: Add, Edit (double-click), Delete, Duplicate, Enable/Disable, **Set New Tag**, Import, Export
📩 **Passive Response Profiles:**
* Profiles that analyze HTTP responses received by Burp Suite
* Columns: Enabled, Profile Name, **Tags**, Author's Twitter
* Actions: Add, Edit (double-click), Delete, Duplicate, Enable/Disable, **Set New Tag**, Import, Export
> 📝 **Note:** All three profile tables now share the same layout with the Tags column and full right-click context menu (Enable, Disable, Set New Tag).
🏷️ **Tags Manager:**
* View and manage tags used to categorize profiles
* Tags are used in Rules to target groups of profiles
* Tags organize the passive scan context menu into submenus
**Common Actions:**
* 📥 **Import** — Load profiles from `.bb` JSON files
* 📤 **Export** — Save profiles to `.bb` JSON files for sharing
* 📋 **Duplicate** — Clone a profile with auto-generated name suffix
* 🖱️ **Double-click** — Open the profile editor dialog (non-modal)
* 🏷️ **Right-click** > **Set New Tag** — Assign a tag to selected profiles (works on all three tables)
### 📋 Rules
The Rules tab manages Smart Scan rules that define automated scanning workflows.
* Each rule has: Name, Enabled status, Description
* Rules follow an IF-THEN pattern: IF passive conditions match, THEN execute active profiles
* Actions: Add, Edit, Delete, Duplicate, Enable/Disable, Import, Export
* Rule files use the `.bbre` extension
### ⚙️ Options
The Options tab provides global configuration settings:
* ⏱️ **Scan Timeout** — Maximum time for a scan before marking as failed
* 🌐 **Collaborator Refresh** — Polling interval for Burp Collaborator results
* 🔢 **Max Concurrent Scans** — Limit the number of simultaneous scans
* 🚫 **Avoid URLs** — URL patterns to exclude from scanning
> 📝 **Note:** Thread pool size, concurrency, and requests per second are configured **per scan** in the URL Filter popup that appears before each scan, not in the global Options tab. See [Scan Control](/scanning/scan-control).
### 🔀 Variables
The Variables tab manages global variables used in profiles:
* View all configured variables with their current values
* Add, edit, and remove custom variables
* Default variables include `{REDIRECT_DOMAIN}`, `{ATTACKER_DOMAIN}`, `{XXE_FILE}`, and more
* Variables are replaced at runtime in payloads, grep patterns, and raw requests
### 🔑 License
The License tab shows license status and activation:
* Enter and activate license keys
* View license expiration and status
### ℹ️ About
The About tab displays:
* Burp Bounty Pro version (currently v3.1.0)
* Author information
* Links to documentation and support
* 🔄 **Check For Updates** — Button that checks for new versions of Burp Bounty Pro and new/updated scanning profiles
## 🖱️ Context Menus
Burp Bounty Pro integrates with Burp Suite's right-click context menus throughout the application.
### On HTTP Requests (Proxy, Site Map, Repeater, etc.)
| Menu Item | Description |
| -------------------- | ----------------------------------------------- |
| 🎯 **Active Scan** | Launch an active scan with the URL Filter popup |
| 🧠 **Smart Scan** | Launch a Smart Scan with rule-based automation |
| 👁️ **Passive Scan** | Launch a passive scan with tag-based submenu |
| 🤖 **AI Scanner** | Launch AI-powered analysis with auto-scan |
The **Passive Scan** submenu provides tag-based filtering:
```
👁️ Passive Scan
├── 🌐 All (N) ← All passive profiles
├── 📨 Passive Request ← Request profiles organized by tag
│ ├── All (N)
│ ├── Tag1 (N)
│ └── Tag2 (N)
└── 📩 Passive Response ← Response profiles organized by tag
├── All (N)
├── Tag1 (N)
└── Tag2 (N)
```
### On Profile Table Rows
| Menu Item | Description |
| ------------------- | ------------------------------------------- |
| ✅ **Enable** | Enable the selected profile(s) |
| ❌ **Disable** | Disable the selected profile(s) |
| 🏷️ **Set New Tag** | Assign a new tag to the selected profile(s) |
Available on all three profile tables (Active, Passive Request, Passive Response).
## 🔗 URL Filter Popup
The URL Filter popup appears before launching Active, Smart, Passive, and AI scans:
| Section | Description |
| ------------------------ | ---------------------------------------------------------------- |
| 🔗 **URL Table** | Select which URLs to include in the scan |
| 🔄 **Match and Replace** | Request modification rules (add headers, change parameters) |
| ⚡ **Scanner Settings** | Per-scan performance settings (context-aware based on scan type) |
The Scanner Settings section adapts based on the scan type:
| Scan Type | Available Settings |
| -------------------- | ------------------------------------------------------------------ |
| 🎯 **Active Scan** | Threads, Active Concurrency, Requests/sec |
| 🧠 **Smart Scan** | Threads, Passive Concurrency, Active Concurrency, Requests/sec |
| 👁️ **Passive Scan** | Threads, Passive Concurrency |
| 🤖 **AI Scanner** | Threads, AI Analysis Concurrency, Active Concurrency, Requests/sec |
# Active Scan
Active scanning is the core capability of Burp Bounty Pro. It sends custom payloads to the target application and analyzes responses to detect vulnerabilities.
## ⚙️ How It Works
1. 📝 **Profile Selection** — Burp Bounty Pro loads all enabled active profiles
2. 📍 **Insertion Point Discovery** — For each request, Burp Suite identifies insertion points (parameters, headers, path components, etc.)
3. 💉 **Payload Injection** — Each profile's payloads are injected into the matching insertion points
4. 🔍 **Response Analysis** — The response is analyzed using the profile's match conditions (grep patterns, status codes, timing, content length, etc.)
5. 🐛 **Issue Reporting** — If match conditions are satisfied, an issue is created with the configured severity and details
## 🚀 Launching an Active Scan
### From Context Menu *(Recommended)* ⭐
1. Select one or more requests from **Proxy History**, **Target Site Map**, **Repeater**, or any other Burp tool
2. Right-click and select **Active Scan** (under the Burp Bounty Pro submenu)
3. The **URL Filter popup** appears with scan configuration options
### 🔗 URL Filter Popup
Before each scan, the URL Filter popup lets you configure:
| Section | Description |
| ------------------------ | ------------------------------------------------------------------ |
| 🔗 **URL Table** | Review and select which URLs to include in the scan |
| 🔄 **Match and Replace** | Define request modifications (header additions, parameter changes) |
| ⚡ **Scanner Settings** | Configure per-scan performance settings |
### ⚡ Scanner Settings (Per-Scan)
Each scan has its own independent performance configuration:
| Setting | Description | Default |
| -------------------------- | -------------------------------------------- | ------- |
| 🧵 **Threads** | Number of threads in this scan's thread pool | 10 |
| 🔀 **Concurrency** | Maximum concurrent connections | 10 |
| 📈 **Requests per second** | Rate limit for this scan | 10 |
These settings apply **only to this scan** — you can run multiple scans simultaneously, each with different performance settings tailored to the target.
