Changelog

Version 4.0.1 strengthens license verification and fixes an authorization issue that could interrupt legitimate live scanning. We recommend updating all Pro installations.

Security and Reliability

• Verified license responses: Scanning access requires a signed licensing response, with checks for the license identity, device, product, activation status and expiry.
• Secure licensing connections: Certificate and hostname verification are enforced for direct and proxy connections. Invalid certificates and unverifiable responses do not qualify for connection-failure grace.
• Consistent scan authorization: The same license policy applies to local, passive, Smart, AI and remote scanning, including resumed scans. Existing findings remain readable if scanning access is blocked.
• Live scan continuity: Fixed a separate runtime authorization timeout that could stop legitimate live scanning after five minutes.

License Checks and Connectivity

Pro validates online whenever the extension loads and rechecks every 15 minutes. After a successful check, temporary connectivity failures allow up to five days of continued use within the same session, limited by the verified license expiry. Reloading the extension or restarting Burp requires another online check.

Using a corporate HTTPS proxy? Its certificate authority must be trusted by the Java runtime used by Burp Suite. Keep the system clock accurate and allow access to api.licensespring.com.

Upgrading to 4.0.1

1. Back up your profile pack and saved user storage.
2. Unload the previous extension and load the complete 4.0.1 release JAR. Keep your existing user storage to retain profile locations, variables, server connections and AI settings.
3. Check the version in About and the status in License. Saved keys are checked without automatically activating the device again. If the key is not available in saved storage, enter it in the License tab.

See the documentation for installation and licensing troubleshooting.

Version 1.0.1 strengthens license verification for Server deployments used through Burp Bounty Pro, REST clients and MCP-compatible AI agents. We recommend updating each Server instance.

Security and Reliability

• Signed license validation: Activation and online checks require authentic, unmodified LicenseSpring responses, including verification of the license key, device and expiry binding.
• Validation after activation: Server checks the license again after activation before granting scanning access.
• Stricter failure handling: Certificate, signature and clock validation failures block scanning instead of entering connection-failure grace.
• Expiry enforcement: The temporary connection-failure allowance cannot extend beyond the verified license expiry. Deadlines are enforced even while a validation request is pending.

License Checks and Connectivity

Server validates online at startup and rechecks every 15 minutes. Temporary network or licensing-service outages allow up to 24 hours from the last successful online check, limited by the verified license expiry. Restarting requires another online check.

Your integrations remain compatible. Existing Pro and Server license products, device registrations, REST/MCP client headers, profiles and saved findings remain supported. No new license key is required for this update.

Upgrading to 1.0.1

1. Stop the Server instance and back up its configuration and findings directory.
2. Replace the executable with version 1.0.1 for the same operating system and architecture.
3. Restart with your existing environment and arguments. Retain BURPBOUNTY_LICENSE_KEY, the profile directory and the findings directory. Check that the startup banner reports v1.0.1.

Keep the system clock accurate and allow HTTPS access to api.licensespring.com. See the documentation for deployment and update instructions.

Version 4.0.0 brings distributed scanning with Burp Bounty Server, a more efficient local scanner, and configuration that survives JAR updates.

Burp Bounty Server Integration

• Local and remote scanning: Choose Local Scanner or Burp Bounty Server Scanner from the right-click menu, with active and passive scanning options.
• Multiple servers: Distribute scan batches across configured servers on your workstations, dedicated machines, or VPS instances, with per-server and overall request budgets.
• Server management: Manage connections and authenticated health checks in Settings > Burp Bounty Servers. Selected profiles and custom variables are sent with each scan, preserving the original HTTP/HTTPS service and port.
• More reliable scan control: Improved scan IDs, duplicate suppression, pause/resume/cancel delivery, and recovery after temporary connection loss.
• REST and MCP workflows: The extension connects through Server's REST API. External AI agents can use the companion Server's optional MCP endpoint to launch scans and retrieve findings.

Burp Bounty Server is included with Pro. Each license is for one individual user, with 10 registered activations shared across Pro and Server.

