Turn your testing methodology into reusable scans. Create custom vulnerability checks in Burp Suite without writing code, then run them locally or across your own servers.
Requires Burp Suite Professional, purchased separately.
Start with included profiles or use the visual editor to define your own payloads, insertion points, and detection conditions. Run active or passive checks by tag.
Use Smart Scan rules to trigger checks when conditions match. Chain requests with cookie reuse to test workflows that need more than one step.
The optional AI Scanner analyzes HTTP context to suggest relevant profiles. Connect your preferred provider, including local models through Ollama.
Set request rate and concurrency, pause and resume scans, and track progress in Burp Suite. Choose the local scanner or send work to your servers.
Included with your Pro license
Burp Bounty Server lets you run scans on your own infrastructure. Distribute work across multiple servers from the extension, or connect external AI agents to those servers through MCP.
“Creating custom scanners with custom payloads allows me to automate part of my workflow and adapt it to my specific methodology.”
Burp Bounty Server is a standalone web vulnerability scanner powered by a Go engine. Run it on your own machines or VPS instances, connect your AI agents through MCP, automate scans with the REST API, or launch remote scans from Burp Bounty Pro.
Runs on Linux, macOS, and Windows. No Burp Suite installation required for standalone use.
Let an MCP-compatible agent discover profiles, launch scans, monitor progress, and retrieve findings. The scanning engine executes the payloads, while your agent coordinates the work and reviews the results.
Run instances on your workstation, dedicated servers, or VPS infrastructure. Register them in Burp Bounty Pro or connect them to your agent as separate MCP servers to distribute scanning work across your available instances.
Use the included profiles or load your own .bb files. Run active checks, analyze supplied traffic with passive profiles, and execute multi-step tests. Select profiles by name or tag to focus on the checks you need.
Focus compatible active profiles on a specific part of a request with $BBOUNTY$ markers. Wrap a parameter value to define exactly where payloads are injected, without testing every parameter in the request.
Set request rate and concurrency limits to suit the target and your infrastructure. Monitor progress, pause and resume scans, or cancel them when needed. Move scan execution to remote machines to reduce the workload on your laptop.
Retain scan summaries and finding evidence so your agent can revisit results after a scan finishes or the server restarts. Configurable retention and storage limits keep history manageable, with detailed evidence available when needed.
Once your agent is connected to Burp Bounty Server and the profiles are loaded, give it a request and a focused task:
Use the SQLi profiles to scan only the id parameter in the request I provide. Limit the scan to 10 requests per second with concurrency 5, then summarize the findings with supporting evidence.Explore the setup guides and MCP documentation
Use Burp Bounty Server independently through MCP or REST, or connect it to Burp Bounty Pro for remote scanning from Burp Suite.
Licensed per user with up to 10 activations. Already using Burp Bounty Pro? Server is included, with the same 10-activation allowance shared across both products.
Bounty Prompt is a free, open-source Burp Suite extension that connects your HTTP traffic directly to AI engines. Save pre-configured prompts, attach any request/response from Burp Suite, and get tailored security insights in seconds powered by Burp AI and Groq Cloud.
Stop copying and pasting HTTP requests into ChatGPT. Bounty Prompt sends the full context to the AI automatically and returns actionable analysis from vulnerability identification to exploitation suggestions without leaving Burp Suite.
What Bounty Prompt does for you:
Open Source: Free to use, inspect, and contribute. Built by the community, for the community.
Go Beyond the Login Screen.
Public endpoints are only part of the attack surface. Burp Bounty Pro and Burp Bounty Server let you chain requests and reuse cookies to test authenticated workflows, where sessions and request order matter.
About Bounty Security
Founded by Eduardo Garcia, Bounty Security builds tools inspired by real pentesting work: turning manual checks into reusable tests, automating repetitive tasks, and keeping you in control of each scan.
Burp Bounty Pro and Burp Bounty Server bring custom scanning to Burp Suite, your own infrastructure, and AI agent workflows. We also develop Bounty Prompt as open-source tools for the security community.
We build for pentesters, security consultancies, AppSec teams, and bug bounty hunters who want tools that fit the way they work.
Automate the repetitive work. Make room for human judgment.
One Profile Format. Pro and Server.