> 💡 **Tip:** For fast, resilient targets, increase to 20-30 threads. For rate-limited targets, decrease to 2-3 threads and 1-2 RPS.
See [Scan Control](/scanning/scan-control) for recommended configurations for different scenarios.
### From Burp Suite Native Scanner
1. Go to **Target** > **Site Map**
2. Right-click on a host, folder, or specific URL
3. Select **Scan** (Burp Suite Professional)
4. Burp Bounty Pro active profiles will run alongside Burp's built-in scanner
> 📝 **Note:** When using Burp's native scanner, the per-scan settings popup does not appear. Default values (10/10/10) are used.
## 📍 What Gets Tested
For each request, Burp Bounty Pro tests all enabled active profiles against all matching insertion points. The insertion points tested depend on the profile's `InsertionPointType` configuration.
Common insertion point categories:
| Category | Description |
| ------------------ | ---------------------------------------------- |
| 🔗 URL Parameters | Parameter names and values in the query string |
| 📝 Body Parameters | Parameter names and values in POST body |
| 🍪 Cookies | Cookie values |
| 📋 HTTP Headers | Standard and custom header values |
| 📂 URL Path | Path folders, filename, full path |
| 📦 JSON | JSON keys and values |
| 📄 XML | XML element values and attribute values |
| 📎 Multipart | Multipart form parameter values |
See [Insertion Points](/profiles/insertion-points) for the complete list.
## 🔄 Scan Flow
```
Request → URL Filter Popup
│ ├─ URL selection
│ ├─ Match and Replace
│ └─ Scanner Settings (Threads, Concurrency, RPS)
│
▼
Enabled Active Profiles → For each profile:
│
├─ Filter insertion points by InsertionPointType
│
├─ For each insertion point:
│ │
│ ├─ For each payload:
│ │ │
│ │ ├─ Apply encoding (if configured)
│ │ ├─ Replace variables ({REDIRECT_DOMAIN}, {BC}, etc.)
│ │ ├─ Inject payload into insertion point
│ │ ├─ Send request (with redirects if configured)
│ │ ├─ Apply match conditions
│ │ │
│ │ └─ If match → 🐛 Report issue, stop remaining payloads*
│ │
│ └─ Next insertion point
│
└─ Next profile
```
> \* 🎯 **Stop-on-first-match**: When a payload matches for a given profile and insertion point, remaining payloads for that same combination are skipped. This prevents duplicate issues and improves scan efficiency.
## ⏸️ Pause, Resume & Stop
During an active scan:
* ⏸️ **Pause All** — Pauses all threads instantly. No requests are lost — threads block at a safe synchronization point.
* ▶️ **Resume All** — All paused threads wake up and continue from where they stopped.
* ⏹️ **Stop** — Stops the scan entirely and clears the queue.
⏱️ Paused time is tracked and excluded from the total scan duration.
See [Scan Control](/scanning/scan-control) for details on the PausableThreadPoolExecutor.
## 🔍 Match Types
Each profile defines how to determine if a vulnerability was found:
| Match Type | Description |
| ---------------------------- | -------------------------------------------- |
| 🔤 Simple String / Regex | Search for patterns in the response |
| 🪞 Payload Reflection | Check if the payload appears in the response |
| 📊 Variations / Invariations | Compare response attributes across requests |
| 📏 Content Length | Detect differences in response size |
| 🔢 HTTP Response Code | Match specific status codes |
| ⏱️ Timeout | Detect timing-based vulnerabilities |
| 🌐 Collaborator | Out-of-band detection via Burp Collaborator |
See [Match Types](/profiles/match-types) for detailed documentation.
## 🔀 Redirection Handling
Active scans can follow HTTP redirects. Configure per profile:
* 🚫 **Never follow** — Only analyze the initial response
* 🏠 **On-site only** — Follow redirects to the same host
* 🎯 **In-scope only** — Follow redirects within Burp's target scope
* 🌐 **Always** — Follow all redirects
* 🔄 **Follow redirects** — Follow with maximum redirect limit
See [Redirections](/profiles/redirections) for details.
## 🔎 Scan Scope
Active profiles support a **Scan Scope** setting that controls how often the profile runs:
| scanScope | Mode | Behavior |
| --------- | --------------------- | --------------------------------------------- |
| 0 | **Per-URL** (default) | Profile runs on every URL scanned |
| 1 | **Per-Host** | Profile runs once per `host:port` combination |
**Per-Host** scope is ideal for:
* 📂 **Path discovery profiles** — Directory fuzzing only needs to run once per host
* 🔐 **Fixed-path CVE profiles** — CVE probes targeting specific paths (e.g., `/wp-admin/`, `/actuator/`)
* 📡 **Raw request profiles** — Profiles that send requests to fixed URLs regardless of the scanned page
When a per-host profile has been executed on a given host:port, it's skipped for subsequent URLs on the same host. This significantly reduces scan time and duplicate findings.
> 💡 **Tip:** Of the 256 default profiles, 63 use per-host scope (path discovery, CVE-specific, raw requests). The remaining 193 use per-URL scope.
## ⚡ Performance Considerations
* 🧵 **Per-Scan Thread Pool** — Configure the number of concurrent threads, concurrency, and RPS in the scan popup
* 📝 **Profile Selection** — Disable profiles you don't need to reduce scan time
* 🏷️ **Tags** — Use tags and rules to target specific profile groups instead of running all profiles
* 🎯 **Stop-on-first-match** — The scanner automatically stops testing remaining payloads after a match, reducing redundant requests
* 🔎 **Scan Scope** — Per-host profiles automatically deduplicate, reducing redundant requests across URLs on the same host
* ⏸️ **Pause & Resume** — If you notice the target is struggling, pause the scan and adjust your approach
# Passive Scan
Passive scanning analyzes HTTP traffic passing through Burp Suite without sending any additional requests. It can run automatically in the background (Live Passive Scan) or be launched manually against selected requests with fine-grained tag-based filtering.