Local Scanner Performance and Controls

• Lower scanning overhead: Payload work is prepared on demand, worker pools are bounded and reused, and repeated pattern matching work is reduced.
• Simpler manual active scan settings: Configure Concurrency and Requests per second. The separate Threads field has been removed from the manual Local Active dialog. Manual Local Active and Server Scanner dialogs default to concurrency 5 and 10 RPS.
• More responsive scan management: Batch preparation runs outside the interface thread, and progress updates are grouped to reduce UI overhead.
• Improved pacing and pause/resume: Better shared request accounting, with paused time excluded from local active scan timeout calculations.
• Timing diagnostics: A new summary in the extension Output tab reports HTTP timing, request outcomes, wait time, and elapsed scan time.

Settings That Survive Updates

• Storage independent of the JAR: Keep your license, profile directory, server connections, AI settings and API key, custom prompts, variables, proxy settings, and live scan preferences when saved user storage is retained.
• Existing configuration migration: Import saved Burp preferences and known legacy license files. Existing activations can be reused on the same computer and user account.
• Automatic profile pack setup: New installations detect a valid BurpBountyData pack beside the JAR and copy it into user storage. Existing configured data directories take precedence.
• Writable storage selection: Use Settings > Storage to choose a suitable directory on macOS, Linux, or Windows, including computers with restricted permissions.
• Safer configuration saves: Added atomic writes, a previous-version backup, conflict detection, and visible errors when settings cannot be saved.

Profiles, Multi-Step Scanning, and Smart Scan

• Matching corrections: Fixed cases involving literal case sensitivity, regular expressions, content-length comparisons, and request/response evidence scopes.
• Payload preparation: Corrected SQLi control steps, insertion-point selection, duplicate custom headers, and multi-step variable substitution and encoding.
• Cookie and redirect handling: Improved cookie replacement and deletion across steps, isolated cookie state between scan chains, and preserved explicit ports in redirect URLs.
• Smart Scan conditions: Corrected AND matching to use the same HTTP exchange, improved First Match coordination, and reduced overlapping rule actions.
• Profile pack and variables: Standardized the data directory as BurpBountyData, corrected profile catalogue entries, and restored legacy redirect and file-testing variables without overwriting customized values.

Results and Interface Reliability

• Remote findings and completion times: Remote passive findings now appear in Scanners > Passive as well as Burp's issues. Completed remote scans display their end time, including after reconnection.
• Reliable scan rows: Fixed remote row creation when persisted Burp messages are unavailable and prevented delayed callbacks from overwriting newly created entries.
• Clear works with one action: Clearing the Active table removes current rows and resets the evidence viewers. Clear affects displayed history; it does not cancel running scans or delete Burp findings.
• Updated completion labels: Local scans with completed requests and partial coverage now display Finished. Startup failures with no completed requests remain Failed, and explicit cancellations remain Cancelled. Actual counters and findings remain available. Remote scans no longer show Finished (incomplete) solely because a blind-host prerequisite is missing; coverage warnings remain available.
• Cleaner remote scan defaults: The dialog is titled Burp Bounty Server Scanner and defaults to Show one success payload for insertion point. Removed the (less optimal) label from the alternative.

Finished indicates that execution ended. Review request counters and coverage warnings when assessing a scan. Server requires its own Blind Host configuration for profiles that need it; it does not inherit Burp Collaborator settings.

Compatibility and Documentation

• Apple Silicon licensing fix: Corrected bundled JNA native support initialization, resolving the missing native library error on affected macOS installations.
• Activation handling: License-check errors no longer automatically trigger a new activation.
• Updated guides: Documentation now covers local and remote scanning, persistent settings, Server deployment, MCP, visual profile creation, and engine compatibility.

Upgrading to 4.0.0

1. Back up your configured data pack and user storage, and keep the previous JAR for rollback.
2. Unload the old extension and load the complete 4.0.0 release JAR. Retain saved user storage to preserve your configuration.
3. Check Settings > General. Pro uses the base BurpBountyData folder containing profiles and rules; Server's --profiles-dir points to the profiles subdirectory.
4. Update your Server instances and check their connection status. Custom REST/MCP clients must use the X-BURPBOUNTY-LICENSE header.

See the documentation for installation instructions and the full configuration reference.