Create custom vulnerability profiles visually in Burp Bounty Pro and reuse them with Burp Bounty Server. Export your .bb files to share checks with your team and bring your detection logic to local and remote scanning workflows.
Your testing workflow
Choose the checks, set the pace, and run them where they fit your engagement.
Scan locally in Burp Suite or distribute work across your own Burp Bounty Servers. Set request rate and concurrency to suit each engagement.
Build reusable profiles in Burp Bounty Pro. Combine Smart Scan rules and multi-step workflows to control what runs and when.
Work inside Burp Suite, integrate through REST, or connect AI agents to Burp Bounty Server through MCP. Use the tools and infrastructure you already have.
★★★★★Go check the new Burp Bounty release! This awesome plugin helps me a lot in my daily bug hunting and pentest 💪🏼
#bugbountyDiego Jurado
★★★★★Never heard of "Burp Bounty"? Then check it out, it's an awesome Burp extension and you should be using it already!
sw33tLie
★★★★★Bounty Thursdays - H1 paid $2.4m to hackers in ONE week , VirSecCon aftermath & Burp Bounty update.
STÖK ✌️
★★★★★😎 Seriously, you should already be using Burp Bounty Pro
@BurpBounty
#BugBounty #bugbountytipsSix2dez
Trusted by security teams worldwide.
Choosing between Pro and Server? Start here.
Choose Burp Bounty Pro for a Burp Suite workflow with visual profile creation, Smart Scan rules, and local or remote scanning. Burp Bounty Server is included with Pro.
Choose Burp Bounty Server on its own if you want to run scans on your infrastructure through REST or AI agents using MCP. A Server-only license does not activate the Pro extension.
Burp Bounty Pro requires Burp Suite Professional, purchased separately. Burp Bounty Server runs independently and does not require Burp Suite.
No. Both products include ready-to-use profiles. For custom checks, Burp Bounty Pro provides a visual editor for payloads, insertion points, and detection conditions. Export your profiles as .bb files to share them or reuse them with Server.
Yes. Run Burp Bounty Server on your own machines or VPS instances and add them to Pro, or connect each instance to your AI agent through MCP. Pro can distribute scan batches across configured servers; with MCP, your agent coordinates the work.
Deployment is subject to your license activation allowance. Request rate and concurrency controls let you manage scan load.
Each license is for one individual user and allows 10 registered activations. With Pro, those 10 activations are shared across Pro and Server. A Server-only license provides 10 activations for Server.
The activation allowance lets you use multiple environments; it does not provide additional user seats. Each person using the software needs their own license.
No. Profile-based scanning works without AI. Pro includes an optional AI Scanner to help select relevant checks, while Server offers MCP so external AI agents can launch scans and retrieve findings.
You choose your AI provider or agent. External AI services may have their own usage costs.
Yes. Supply requests with the session context needed by the application, then use multi-step profiles and cookie reuse to chain checks. You configure the workflow and authentication requirements for your target.
Burp Bounty Pro runs inside Burp Suite Professional on Windows, macOS, and Linux. Server binaries are available for Linux AMD64, Windows AMD64, and macOS on Intel or Apple Silicon.
See the installation documentation for setup instructions and requirements.
Local scans run through Burp Suite on your computer. Remote scans send the selected requests and profiles to the Burp Bounty Servers you configure.
If you use AI features or an external AI agent, request, response, or finding data can also be shared with your selected AI provider. Where that data is processed depends on your provider and configuration. License validation and update checks also contact external services.
Yes. Findings reflect the detection conditions defined in each profile. Review the request and response evidence and validate the impact before reporting an issue. Automated checks can produce false positives or miss vulnerabilities.
Yes. We provide product updates and help with setup and troubleshooting. The documentation covers installation, profiles, scanning, and MCP. For assistance, contact our team.
Visual Profile Editor · Smart Scan · Local & Remote Scanning
Build custom vulnerability profiles in a visual editor, run active and passive scans inside Burp Suite, and use Smart Scan rules to launch targeted checks from passive findings.
Your Pro subscription also includes Burp Bounty Server. Distribute scans across your servers and VPSs, review remote findings in Burp, or use Server independently through REST and MCP.
Licensed per user, with 10 activations shared across Pro and Server. The Pro extension requires Burp Suite Professional, sold separately.