## 📝 Types of Passive Profiles
Burp Bounty Pro has two types of passive profiles:
### 📩 Passive Response Profiles
**Scanner type: 2**
Analyze HTTP responses received from the server. Use these to detect:
* 🔑 Sensitive information disclosure (API keys, tokens, credentials)
* 🛡️ Security header misconfigurations (CSP, HSTS, X-Frame-Options)
* 🖥️ Technology fingerprinting (server banners, framework detection)
* ⚠️ Error messages and debug information
* 🌐 Domain takeover indicators
* 🔐 Hardcoded secrets and configuration data
**How it works:**
1. Burp Suite receives an HTTP response
2. All enabled Passive Response profiles are checked against the response
3. Each profile's grep patterns are matched against the response body and/or headers
4. If conditions match, an information issue is reported
### 📨 Passive Request Profiles
**Scanner type: 3**
Analyze HTTP requests sent by the browser or client. Use these to detect:
* 💉 Interesting parameters (SQLi, XSS, SSRF, RCE candidates)
* 🔗 API endpoints and technology indicators
* 🔑 Authentication tokens and session identifiers
* 🖥️ URL patterns suggesting specific technologies (Jira, WordPress, etc.)
* 🐛 Debug and testing parameters
**How it works:**
1. Burp Suite intercepts an HTTP request
2. All enabled Passive Request profiles are checked against the request
3. Each profile's grep patterns are matched against the request URL, headers, and/or body
4. If conditions match, an information issue is reported
## 🚀 Launching a Passive Scan
### 🖱️ Manual Passive Scan (Context Menu)
You can manually launch passive scans against selected requests from anywhere in Burp Suite:
1. Select one or more requests in **Proxy History**, **Target Site Map**, **Repeater**, or any other Burp tool
2. Right-click and select **Passive Scan**
3. Choose the scope of the scan from the submenu:
#### 🏷️ Tag-Based Passive Scan Submenu
```
👁️ Passive Scan
├── 🌐 All (125) ← Run ALL passive profiles (request + response)
│
├── 📨 Passive Request ← Request profiles only
│ ├── All (48) ← All enabled request profiles
│ ├── Parameters (12) ← Only profiles tagged "Parameters"
│ ├── API (5) ← Only profiles tagged "API"
│ ├── Technology (8) ← Only profiles tagged "Technology"
│ └── ... ← Other tags
│
└── 📩 Passive Response ← Response profiles only
├── All (77) ← All enabled response profiles
├── Security_Headers (15) ← Only profiles tagged "Security_Headers"
├── Secrets (10) ← Only profiles tagged "Secrets"
├── Cookie_Security (3) ← Only profiles tagged "Cookie_Security"
└── ... ← Other tags
```
Each menu item shows the **count of matching profiles** in parentheses. Tags are sorted alphabetically, with "All" always at the top.
**Benefits of tag-based launching:**
* 🎯 **Focused scanning** — Run only the passive profiles relevant to your current task
* ⚡ **Faster results** — Skip irrelevant profiles to reduce processing time
* 📂 **Organized workflow** — Group profiles by vulnerability class, technology, or engagement
> 💡 **Example:** You've just discovered a new WordPress site. Right-click the request, select **Passive Scan** > **Passive Response** > **Technology** to quickly check what technologies are detected, without running all 125 passive profiles.
### 🔄 Live Passive Scan (Automatic)
Live Passive Scan runs automatically in the background as traffic passes through Burp Suite:
1. Go to the **Burp Bounty Pro** tab > **Dashboard**
2. Toggle the **Live Passive Scan** button to "on"
3. All HTTP traffic passing through Burp Suite is automatically analyzed by enabled passive profiles
4. When enabled, the **Scope Only** checkbox restricts scanning to in-scope targets
### 🔗 URL Filtering
When launching passive scans manually, the URL filter popup appears (same as Active Scan), giving you control over:
* ✅ Which URLs to include/exclude
* 🌐 Domain filtering
* 📄 File extension filtering
* 🔄 Match and Replace rules for request modification
## 🔄 Passive Scan Flow
```
HTTP Traffic → Burp Suite Proxy
│
├─ 📨 Request → Passive Request Profiles (filtered by tag if selected)
│ ├─ Match grep patterns against request URL, headers, body
│ └─ 🐛 Report findings as Information issues
│
└─ 📩 Response → Passive Response Profiles (filtered by tag if selected)
├─ Match grep patterns against response headers, body
└─ 🐛 Report findings as Information issues
```
## 📊 Passive Scanner Tab
Passive scan results are displayed in the dedicated **Scanners** > **Passive** sub-tab:
* Lists each scanned request with host, method, URL, parameter count, and findings summary
* Tracks which passive profiles matched for each request
* Includes request/response viewers for inspection
## 📝 Managing Passive Profiles
### 📊 Profile Tables
Passive profiles are displayed in two tables within the **Profiles** tab:
| Column | Description |
| ----------------------- | ---------------------------------------------------------------------- |
| ✅ **Enabled** | Checkbox to enable/disable the profile |
| 📝 **Profile Name** | Name of the passive profile |
| 🏷️ **Tags** | Tags assigned to the profile (e.g., "All, Security\_Headers, Secrets") |
| 🐦 **Author's Twitter** | Profile author's Twitter handle |
### 🖱️ Context Menu (Right-Click)
Right-click on one or more selected profiles to access:
| Action | Description |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ✅ **Enable** | Enable the selected profile(s) |
| ❌ **Disable** | Disable the selected profile(s) |
| 🏷️ **Set New Tag** | Assign a new tag to the selected profile(s). Opens a dialog where you enter the tag name. The tag is added to the profile's `.bb` file and appears in the Tags column. |
> 💡 **Tip:** Select multiple profiles with **Ctrl+Click** or **Shift+Click**, then right-click **Set New Tag** to tag them all at once. This is a fast way to organize your passive profiles into categories.
## 🧠 Integration with Smart Scan
Passive scan findings are the foundation of **Smart Scan** rules. When a passive profile matches, it can automatically trigger active scanning:
```
👁️ Passive Match → 📋 Rule Condition Met → 🎯 Active Profiles Execute
```
For example:
* 📨 Passive Request profile detects WordPress URLs → Rule triggers WordPress vulnerability profiles
* 📩 Passive Response profile detects Jira headers → Rule triggers Jira CVE profiles
* 📨 Passive Request profile detects SQLi-like parameters → Rule triggers SQLi active profiles
See [Smart Scan](/scanning/smart-scan) for details.
