🏠Introduction

Burp Bounty Pro is a powerful Burp Suite extension that allows security researchers and bug bounty hunters to create custom scan profiles for detecting vulnerabilities in web applications. It extends Burp Suite's scanning capabilities by letting you define custom payloads, match conditions, and detection rules — without writing any code.

✨ Key Features

🎯 Custom Active Scanning — Define payloads and match patterns to detect vulnerabilities like XSS, SQLi, SSRF, RCE, path traversal, and more
👁️ Passive Scanning with Tag-Based Launching — Analyze requests and responses passing through Burp Suite. Launch passive scans by tag to run only the checks you need (e.g., only security headers, only secret detection)
🧠 Smart Scan (Rules) — Create IF-THEN rules that automatically trigger active scans when specific passive conditions are detected
🔗 Multi-Step Profiles — Chain multiple scanning steps together with cookie reuse and sequential execution for complex attack scenarios
🔀 Global Variables — Use dynamic variables like {REDIRECT_DOMAIN}, {BC}, {CURRENT_HOST} in payloads and match patterns
📦 254 Default Profiles — Ready-to-use profiles covering CVEs, common vulnerabilities, technology detection, and sensitive data exposure
📋 27 Default Rules — Pre-configured Smart Scan rules for automated vulnerability detection workflows
🔍 Flexible Match Types — Simple string, regex, payload reflection, response variations, content length differences, HTTP response codes, time-based detection, and Burp Collaborator integration
📍 30+ Insertion Point Types — URL parameters, body parameters, cookies, JSON keys/values, XML, HTTP headers, URL path components, and more
⚡ Per-Scan Performance Settings — Configure threads, concurrency, and requests per second independently for each scan
⏸️ Pause & Resume — True thread-safe pause/resume that preserves full scan state. Paused time is excluded from scan duration.
🏷️ Tags System — Organize profiles with tags across all profile types. Tags power the passive scan submenu and Smart Scan rule targeting.
📤 Profile Import/Export — Share and reuse profiles across teams with JSON-based .bb profile files

🆕 What's New in v3.0.0

🔗 Multi-step scanning for complex attack chains
🔀 Global variables system with user-configurable values
⏱️ Time-based vulnerability detection engine
⚡ Per-scan scanner settings (threads, concurrency, RPS) in the scan popup
⏸️ Pause/resume with PausableThreadPoolExecutor — true zero-loss state management
🏷️ Tag-based passive scan launching with Request/Response submenus and profile counts
🏷️ Tags column and Set New Tag on all profile tables (Active, Passive Request, Passive Response)
🎯 Stop-on-first-match optimization for single-step profiles
🪟 Non-modal dialogs, profile duplication, payload/grep markers
🔗 URL filtering for all scan types
🛡️ 30-redirect loop protection and scan timeout detection (with paused time excluded)