AI Scanner

• AI-Powered Vulnerability Analysis: New AI Scanner that analyzes HTTP requests and responses using artificial intelligence to automatically identify attack surfaces, correlate parameters with vulnerability types, detect technologies, and recommend the most relevant scan profiles from your library.
• Multi-Provider Support: Works with OpenAI, Anthropic (Claude), Google Gemini, OpenRouter, and local models via Ollama. Use any model available through these providers by configuring the model name and endpoint.
• Programmatic Response Analysis: Before sending data to the AI, a built-in analysis engine detects parameter reflections in the response body and headers, identifies reflection contexts (HTML body, JavaScript, CSS, HTML attributes, event handlers, URL attributes, comments), and reports security header presence.
• Auto-Scan: When enabled, the AI Scanner automatically matches recommended profile names against your active profiles and launches them as active scans against the original request.
• Customizable Prompts: Full control over the system prompt (profile taxonomy, analysis rules, confidence calibration, output schema) and user prompt template via the Edit Prompts dialog. Includes auto-upgrade detection for outdated saved prompts.
• 12-Field Output Schema: Each AI finding includes: parameter, parameter type, insertion point hint, reflected status, reflection contexts, response content type, attack types, confidence, priority, technology detected, reasoning, and recommended profiles.
• Technology Fingerprinting: Detects WordPress, Jira/Atlassian, Spring Boot, Grafana, GraphQL, Drupal, Symfony, and more from response headers, paths, and body content. Technology-specific CVE profiles are only recommended when evidence is found.
• Per-Entry Controls: Pause, resume, and cancel individual AI analysis entries independently.

Scan Scope: Per-Host Deduplication

• Per-Host Scan Scope: New scanScope field for active profiles. Per-URL (scanScope: 0, default) runs on every URL; Per-Host (scanScope: 1) runs once per host:port, with thread-safe deduplication. Ideal for path discovery, fixed-path CVE probes, and raw request profiles.
• 63 Default Profiles Updated: Path discovery, CVE-specific, and raw request profiles classified as per-host. The remaining 193 profiles use per-URL scope. Backward compatible: profiles without scanScope default to per-URL.
• Per-Host Scan Grouping: Per-host profiles are grouped into a single scanner table entry per domain, eliminating redundant "0/0 requests" entries when scanning multiple URLs from the same host.

Redesigned Scanners Tab

• Dedicated Sub-Tabs: The scanner view is now organized into five sub-tabs: Active (per-request active scan logging), Passive (passive scan results with matched profiles), Smart (Smart Scan rule matches and launched profiles), AI (AI Scanner entries and findings), and Live (real-time passive scan activity).
• Per-Tab Results Tables: Each sub-tab has its own results table, entry controls (pause/resume/cancel/remove), and request/response viewers.
• Active Tab Highlighting: The Active sub-tab highlights in blue when Smart Scan or AI Scanner launches new active scans, indicating activity in that tab.
• Live Scanner Panel: All live scanner toggles, scope settings, excluded extensions, and concurrency controls consolidated into the Live sub-tab. Toggle buttons turn green when active.

Context-Aware Scanner Settings

• Adaptive URL Filter Popup: The scanner settings panel in the URL Filter popup now adapts based on the scan type, showing only relevant fields:
  • Active Scan: Threads, Active Concurrency, Requests/sec
  • Smart Scan: Threads, Passive Concurrency, Active Concurrency, Requests/sec
  • Passive Scan: Threads, Passive Concurrency
  • AI Scanner: Threads, AI Analysis Concurrency, Active Concurrency, Requests/sec
• Match & Replace panel is hidden for passive scanner type to reduce clutter.

Scanning Improvements

• Smart Scanner Improvements: Uses shared active scan pool instead of recreating the entire pool per rule match. Reports matched rule names and launched profile names to the new Smart Scanner tab. Accepts override thread/concurrency/RPS parameters from the scan launch dialog.
• Passive Scanner Improvements: Accepts thread/concurrency/RPS parameters. Tracks matched profile names for reporting. Rewritten with pause/resume/cancel support and stale-execution detection via generation counters.
• Dynamic Pool Sizing: New adjustCorePoolSize() method on the Scheduler for AI Scanner to temporarily expand the pool for blocked API tasks.
• Error Logging Cleanup: Verbose multi-line stack traces replaced with clean single-line error messages with root cause extraction.

UI Improvements

• API Key Validation Popup: Warning dialog when launching AI Scanner without an API key configured, with an OK button that navigates directly to Settings.
• Settings Auto-Save on Unload: AI Scanner settings are saved from the current UI state when the extension unloads, even without clicking Save.
• Settings Tab Reorganization: Options and Variables tabs consolidated into a Settings tab with General and Variables sub-tabs.
• Dashboard Improvements: Column auto-resize enabled, horizontal scrollbar always visible. "Delete" renamed to "Remove Selected" with new "Clear" option added to context menus.
• 256 Default Profiles: Updated profile library with scan scope classifications. 28 default Smart Scan rules.