## 🚫 Excluded File Extensions
To reduce noise, passive scanning automatically excludes responses with these file extensions:
`jpg`, `gif`, `png`, `css`, `svg`, `woff`, `woff2`, `ttf`, `eot`, `ico`, `pdf`, `swf`, `mp3`, `mp4`, `avi`, `mov`
## 📖 Creating Passive Profiles
Passive profiles use the same grep/match system as active profiles but without payloads or insertion points. See:
* 📝 [Creating Passive Profiles](/profiles/creating-passive-profile)
* 🔍 [Grep Options](/profiles/grep-options)
* 🏷️ [Tags](/profiles/tags) — How to organize profiles with tags
## 📚 Examples
### 🛡️ Detecting Missing Security Headers
A Passive Response profile that checks for missing `Strict-Transport-Security` header:
```json
{
"ProfileName": "Strict-Transport-Security",
"Scanner": 2,
"Tags": ["All", "Security_Headers"],
"Grep": [
"true,,Simple String,Only in Headers,Strict-Transport-Security"
],
"NotResponse": true,
"IssueSeverity": "Information"
}
```
The `NotResponse: true` flag inverts the match — the issue is reported when the pattern is **NOT** found.
### 💉 Detecting Interesting Parameters
A Passive Request profile that detects URL parameters commonly associated with SQL injection:
```json
{
"ProfileName": "SQLi_Parameters",
"Scanner": 3,
"Tags": ["All", "Parameters", "SQLi"],
"Grep": [
"true,,Regex,,[?&](id|user_id|item|no|number|order)=",
"true,OR,Regex,,[?&](select|report|role|update|query)=",
"true,OR,Regex,,[?&](col|row|search|table|field)="
],
"IssueSeverity": "Information"
}
```
### 🔄 Workflow: Tag-Based Passive Scan
1. 🏷️ **Organize passive profiles** with descriptive tags:
* Security header profiles → `Security_Headers`
* Secret detection profiles → `Secrets`
* Parameter detection profiles → `Parameters`
* Cookie analysis profiles → `Cookie_Security`
2. 🎯 **Launch focused scans** from the context menu:
* Quick security header audit → **Passive Response** > **Security\_Headers**
* Check for leaked secrets → **Passive Response** > **Secrets**
* Identify interesting parameters → **Passive Request** > **Parameters**
3. 🧠 **Combine with Smart Scan** for automation:
* Parameter detection → automatically trigger SQLi/XSS active profiles
* Technology detection → automatically trigger CVE profiles
# Smart Scan
Smart Scan is one of the most powerful features of Burp Bounty Pro. It uses **Rules** to automatically trigger active scanning profiles when specific passive conditions are detected — creating intelligent, context-aware scanning workflows.
## 💡 Concept
Smart Scan follows an **IF-THEN** pattern:
```
IF passive profile(s) match → THEN execute active profile(s)
```
This means:
1. 👁️ **Passive profiles** continuously analyze all traffic (requests and responses)
2. 📋 When a passive profile matches, **rules** check if conditions are met
3. 🎯 If conditions are met, **active profiles** are automatically executed against the matched request
## ❓ Why Smart Scan?
Instead of running all active profiles against every request (which is slow and noisy), Smart Scan:
* ⚡ **Reduces scan time** — Only tests relevant vulnerabilities for each target
* 🎯 **Reduces false positives** — Only scans when context suggests a vulnerability is likely
* 🤖 **Automates workflows** — No manual intervention needed to target specific technologies
* 🖥️ **Enables technology-specific testing** — Detects WordPress, Jira, Spring, etc. and runs their CVE profiles
## ⚙️ How It Works
### 📘 Example: WordPress Detection
1. 👁️ **Passive Response profile** `Wordpress detection` matches responses containing WordPress indicators (e.g., `wp-content`, `wp-includes`)
2. 📋 **Rule** `Wordpress_Rule` is configured:
* **IF**: Passive Response profile `Wordpress detection` matches
* **THEN**: Execute active profiles: `Wordpress_user_enum_oembed`, `Wordpress_user_enum_json`, `Wordpress_directory_listing`, `Wordpress_Path_Traversal`, `Wordpress_Config_Accessible`, etc.
3. 🎯 **Active scanning** automatically begins on the matched request with WordPress-specific profiles
### 📘 Example: SQL Injection Parameter Detection
1. 👁️ **Passive Request profile** `SQLi_Parameters` detects parameters like `id=`, `user_id=`, `query=`
2. 📋 **Rule** `SQLi_Rule` is configured:
* **IF**: Passive Request profile `SQLi_Parameters` matches
* **THEN**: Execute active profiles: `SQLi`, `SQLi_Timebased_Encoded_Space`
3. 🎯 **Active scanning** targets only the requests with suspicious parameters
## 📋 Rule Structure
Each rule consists of:
### 🔍 Match Conditions (IF)
One or more passive profile matches that must be satisfied:
* 📨 **Passive Request profiles** — Match patterns in HTTP requests
* 📩 **Passive Response profiles** — Match patterns in HTTP responses
* 🔗 **Logic operators** — Combine conditions with AND/OR:
* **AND** — All conditions must match
* **OR** — At least one condition must match
### 🎯 Execute Actions (THEN)
What to do when conditions are met:
* 📝 **Execute specific profiles** — Run named active profiles
* 🏷️ **Execute profiles by tag** — Run all active profiles with a specific tag (e.g., all profiles tagged "XSS")
* 🎯 **Match scope** — Execute on "All Matches" or "First Match" only
## 🔄 Smart Scan Flow
```
HTTP Traffic
│
├─ 📨 Passive Request Profile matches request
│ └─ 📋 Check Rules → IF condition met → 🎯 Execute Active Profiles on this request
│
└─ 📩 Passive Response Profile matches response
└─ 📋 Check Rules → IF condition met → 🎯 Execute Active Profiles on this request
```
## 📊 Smart Scanner Tab
Smart Scan results are displayed in the dedicated **Scanners** > **Smart** sub-tab:
* Lists each evaluated request with host, method, URL, and matched rules
* Shows which active profiles were launched and scan count
* Includes request/response viewers for inspection
## ⚙️ Configuration
### ⚡ Scanner Settings
When Smart Scan rules trigger active scans automatically, they use default scanner settings (**10 threads**, **10 concurrency**, **10 RPS**). These defaults are suitable for most scenarios.
When you manually launch a Smart Scan via the context menu, the URL Filter popup appears with context-aware settings:
| Setting | Description |
| -------------------------- | ---------------------------------------------- |
| 🧵 **Threads** | Number of threads for the scan |
| 🔀 **Passive Concurrency** | Maximum concurrent passive profile evaluations |
| 🔀 **Active Concurrency** | Maximum concurrent active scan connections |
| 📈 **Requests per second** | Rate limit for the scan |
See [Scan Control](/scanning/scan-control) for details on per-scan performance configuration.
### ✅ Enabling/Disabling Rules
* Go to **Burp Bounty Pro** > **Rules** tab
* Enable/disable individual rules with the checkbox
* Only enabled rules participate in Smart Scan
## 📦 Default Rules
Burp Bounty Pro ships with 28 pre-configured rules covering:
* 🖥️ **Technology detection** — WordPress, Jira, Spring Boot, Drupal, Symfony, Weblogic, CouchDB, etc.
