Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Professional

Prompting Burp AT effectively

  • Last updated: July 23, 2026

  • Read time: 2 Minutes

Burp AT can handle goals of any size, from wide-ranging to quick and focused.

This page helps you write effective prompts.

What to include

For best results, write your prompt as clearly as possible. A clear prompt may cover:

  • Target - which URL or endpoints you want Burp AT to work on.

  • Scope - which paths to include, and anything to leave alone.

  • Outcome - what you want to find out, so you can tell when the goal is met.

  • Context - how to sign in, and anything Burp AT should know about how the application works.

Aim for an outcome you can verify yourself, so you can confirm what Burp AT finds and report it with confidence.

You can also tell Burp AT how thorough to be, and which area to focus on. You might ask it to try several techniques, or to confirm a result before moving on.

For example:

  • Instead of Test my application, write Test https://example.com for broken access control on the /admin endpoints. I can sign in as a low-privileged user with these credentials.

  • Instead of Find vulnerabilities in this request, write This login request may be vulnerable to SQL injection in the username parameter. Confirm whether it is, and show me the evidence.

Note

Burp AT may decline a prompt it considers outside acceptable use, even when your testing is authorized. If this happens, rephrase it to make the testing context clear.

Templates to start from

Use these examples as starting points, and fill in your own target, scope, and detail.

To set a goal at the start of a task:

  • A broad goal: Map [target], then probe [area] for common weaknesses.

  • A focused goal: [Request or endpoint] may be vulnerable to [issue]. Confirm whether it is, and show me the evidence.

  • An authenticated goal: Test [target] for [issue type] as a [role] user. Sign in with [credentials].

If you do want to adjust course, steer it with follow-up prompts:

  • Narrow the focus: Focus on [finding] and confirm whether it is exploitable.

  • Extend the work: Now test [related area] the same way.

  • Push for depth: Try [technique] before moving on.

Giving Burp AT context

Attaching resources from Burp, such as a request or a site map node, helps to make your goals and prompts more effective. For more information on the resources you can attach and how to use them, see Tasks.