Burp Bounty Pro extends Burp Suite with custom vulnerability profiles, Smart Scan rules, AI-powered targeting, and multi-step scanning, so you find what automated scanners miss, without writing code. Built by a pentester, for pentesters.
🔬 AI Scanner
An LLM analyzes each request and decides which vulnerability types to test for. A programmatic routine extracts reflection points, security headers, and content type first. The AI reasons about that context and launches the right profiles automatically. Supports OpenAI, Anthropic, Gemini, OpenRouter, and Ollama.
🧠 Smart Scan (IF-THEN Rules)
Chain passive detection with active attacks automatically. Detect WordPress? Launch WordPress-specific exploit profiles. Spot SQLi-prone parameters? Trigger targeted injection testing. 27 pre-configured rules included, or build your own.
🎯 254 Ready-to-Use Profiles
Start scanning immediately with built-in profiles covering CVEs, XSS, SQLi, SSRF, SSTI, RCE, path traversal, technology detection, and sensitive data exposure. Or create your own custom profiles, no code required.
👁 Passive Scanning
Analyze HTTP traffic passively for security headers, leaked secrets, API keys, technology fingerprints, and interesting parameters. Launch scans by tag to run only the checks you need. Enable Live Passive Scan to analyze all traffic automatically.
🔗 Multi-Step Scanning
Chain multiple scanning steps with cookie reuse and sequential execution. Each step defines its own payloads, match rules, and detection logic. Test authenticated workflows and multi-stage attack scenarios that single-request scanners can't reach.
⚡ Granular Scan Control
Per-scan thread pools, configurable request rate limiting, true pause/resume without losing state, and per-host scan deduplication. Run different scans with different performance settings simultaneously against multiple targets.
📍 30+ Insertion Point Types
Test URL parameters, body params, cookies, JSON keys/values, XML, HTTP headers, URL path components, and more. Define exactly where payloads are injected, far beyond Burp Suite's default insertion points.
🏷️ Tags & Profile Management
Organize profiles by technology stack, vulnerability type, or custom categories. Tags power the passive scan context menu and Smart Scan rule targeting. Import/export profiles across teams with .bb files.
🔀 Global Variables
Use dynamic variables like {BC} for Collaborator payloads, {REDIRECT_DOMAIN} for open redirect testing and more. Variables work in both payloads and grep patterns, so profiles adapt to any target automatically.
"The ability to perform a fast, targeted analysis of endpoints and select vulnerability types based on my prior manual analysis significantly optimizes both time and efficiency. Creating custom scanners with custom payloads allows me to automate part of my workflow and adapt it to my specific methodology."
Application Security Researcher & Bug Bounty Hunter, Burp Bounty Pro user
Works with Burp Suite Professional. Java 14+ required. Set up in under 3 minutes.
Burp Bounty Server is a standalone web vulnerability scanner powered by a Go engine. Run it on your own machines or VPS instances, connect your AI agents through MCP, automate scans with the REST API, or launch remote scans from Burp Bounty Pro.
Runs on Linux, macOS, and Windows. No Burp Suite installation required for standalone use.
Let an MCP-compatible agent discover profiles, launch scans, monitor progress, and retrieve findings. The scanning engine executes the payloads, while your agent coordinates the work and reviews the results.
Run instances on your workstation, dedicated servers, or VPS infrastructure. Register them in Burp Bounty Pro or connect them to your agent as separate MCP servers to distribute scanning work across your available instances.
Use the included profiles or load your own .bb files. Run active checks, analyze supplied traffic with passive profiles, and execute multi-step tests. Select profiles by name or tag to focus on the checks you need.
Focus compatible active profiles on a specific part of a request with $BBOUNTY$ markers. Wrap a parameter value to define exactly where payloads are injected, without testing every parameter in the request.
Set request rate and concurrency limits to suit the target and your infrastructure. Monitor progress, pause and resume scans, or cancel them when needed. Move scan execution to remote machines to reduce the workload on your laptop.
Retain scan summaries and finding evidence so your agent can revisit results after a scan finishes or the server restarts. Configurable retention and storage limits keep history manageable, with detailed evidence available when needed.
Once your agent is connected to Burp Bounty Server and the profiles are loaded, give it a request and a focused task:
Use the SQLi profiles to scan only the id parameter in the request I provide. Limit the scan to 10 requests per second with concurrency 5, then summarize the findings with supporting evidence.Explore the setup guides and MCP documentation
Use Burp Bounty Server independently through MCP or REST, or connect it to Burp Bounty Pro for remote scanning from Burp Suite.
Licensed per user with up to 10 activations. Already using Burp Bounty Pro? Server is included, with the same 10-activation allowance shared across both products.
GBounty is a free, open-source web vulnerability scanner built in Golang for speed and precision. It uses multi-step, profile-based scanning to detect vulnerabilities across web applications — from exposed parameters and software versions to complex chained attack scenarios. Runs on Linux, Windows, and macOS.