* 💉 **Vulnerability parameters** — SQLi, XSS, RCE, LFI, SSRF, SSTI, Open Redirect
* 🌐 **Bulk scanning** — Disabled by default: scan all requests with specific profile groups
See [Default Rules](/reference/default-rules) for the complete list.
## 📖 Creating Custom Rules
See [Creating Rules](/rules/creating-rules) for a step-by-step guide.
# AI Scanner
The AI Scanner uses artificial intelligence to analyze HTTP requests and responses, automatically identifying potential attack surfaces and recommending the most relevant scan profiles — without needing to define rules manually.
## 💡 Concept
The AI Scanner acts as an intelligent reconnaissance layer:
```
HTTP Request → AI Analysis → Findings (parameters + attack types) → Auto-launch Active Profiles
```
Instead of relying on predefined passive rules, the AI Scanner:
* 🔍 **Analyzes every parameter** in the request (URL, body, cookies, JSON, XML, headers)
* 🧠 **Correlates parameter names** with known attack patterns (e.g., `id` → SQLi, `file` → LFI, `url` → SSRF)
* 🪞 **Detects reflection contexts** programmatically (HTML body, JavaScript, attributes, headers)
* 🖥️ **Fingerprints technologies** from response headers and body (WordPress, Jira, Spring, Grafana, etc.)
* 🎯 **Recommends specific profiles** from your active profile library
* ⚡ **Auto-launches active scans** with the recommended profiles (if enabled)
## ⚙️ How It Works
### Analysis Pipeline
1. **Request Preprocessing** — Extracts method, URL, headers, body, parameters, and their types
2. **Programmatic Response Analysis** — Detects parameter reflections, reflection contexts (HTML body, JavaScript, CSS, attributes, event handlers, URL attributes), and security headers
3. **AI Analysis** — Sends the structured data to an AI model with the full profile taxonomy, parameter name correlations, and confidence calibration rules
4. **Result Parsing** — Parses the AI response into structured findings with parameters, attack types, confidence levels, and recommended profiles
5. **Auto-Scan** *(optional)* — Automatically launches active scans using the recommended profiles
### AI Providers
The AI Scanner supports multiple AI providers:
| Provider | Default Model | Default Endpoint |
| ------------------ | ------------------------ | --------------------------------------------------- |
| **OpenAI** | gpt-4o | `https://api.openai.com/v1/chat/completions` |
| **Anthropic** | claude-sonnet-4-20250514 | `https://api.anthropic.com/v1/messages` |
| **Google Gemini** | gemini-pro | `https://generativelanguage.googleapis.com/v1beta/` |
| **OpenRouter** | (configurable) | `https://openrouter.ai/api/v1/chat/completions` |
| **Local (Ollama)** | (configurable) | `http://localhost:11434/api/chat` |
You can use any model available through these providers by changing the **Model** field in Settings.
## 🚀 Launching an AI Scan
### From Context Menu
1. Select one or more requests from **Proxy History**, **Target Site Map**, **Repeater**, or any other Burp tool
2. Right-click and select **AI Scanner** from the Burp Bounty Pro context menu
3. The **URL Filter popup** appears — review URLs and configure scanner settings
4. Click **OK** to start the AI analysis
> ⚠️ **API Key Required:** If no API key is configured, a popup will prompt you to set one up in **Settings** before scanning.
### From the Scanners Tab
1. Go to **Burp Bounty Pro** > **Scanners** > **AI** sub-tab
2. View all AI scan entries with their status and findings
## 📊 AI Scanner Tab
The AI Scanner tab (under **Scanners** > **AI**) displays:
### Results Table
| Column | Description |
| -------------- | ------------------------------------------- |
| **#** | Entry ID |
| **Status** | Analyzing, Complete, Error |
| **Host** | Target hostname |
| **Method** | HTTP method |
| **URL** | Full request URL |
| **Parameters** | Number of parameters detected |
| **Findings** | Summary of findings (e.g., "1 High, 2 Med") |
### Detail Panel
When you select an entry:
* **Request/Response** tabs show the original HTTP request and response
* **AI Response** tab shows the full JSON response from the AI model
### Entry Controls
| Action | Description |
| -------------- | ------------------------------------ |
| ⏸️ **Pause** | Pause the AI analysis for this entry |
| ▶️ **Resume** | Resume a paused entry |
| ❌ **Cancel** | Cancel the analysis |
| 🗑️ **Remove** | Remove the entry from the list |
| 🗑️ **Clear** | Remove all entries |
## 🔍 Finding Structure
Each finding from the AI Scanner contains:
| Field | Description |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **parameter** | The real parameter name from the request |
| **parameter\_type** | url, body, cookie, header, json, xml, multipart |
| **insertion\_point\_hint** | Where to inject payloads (e.g., param\_url\_value, param\_body\_value) |
| **reflected** | Whether the parameter value appears in the response |
| **reflection\_contexts** | Where it's reflected: html\_body, javascript, html\_attribute, url\_attribute, event\_handler, css, html\_comment, response\_header, json\_value, none |
| **response\_content\_type** | Response Content-Type header |
| **attack\_types** | Applicable attack types (SQLi, XSS, RCE, LFI, SSRF, SSTI, XXE, etc.) |
| **confidence** | high, medium, or low |
| **priority** | 1 (Critical) to 5 (Informational) |
| **technology\_detected** | Technology fingerprint found (e.g., wordpress, jira, spring) or null |
| **reasoning** | Brief explanation of why this parameter is interesting |
| **recommended\_profiles** | Exact profile names to use for testing |
### Confidence Levels
| Level | Criteria |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **high** | Parameter reflected in dangerous context (HTML body unencoded, JavaScript block, Location header) without output encoding. Or direct evidence: SQL error messages, file contents in response, template engine output. |
| **medium** | Parameter name correlates strongly with an attack type. Or parameter reflected but in safer context (HTML attribute with encoding, JSON response). |
| **low** | Generic parameter without reflection and without strong name correlation, but accepts user input and at least one attack is plausible. |
## 🎯 Auto-Scan
When **Auto-scan after analysis** is enabled, the AI Scanner automatically launches active scans using the recommended profiles from the AI analysis:
1. The AI returns findings with `recommended_profiles` for each parameter
2. Each recommended profile name is matched against your enabled active profiles (case-insensitive)
3. Matched profiles are collected and launched as an active scan against the original request
4. The launched profiles are displayed in the AI Scanner results
### Example Flow
```
Request: GET /product?id=1&cat=5
│
├─ AI Analysis finds:
│ ├─ id → SQLi (medium) → profiles: SQLi, SQLi_TimeBased
│ └─ cat → SQLi (medium) → profiles: SQLi, SQLi_TimeBased
│
└─ Auto-scan launches: SQLi, SQLi_TimeBased profiles against /product?id=1&cat=5
```
## ⚙️ Settings
AI Scanner settings are accessed from the **Settings** dialog within the AI Scanner tab.
