Burp Bounty Pro
Burp Bounty Pro
Custom Vulnerability Profiles. Smart Scan Rules. Multi-Step Detection.
What is Burp Bounty Pro?
Burp Bounty Pro is a Burp Suite extension that lets you create custom scan profiles for detecting vulnerabilities in web applications — without writing code. Define your own payloads, match conditions, and detection rules, or use the 254 built-in profiles and 27 Smart Scan rules to start finding real vulnerabilities immediately.
What's New in v3.0
- Multi-Step Scanning — Chain multiple scanning steps with cookie reuse for complex authenticated workflows and multi-stage attack scenarios.
- Smart Scan (IF-THEN Rules) — Detect WordPress? Auto-launch WordPress exploit profiles. Spot SQLi-prone parameters? Trigger targeted injection testing. 27 pre-configured rules included.
- Time-Based Detection Engine — Detect timing-based vulnerabilities like sleep-based SQL injection and blind command injection with configurable thresholds.
- Global Variables — Use dynamic variables like
{CURRENT_HOST},{BC},{REDIRECT_DOMAIN}in payloads and match patterns across all profiles. - 30+ Insertion Point Types — URL params, body params, cookies, JSON keys/values, XML, HTTP headers, URL path components, and more.
- Per-Scan Performance Control — Independent thread pools, configurable request rate, true pause/resume without losing state.
See the Documentation for the full reference, or try it free.
Why Pentesters Choose Burp Bounty Pro
Custom Vulnerability Profiles
254 ready-to-use profiles covering CVEs, XSS, SQLi, SSRF, SSTI, RCE, path traversal, technology detection, and sensitive data exposure. Build your own with custom payloads and match conditions — no code required.
Smart Scan Automation
Create IF-THEN rules that chain passive detection with active attacks automatically. Detect a technology? Launch targeted exploit profiles. Spot suspicious parameters? Trigger injection testing. 27 pre-configured rules included.
Multi-Step Scanning
Chain multiple scanning steps with cookie reuse and sequential execution. Test complex authenticated workflows and multi-stage attack scenarios that single-request scanners can't reach.
Granular Scan Control
Per-scan thread pools, configurable request rate limiting, true pause/resume without losing state, and tag-based profile organization. Run different scans with different settings simultaneously.
What You Get on Day One
- 254 Profiles, Zero Setup
Install the extension, load the default profiles, and start scanning in under 5 minutes. Covers CVEs, common vulnerabilities, technology detection, and sensitive data exposure. - 30+ Insertion Points
URL parameters, body params, cookies, JSON keys/values, XML elements, HTTP headers, URL path components, multipart forms. Define exactly where payloads are injected — far beyond Burp Suite's defaults. - Tag-Based Workflow
Organize profiles by technology, vulnerability type, or custom categories. Right-click any request and launch only the scans you need — WordPress checks, SQLi payloads, or your custom attack set. - Import/Export Profiles
Share .bb profile files across your team. Compatible with GBounty and Burp Bounty Go — one profile format, every tool.
FAQs
They’re Burp Suite Pro extensions, so you’ll need Burp Suite Pro to use them.
Each license is user-based. With one license you have three device activations.
Burp Bounty Pro ships with ready-to-use profiles, but you can easily customize them for unique scenarios.
All scanners can produce false positives, but our optimized profiles help keep them to a minimum.
Visit our Documentation page for guides, best practices, and troubleshooting tips.
Or on our youtube channel:
And the Xs channel:
Verify your license key and ensure you’re running the latest version of Burp Suite Pro.
Java 14 or above. Burp Bounty Pro runs on Burp Suite Professional on Linux, macOS, and Windows.
Version 3.0 introduces multi-step scanning with cookie reuse, a global variables system for dynamic payloads, a time-based detection engine for blind vulnerabilities, Smart Scan IF-THEN rules, per-scan configurable thread pools, and tag-based passive scan launching.
Yes. Export profiles as .bb JSON files and import them on any installation. The same .bb format works in Burp Bounty Pro, Burp Bounty Go, and GBounty.
No — it extends it. Burp Bounty Pro adds 254 custom vulnerability profiles, Smart Scan rules, multi-step scanning, and 30+ insertion point types on top of Burp Suite's native scanning capabilities. Both work together.
Burp Bounty Go
10K+ Req/Sec · Golang Engine · Distributed Scanning
Need raw speed? Burp Bounty Go offloads scanning to a high-performance Golang engine processing 10,000+ requests per second. Run multiple scanning servers on localhost or remote VPS and manage everything from Burp Suite.
Built-in Blind Host for OOB detection · Multi-step profiles · Tag-based scan launching · Same .bb profile format as Burp Bounty Pro · Linux, macOS, and Windows.