If you use Burp Bounty Pro or Burp Bounty Go, GBounty shares the same profile format — so your custom profiles work across all three tools. If you need a standalone scanner outside of Burp Suite, GBounty is your answer.
What makes GBounty different:
Open Source — Free to use, inspect, and contribute. The core scanning engine that powers the Bounty Security ecosystem.
Bounty Prompt is a free, open-source Burp Suite extension that connects your HTTP traffic directly to AI engines. Save pre-configured prompts, attach any request/response from Burp Suite, and get tailored security insights in seconds — powered by Burp AI and Groq Cloud.
Stop copying and pasting HTTP requests into ChatGPT. Bounty Prompt sends the full context to the AI automatically and returns actionable analysis — from vulnerability identification to exploitation suggestions — without leaving Burp Suite.
What Bounty Prompt does for you:
Open Source — Free to use, inspect, and contribute. Built by the community, for the community.
Why Authenticated Scanning Matters
The highest-severity vulnerabilities live behind the login — broken access controls, privilege escalation, user-specific logic flaws. Burp Bounty Pro's multi-step scanning with cookie reuse tests what unauthenticated scanners never reach.
Bounty Security builds offensive security tools that solve the problems we face ourselves. From Burp Bounty Pro with 254 vulnerability profiles and Smart Scan rules, to Burp Bounty Go processing 10,000+ requests per second across distributed servers, to open-source tools like Bounty Prompt (AI-powered security analysis) and GBounty (standalone Golang scanner) — everything we ship comes from real-world pentesting experience.
Built for the people who break things to make them safer:
One Profile Format. Every Tool.
Build a vulnerability profile once, export it as a .bb file, and use it across Burp Bounty Pro, Burp Bounty Go, and GBounty. Your custom detection logic works everywhere.
We build offensive security tools that solve real problems in the field. Our scanners are used daily by penetration testers, Red Teams, and bug bounty hunters to find vulnerabilities faster — with the precision and control that automated tools usually lack.
Our Golang scanning engine processes 10,000+ requests per second. Burp Bounty Pro runs 254 profiles with per-scan thread control. We don't just claim speed — we engineer it into every component.
Smart Scan rules chain passive detection with active attacks automatically. Multi-step profiles test complex workflows. You define exactly what to scan and how — the tools handle the repetitive work.
Custom profiles, configurable payloads, 30+ insertion point types, tag-based scan launching, and importable/exportable .bb profile files. Every tool adapts to how you work — not the other way around.
★★★★★Go check the new Burp Bounty release! This awesome plugin helps me a lot in my daily bug hunting and pentest 💪🏼
#bugbountyDiego Jurado
★★★★★Never heard of "Burp Bounty"? Then check it out, it's an awesome Burp extension and you should be using it already!
sw33tLie
★★★★★Bounty Thursdays - H1 paid $2.4m to hackers in ONE week , VirSecCon aftermath & Burp Bounty update.
STÖK ✌️
★★★★★😎 Seriously, you should already be using Burp Bounty Pro
@BurpBounty
#BugBounty #bugbountytipsSix2dez
Trusted by security teams worldwide.
Our solutions are built for efficiency, adaptability, and precision—with a special emphasis on authenticated scanning. By seamlessly integrating with top platforms like Burp Suite Pro, our tools allow you to test even behind login screens, centralizing all findings into one project. Plus, advanced customization ensures you can tackle any testing scenario with ease.
Not necessarily. While our products include powerful features for seasoned pros—like automating scans in authenticated sessions—they’re also designed to be intuitive for those new to cybersecurity. This balance makes it simple for users of all experience levels to set up effective scans right away.
Yes. Our tools, including Burp Bounty Pro and GBounty, are fully compatible with Linux, Windows, and macOS, ensuring you can run authenticated and unauthenticated tests across any environment.
Absolutely. We offer dedicated technical support to help with setup, troubleshooting, and maximizing your tool’s capabilities—particularly when configuring authenticated scanning. Our products also receive regular updates to stay ahead of evolving security threats, guaranteeing continued reliability and effectiveness.
Your privacy is a priority. Our tools conduct scans locally, without sending sensitive data to external servers. We also adhere to industry best practices to maintain the highest level of data integrity and confidentiality, ensuring that any information gathered—authenticated or not—remains secure.
Visual Profile Editor · Smart Scan · Local & Remote Scanning
Build custom vulnerability profiles in a visual editor, run active and passive scans inside Burp Suite, and use Smart Scan rules to launch targeted checks from passive findings.
Your Pro subscription also includes Burp Bounty Server. Distribute scans across your servers and VPSs, review remote findings in Burp, or use Server independently through REST and MCP.
Licensed per user, with 10 activations shared across Pro and Server. The Pro extension requires Burp Suite Professional, sold separately.