### General Settings
| Setting | Description | Default |
| ---------------------------- | ----------------------------------------------------------- | ---------------- |
| **Enable** | Enable/disable AI Scanner | Enabled |
| **Auto-scan after analysis** | Automatically launch active scans with recommended profiles | Enabled |
| **Provider** | AI provider to use | OpenAI |
| **API Key** | API key for the selected provider | (empty) |
| **Model** | AI model name | gpt-4o |
| **Endpoint** | API endpoint URL | Provider default |
### Prompt Customization
The AI Scanner uses two prompts that can be fully customized via the **Edit Prompts** button:
* **System Prompt** — Defines the AI's role, profile taxonomy, analysis rules, confidence calibration, and output schema
* **User Prompt Template** — Template for each request analysis, with placeholders:
* `{REQUEST}` — Full HTTP request
* `{PARAMETERS}` — Extracted parameters with types and reflection data
* `{RESPONSE_HEADERS}` — Response headers
* `{RESPONSE_ANALYSIS}` — Programmatic response analysis (reflections, contexts, security headers)
* `{AVAILABLE_PROFILES}` — List of all active profiles with tags
> 💡 **Tip:** The default prompts include comprehensive profile taxonomy, parameter name correlations, and examples. Customize them to fit your specific workflow or to add custom profile categories.
### Prompt Auto-Update
When you update Burp Bounty Pro, if the saved prompts are outdated (missing new schema fields or sections), they are automatically reset to the new defaults to ensure compatibility.
## 🖥️ Technology Detection
The AI Scanner can detect technologies from response data and recommend technology-specific CVE profiles:
| Technology | Detection Indicators | Example Profiles |
| -------------- | ------------------------------------------ | --------------------------------------------------------- |
| WordPress | /wp-content/, /wp-admin/, wp-json | Wordpress\_Path\_Traversal, Wordpress\_Config\_Accessible |
| Jira/Atlassian | /rest/api/, X-ASEN header, atlassian-token | CVE-2021-26086, CVE-2019-8442 |
| Spring Boot | /actuator/, X-Application-Context | Spring\_Boot\_Actuators, CVE-2020-5410 |
| Grafana | /api/dashboards/, grafana in paths | CVE-2021-43798\_Grafana\_LFI |
| GraphQL | /graphql endpoint, query in body | Graphql Introspection, GraphQL Batching |
| Drupal | X-Drupal-Cache, /node/ | Drupal\_User\_Enum |
| Symfony | X-Debug-Token, /\_profiler/ | Symfony\_Debug |
Technology-specific profiles are only recommended when evidence is found in the response.
## 📚 Examples
### SQLi Parameter Detection
```
Request: GET /api/users?id=42&sort=name HTTP/1.1
```
AI finding:
```json
{
"parameter": "id",
"parameter_type": "url",
"insertion_point_hint": "param_url_value",
"reflected": false,
"reflection_contexts": ["none"],
"attack_types": ["SQLi"],
"confidence": "medium",
"priority": 3,
"reasoning": "Numeric parameter 'id' is a classic SQLi candidate.",
"recommended_profiles": ["SQLi", "SQLi_TimeBased", "SQLi_Collaborator"]
}
```
### LFI with File Path
```
Request: GET /image?file=./pictures/photo.jpg HTTP/1.1
```
AI finding:
```json
{
"parameter": "file",
"parameter_type": "url",
"insertion_point_hint": "param_url_value",
"reflected": false,
"reflection_contexts": ["none"],
"attack_types": ["LFI"],
"confidence": "medium",
"priority": 2,
"reasoning": "Parameter 'file' controls the file path, making it a strong LFI candidate.",
"recommended_profiles": ["PathTraversal_Linux", "PathTraversal_Windows"]
}
```
### Reflected XSS Detection
```
Request: GET /search?q=test HTTP/1.1
Response:
Results for: test
```
AI finding:
```json
{
"parameter": "q",
"parameter_type": "url",
"insertion_point_hint": "param_url_value",
"reflected": true,
"reflection_contexts": ["html_body"],
"attack_types": ["XSS"],
"confidence": "high",
"priority": 2,
"reasoning": "Parameter 'q' reflected unencoded in HTML body.",
"recommended_profiles": ["XSS", "XSS_GETPOST", "Test_XSS_append"]
}
```
# Scan Control
Burp Bounty Pro provides granular control over scan execution, including pause/resume functionality, per-scan configurable thread pools, request rate limiting, and automatic optimization features.
## 🎮 Dashboard Controls
The Dashboard tab provides the following control buttons:
| Button | Action |
| -------------------- | -------------------------------------------------------------------------------------------------------------------- |
| ⏸️ **Pause All** | Pauses all running scan tasks. Threads block at a safe synchronization point and resume exactly where they left off. |
| ▶️ **Resume All** | Resumes all paused tasks. All blocked threads wake up and continue scanning without losing state. |
| ⏹️ **Stop** | Stops all scans and clears the task queue. Running tasks are interrupted. |
| 🗑️ **Clear Issues** | Clears the issues table (does not affect Burp Suite's issue list). |
> 📝 **Note:** Pause/Resume preserves full scan state — no scan progress is lost. Tasks continue from the exact point where they were paused.
## ⏸️ Pause & Resume
Burp Bounty Pro implements true, thread-safe pause/resume using a custom **PausableThreadPoolExecutor** — a thread pool that suspends execution without destroying threads or losing state.
### 🔧 How It Works
```
┌──────────────┐
│ Scheduler │
│ (per scan) │
└──────┬───────┘
│
┌────────────▼────────────┐
│ PausableThreadPoolExecutor │
│ │
│ ┌─ Thread 1 ──┐ │
│ │ beforeExecute() ──► if isPaused: │
│ │ condition.await() │
│ │ │ │
│ ├─ Thread 2 ──┤ │
│ ├─ Thread 3 ──┤ │
│ └─ Thread N ──┘ │
└────────────────────────────┘
```
1. Each scan creates its own `Scheduler` wrapping a `PausableThreadPoolExecutor`
2. When **Pause** is activated, the executor sets `isPaused = true`
3. Each thread checks `isPaused` in `beforeExecute()` — if paused, the thread blocks on a `Condition.await()`
4. When **Resume** is activated, `isPaused` is set to `false` and `Condition.signalAll()` wakes all blocked threads
5. ✅ Threads continue execution from exactly where they paused
### ⏱️ Pause Time Tracking
Burp Bounty Pro tracks the total time each scan spends paused. This paused time is subtracted from the scan duration calculation, ensuring accurate scan time reporting in the Dashboard. If you pause a scan for 10 minutes, the reported scan time reflects only the active scanning time.