Major New Features

• Multi-step Scanning: Profiles now support multiple steps, enabling complex attack chains and multi-stage vulnerability testing. Each step can define its own payloads, match rules, and detection logic. Includes cookie reuse across steps for authenticated workflows, per-step request/response viewing in scan results, and path discovery per step.
• Global Variables System: New user-managed variable system from the Options tab. Define and customize variables like {EMAIL}, {BC}, {RANDOM}, {CURRENT_URL}, {CURRENT_HOST}, {CURRENT_PORT}, {CURRENT_COOKIES}, {CURRENT_USER_AGENT}, {CURRENT_REFERER}, and more. Custom variables are dynamically replaced in payloads, greps, and raw requests.
• Time-based Detection Engine: New time delay matching logic for detecting timing-based vulnerabilities (e.g., sleep-based SQL injection, blind command injection). Supports three comparison modes: "Between", "Greater than", and "Less than", with configurable thresholds in seconds. Fully integrated into multi-step scanning workflows.
• URL Filtering for All Scan Types: FilterURLs popup now appears before Active, Passive, and Smart scanning, giving full control over scope, domains, and file extensions before launching scans.

New UI Features

• Non-modal Dialogs: All profile, rule, and tag editors are now non-blocking. Edit profiles while interacting with Burp Suite, compare multiple profiles side by side, or review scan results while configuring new profiles.
• Profile & Rule Duplication: New "Duplicate" button on all profile tabs (Active, Passive Request, Passive Response) and Rules. Creates copies with automatic naming (Name Copy, Name Copy1, Name Copy2...).
• Double-click to Edit: Double-click any profile or rule row to open the editor directly, without needing the Edit button.
• Payload & Grep Markers: Highlighted in red for better visibility when editing profiles.
• Improved Grep Table: Increased height for better readability of match patterns.

Scanning Efficiency Improvements

• PausableThreadPoolExecutor: New thread pool implementation that supports pause/resume without terminating threads, enabling graceful scan suspension and resource optimization.
• Configurable thread pools for active scanning, passive scanning, and smart scanning, each with independent concurrency control.
• Request throttling: Configurable per-request delay (in milliseconds) to control scan speed, avoid WAF detection, and reduce server load.
• Early filtering pipeline: URL extension, response code, and content-type checks are applied before making HTTP requests, drastically reducing unnecessary traffic.
• Duplicate avoidance: Tracks scanned issue/host combinations to prevent re-scanning the same issue on the same endpoint.
• Redirect loop protection: Maximum of 30 redirects per payload request to prevent infinite redirect chains.
• Scan timeout detection: Configurable timeout (default 60 minutes) that marks scans as Failed and releases resources automatically.
• Queue-based task management for efficient task scheduling and idle state detection.
• Atomic scan ID generation for thread-safe concurrent scan management.
• Passive scan exclusion list: Automatic filtering of static file extensions (jpg, gif, png, css, svg, etc.) to skip unnecessary passive analysis.
• Grep matching optimization: Separates AND/OR logic into grouped evaluation, enabling short-circuit on first OR match.
• Max concurrent scans with configurable limit and graceful 30-minute shutdown timeout.

License & Configuration

• LicenseSpring Integration: Professional license management with activation/deactivation, expiration tracking, and license status display.
• Persistent Settings: All configuration (threads, timeouts, proxy, scan preferences) persisted across Burp Suite sessions.
• Auto-load BurpBountyData: Fixed first-launch path detection for automatic profile loading.

Dashboard

• Dual-view Dashboard: Detailed per-request log tracking host, method, path, status, response time, rule/profile name, severity, and confidence. Summary view aggregates vulnerability counts (info, low, medium, high) by domain.
• Scanner Log: Real-time scan progress tracking with pause/resume/stop controls per scan instance.

UI Polish

• Streamlined Options Tab: Cleaner settings panel, simplified configuration.
• Updated About Page: New commercial description reflecting Burp Bounty Pro 3.0.0 capabilities.
• Improved Step Options Layout: Better UI layout for multi-step configuration.