👁️Creating Passive Profiles

Passive profiles analyze HTTP traffic without sending additional requests. They are ideal for detecting sensitive information, security misconfigurations, and technology fingerprints.

📩 Passive Response Profile

🤔 When to Use

Use Passive Response profiles to analyze server responses for:

• 🛡️ Missing or misconfigured security headers

• 🔑 Sensitive data exposure (API keys, tokens, passwords)

• 🖥️ Technology indicators and version numbers

• ⚠️ Error messages and debug information

• 🌐 Domain takeover indicators

📝 Step-by-Step Creation

1️⃣ Open the Profile Editor

1. Go to Burp Bounty Pro > Profiles > Passive Response Profiles tab

2. Click Add

2️⃣ Basic Information

{
  "ProfileName": "Missing_CSP_Header",
  "Scanner": 2,
  "Author": "@researcher",
  "Enabled": true,
  "Tags": ["All", "Security Headers"]
}

3️⃣ Define Grep Patterns

For Passive Response profiles, grep patterns are matched against the HTTP response (headers and/or body).

🛡️ Example: Detect missing Content-Security-Policy header

true,,Simple String,Only in Headers,Content-Security-Policy

With NotResponse: true, this reports an issue when the header is NOT found.

🔑 Example: Detect exposed API keys

true,,Regex,,(?i)(api[_-]?key|apikey)\s*[:=]\s*['"][a-zA-Z0-9]{20,}['"]

☁️ Example: Detect AWS credentials in responses

true,,Regex,,AKIA[0-9A-Z]{16}
true,OR,Regex,,(?i)aws_secret_access_key\s*=\s*[a-zA-Z0-9/+=]{40}

4️⃣ Configure Match Options

Option	Description
🔄 NotResponse	Set to true to report when pattern is NOT found (e.g., missing headers)
🔤 CaseSensitive	Set to true for case-sensitive matching
🚫 ExcludeHTTP	Exclude HTTP headers from the match scope
📋 OnlyHTTP	Only match in HTTP headers

5️⃣ Set Issue Properties

{
  "IssueName": "Missing Content-Security-Policy Header",
  "IssueSeverity": "Information",
  "IssueConfidence": "Certain",
  "IssueDetail": "The response does not include a Content-Security-Policy header."
}

📚 Complete Example: Server Banner Detection

[
  {
    "ProfileName": "ServerBannerResponse",
    "Enabled": true,
    "Scanner": 2,
    "Author": "@bountysecurity",
    "Payloads": [],
    "Grep": [
      "true,,Regex,Only in Headers,Server:\\s.*"
    ],
    "Tags": ["All"],
    "MatchType": 1,
    "CaseSensitive": false,
    "IssueName": "ServerBannerResponse",
    "IssueSeverity": "Information",
    "IssueConfidence": "Certain",
    "IssueDetail": "<br/>- GREP: <br/><grep>"
  }
]

---

📨 Passive Request Profile

🤔 When to Use

Use Passive Request profiles to analyze outgoing requests for:

• 💉 Interesting parameter names (candidates for SQLi, XSS, SSRF, RCE)

• 🔗 API endpoint patterns

• 🖥️ Technology-specific URL patterns (Jira, WordPress, Spring Boot, etc.)

• 🔑 Authentication tokens and session IDs

• 📁 URLs containing file paths or redirect parameters

📝 Step-by-Step Creation

1️⃣ Open the Profile Editor

1. Go to Burp Bounty Pro > Profiles > Passive Request Profiles tab

2. Click Add

2️⃣ Basic Information

{
  "ProfileName": "SSRF_Parameters",
  "Scanner": 3,
  "Author": "@researcher",
  "Enabled": true,
  "Tags": ["All", "SSRF"]
}

3️⃣ Define Grep Patterns

For Passive Request profiles, grep patterns are matched against the HTTP request (URL, headers, and/or body).

🌐 Example: Detect SSRF-prone parameters

true,,Regex,,[?&](url|uri|path|dest|redirect|src|source|file|document|folder|root|pg|style|pdf|template|php_path|doc)=

🖥️ Example: Detect WordPress requests

true,,Regex,,/wp-(admin|content|includes|login|json)/
true,OR,Simple String,,/xmlrpc.php
true,OR,Simple String,,/wp-cron.php

📋 Example: Detect Jira requests

true,,Regex,,/jira/
true,OR,Regex,,/rest/api/
true,OR,Regex,,/plugins/servlet/

4️⃣ Set Issue Properties

{
  "IssueName": "SSRF-Prone Parameters Detected",
  "IssueSeverity": "Information",
  "IssueConfidence": "Firm",
  "IssueDetail": "Request contains parameters commonly associated with SSRF vulnerabilities.<br/><br/>- GREP: <br/><grep>"
}

📚 Complete Example: SQLi Parameter Detection

[
  {
    "ProfileName": "SQLi_Parameters",
    "Enabled": true,
    "Scanner": 3,
    "Author": "@bountysecurity",
    "Payloads": [],
    "Grep": [
      "true,,Regex,,[?&](id|user_id|item|no|number|order)=",
      "true,OR,Regex,,[?&](select|report|role|update|query)=",
      "true,OR,Regex,,[?&](col|row|search|table|field)="
    ],
    "Tags": ["All"],
    "MatchType": 2,
    "CaseSensitive": false,
    "IssueName": "SQLi_Parameters",
    "IssueSeverity": "Information",
    "IssueConfidence": "Firm",
    "IssueDetail": "Interesting parameters found that could be vulnerable to SQL Injection.<br/>- GREP: <br/><grep>"
  }
]

---

📊 Key Differences: Response vs Request Profiles

Aspect	Passive Response (Scanner=2)	Passive Request (Scanner=3)
🔍 Analyzes	Server responses	Client requests
⏱️ Timing	After server responds	Before/when request is sent
🎯 Common use	Data exposure, misconfigurations	Parameter discovery, tech detection
💉 Payloads	Not used	Not used
📍 Insertion Points	Not used	Not used
🧠 Smart Scan	Can trigger active profiles via Rules	Can trigger active profiles via Rules

💡 Tips

• 🔄 Use NotResponse for missing headers — Set NotResponse: true to detect when expected patterns are absent

• 🧠 Combine with Rules — Passive profiles are most powerful when combined with Smart Scan rules to trigger targeted active scans

• 🌐 Keep patterns broad for discovery — Passive profiles for parameter discovery should cast a wide net

• 🎯 Keep patterns specific for detection — Passive profiles for vulnerability/data detection should be precise to avoid noise

• 🏷️ Use Tags — Tag your profiles to make them easy to reference in Rules