### 🌐 Individual vs. Global Pause
* ⏸️ **Pause All / Resume All** — Controls all running scans at once from the Dashboard
* Each `ScanManager` instance maintains its own independent pause state via its own `Scheduler`
## ⚡ Per-Scan Scanner Settings
Scanner settings are configured **per scan** in the URL filter popup that appears before launching each scan. This allows different scans to use different thread counts and request rates.
### 📊 Configuration Fields
| Setting | Description | Default |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| 🧵 **Threads** | Number of threads in the scan's thread pool. Each scan creates its own independent `Scheduler` with this many threads. | 10 |
| 🔀 **Concurrency** | Maximum concurrent connections for the scan. Controls how many HTTP requests can be in-flight simultaneously. | 10 |
| 📈 **Requests per second** | Rate limit for the scan. Controls the maximum number of requests sent per second. A value of 10 means one request every 100ms per thread. | 10 |
### 🔧 How Per-Scan Settings Work
```
Scan Launch Popup (FilterURLs)
│
├─ 🔗 URL selection and filtering
├─ 🔄 Match and Replace rules
└─ ⚡ Scanner Settings
├─ Threads: [10]
├─ Concurrency: [10]
└─ Requests per second: [10]
│
▼
ScanManager created with these values
│
▼
Scheduler(threads) → PausableThreadPoolExecutor
```
Each scan is independent — you can run one scan with 20 threads against a robust target and another with 2 threads against a rate-limited target, simultaneously.
### 📋 Recommended Configurations
| Scenario | Threads | Concurrency | RPS | Notes |
| --------------------------- | ------- | ----------- | --- | ---------------------------------------- |
| 🏴☠️ **Bug Bounty (fast)** | 20 | 20 | 50 | Stable targets with no rate limiting |
| 🔒 **Penetration Test** | 10 | 10 | 10 | Balanced speed and stealth |
| 🛡️ **Rate-Limited Target** | 3 | 3 | 2 | Avoid triggering WAF or rate limits |
| 🏥 **Sensitive Production** | 2 | 2 | 1 | Minimal impact on live systems |
| 🏢 **Internal Network** | 30 | 30 | 100 | Fast scanning on internal infrastructure |
> 💡 **Tip:** If a target starts returning 429 (Too Many Requests) or dropping connections, reduce the Threads and RPS values. You can also pause the scan, wait a moment, and resume.
### 🧠 Smart Scan Default Values
When Smart Scan rules trigger active scans automatically (without a manual popup), default values of **10 threads**, **10 concurrency**, and **10 RPS** are used. These are suitable for most scenarios.
## 🎯 Stop-on-First-Match
When a payload matches for a given profile and insertion point, Burp Bounty Pro automatically stops testing remaining payloads for that same combination.
**How it works:**
1. A shared `AtomicBoolean` flag is created per (profile + insertion point) combination
2. All payloads for that combination are scheduled as parallel tasks
3. When one task finds a match, it sets the flag to `true`
4. Other tasks check the flag before executing and skip if it's already set
**Benefits:**
* ✅ Prevents duplicate issues for the same vulnerability
* ⬇️ Reduces the number of requests sent to the target
* ⚡ Improves overall scan speed
**Behavior:**
* ⚠️ Due to the parallel nature of scanning, up to 2 issues may occasionally be reported (race condition is benign)
* 🔗 Multi-step profiles have their own stop-on-match logic per step
* 🌐 Collaborator-based profiles (`{BC}`) are excluded from this optimization since detection is asynchronous
## ⏱️ Scan Timeout
Scans are monitored for timeout conditions:
* ⏱️ **Scan Timeout** — If a scan exceeds the configured time limit (configurable in Options, in minutes), it's marked as "❌ Failed"
* 🛑 **Graceful Shutdown** — The thread pool supports a 30-minute graceful shutdown timeout
## 🔄 Redirect Loop Protection
To prevent infinite redirect loops:
* 🛡️ A maximum of **30 redirects** per request chain is enforced
* 🔢 Supported redirect status codes: `300`, `301`, `302`, `303`, `307`, `308`
* 📝 Per-profile redirect limits can be set with the `MaxRedir` field
## 🔁 Duplicate Scan Avoidance
Burp Bounty Pro tracks scan combinations to avoid re-scanning:
* Each (profile + insertion point + payload) combination is tracked
* If a combination has already been scanned, it's skipped on subsequent runs
* This is particularly useful when scanning multiple pages on the same host
## 🔎 Scan Scope (Per-Host Deduplication)
Active profiles support a `scanScope` setting:
| scanScope | Mode | Behavior |
| --------- | --------------------- | --------------------------------------------- |
| 0 | **Per-URL** (default) | Profile runs on every URL scanned |
| 1 | **Per-Host** | Profile runs once per `host:port` combination |
Per-host deduplication is tracked via a thread-safe Set with keys in the format `profileName:host:port`. This eliminates redundant scans for profiles that test fixed paths (directory fuzzing, CVE probes, raw requests).
See [Active Scan](/scanning/active-scan#-scan-scope) for details.
## 🔢 Max Concurrent Scans
Limit the total number of concurrent scans running at any time:
* Configurable in **Options** > **Max Scans**
* Prevents excessive resource consumption when scanning multiple targets simultaneously
# Overview
Profiles are the building blocks of Burp Bounty Pro. Each profile defines a complete vulnerability test: what payloads to send, where to inject them, and how to determine if the test was successful.
## 📂 Profile Types
Burp Bounty Pro supports three types of profiles, identified by the `Scanner` field:
| Scanner Value | Type | Description |
| ------------- | -------------------- | ------------------------------------------ |
| 🎯 1 | **Active** | Sends payloads to test for vulnerabilities |
| 📩 2 | **Passive Response** | Analyzes HTTP responses for patterns |
| 📨 3 | **Passive Request** | Analyzes HTTP requests for patterns |
## 📄 Profile File Format
Profiles are stored as JSON files with the `.bb` extension. Each file contains an array of profile objects:
```json
[
{
"ProfileName": "My_Profile",
"Name": "",
"Enabled": true,
"Scanner": 1,
"Author": "@yourname",
"Payloads": [...],
"Grep": [...],
"MatchType": 1,
...
}
]
```
## 🏗️ Profile Structure
### 📌 Core Fields
| Field | Type | Description |
| ------------- | --------- | ------------------------------------------------------------- |
| `ProfileName` | String | Unique identifier for the profile |
| `Name` | String | Display name (optional) |
| `Enabled` | Boolean | Whether the profile is active |
| `Scanner` | Integer | Profile type: 1=Active, 2=Passive Response, 3=Passive Request |
| `Author` | String | Profile creator |
| `Tags` | String\[] | Tags for categorization and rule targeting |
### 💉 Payload Configuration (Active profiles)
| Field | Type | Description |
| ------------------ | --------- | ---------------------------------------------- |
| `Payloads` | String\[] | List of payloads (format: `"enabled,payload"`) |
| `Encoder` | String\[] | Encoding transformations to apply |
| `UrlEncode` | Boolean | URL-encode the payload |
| `CharsToUrlEncode` | String | Specific characters to URL-encode |
| `payloadsFile` | String | Path to external payloads file |
| `payloadPosition` | Integer | 1=Replace, 2=Append, 3=Insert |
### 🔍 Detection Configuration
| Field | Type | Description |
| ----------------- | --------- | ---------------------------------------------------------------- |
| `Grep` | String\[] | Match patterns (format: `"enabled,operator,type,scope,pattern"`) |
| `MatchType` | Integer | Detection method (1-9) |
| `grepsFile` | String | Path to external greps file |
| `PayloadResponse` | Boolean | Check if payload is reflected in response |
| `NotResponse` | Boolean | Invert match (vulnerability when pattern NOT found) |
| `CaseSensitive` | Boolean | Case-sensitive matching |
### 🔽 Response Filtering
| Field | Type | Description |
| ---------------------- | ------- | ------------------------------------ |
| `ExcludeHTTP` | Boolean | Exclude HTTP header from match scope |
| `OnlyHTTP` | Boolean | Only match in HTTP headers |
| `IsContentType` | Boolean | Filter by Content-Type |
| `ContentType` | String | Expected Content-Type value |
| `NegativeCT` | Boolean | Invert Content-Type filter |
| `IsResponseCode` | Boolean | Filter by HTTP status code |
| `ResponseCode` | String | Expected status code |
| `NegativeRC` | Boolean | Invert status code filter |
| `isurlextension` | Boolean | Filter by URL file extension |
| `urlextension` | String | File extension pattern |
| `NegativeUrlExtension` | Boolean | Invert extension filter |
### 📡 Request Configuration
| Field | Type | Description |
| -------------------- | ---------- | -------------------------------------- |
| `requestType` | Integer | 1=Standard, 2=Raw request |
| `rawRequest` | String | Raw HTTP request template (for type 2) |
| `InsertionPointType` | Integer\[] | Insertion point types to test |
| `Scope` | Integer | Scanning scope |
| `RedirType` | Integer | Redirect handling mode |
| `MaxRedir` | Integer | Maximum number of redirects to follow |
### 🔄 Request Modification
| Field | Type | Description |
| ----------------------- | --------- | ----------------------------------- |
| `changeHttpRequest` | Boolean | Modify the HTTP request method |
| `changeHttpRequestType` | Integer | 1=POST→GET, 2=GET→POST, 3=Toggle |
| `Header` | Object\[] | Match and Replace rules for headers |
| `NewHeaders` | String\[] | Headers to use as insertion points |
| `isHeaderValue` | Boolean | Use header value as insertion point |
### ⏱️ Time-Based Detection
| Field | Type | Description |
| ---------- | ------- | --------------------------- |
| `isTime` | Boolean | Enable time-based detection |
| `TimeOut1` | String | First timing threshold |
| `TimeOut2` | String | Second timing threshold |
### 📏 Content Length Detection
| Field | Type | Description |
| ----------------- | ------- | -------------------------------- |
| `iscontentLength` | Boolean | Enable content length comparison |
| `contentLength` | String | Content length threshold |
### 📊 Variation Detection
| Field | Type | Description |
| --------------------- | --------- | ------------------------------ |
| `VariationAttributes` | String\[] | Response attributes to compare |
### 🐛 Issue Properties
| Field | Type | Description |
| ----------------------- | ------ | --------------------------------------------------------------------- |
| `IssueName` | String | Vulnerability name |
| `IssueSeverity` | String | High, Medium, Low, Information, False positive |
| `IssueConfidence` | String | Certain, Firm, Tentative |
| `IssueDetail` | String | Detailed description (supports `` and `` placeholders) |
| `IssueBackground` | String | Background information about the vulnerability |
| `RemediationDetail` | String | How to fix the vulnerability |
| `RemediationBackground` | String | General remediation guidance |
### 🔗 Multi-Step
| Field | Type | Description |
| ------- | ------- | ----------------------------------------------- |
| `steps` | Step\[] | Array of scanning steps for multi-step profiles |
### ⚙️ Other
| Field | Type | Description |
| ------------------ | ------- | ------------------------------------ |
| `sequence` | Boolean | Sequence mode |
| `Scanas` | Boolean | Scan-as mode |
| `Scantype` | Integer | Scan type |
| `pathDiscovery` | Boolean | Enable path discovery |
| `showIssue` | Boolean | Show issue dialog |
| `HttpResponseCode` | String | Additional HTTP response code filter |
## 🛠️ Managing Profiles
### 📥 Import
1. Go to **Profiles** tab
2. Click **Import**
3. Select one or more `.bb` files
4. ✅ Profiles are loaded into the appropriate category (Active, Passive Request, Passive Response)
### 📤 Export
1. Select profiles in the table
2. Click **Export**
3. Choose a save location
4. ✅ Profiles are saved as `.bb` JSON files
### 📋 Duplicate
1. Select a profile
2. Click **Duplicate**
3. ✅ A copy is created with an auto-generated name suffix
### ✏️ Edit
🖱️ Double-click any profile to open the non-modal editor dialog.
# Creating Active Profiles
This guide walks you through creating an active scanning profile step by step.
## 📝 Step 1: Open the Profile Editor
1. Go to **Burp Bounty Pro** > **Profiles** > **Active Profiles** tab
2. Click **Add** to create a new profile
3. 🪟 The profile editor dialog opens (non-modal — you can interact with Burp while editing)
## 📋 Step 2: Basic Information
| Field | Description | Example |
| ------------------- | ----------------------------- | ---------------- |
| 📝 **Profile Name** | Unique identifier | `My_XSS_Profile` |
| 👤 **Author** | Your name or handle | `@researcher` |
| 🏷️ **Tags** | Categories for organization | `XSS`, `All` |
| ✅ **Enabled** | Whether the profile is active | `true` |
## 💉 Step 3: Define Payloads
Add the payloads that will be injected into insertion points.
**Format:** Each payload entry has an enabled flag followed by the payload value:
```
true,
true,">
false,