ProfessionalCommunity Edition

Creating custom scan checks

• Last updated: September 11, 2025

• Read time: 3 Minutes

Custom scan checks enable you to extend Burp Scanner with your own vulnerability detection logic. You can create two types of custom scan checks:

• Scripts - Written in Java with access to our Montoya API. Best if you want to build more complex checks.

• BChecks - Written in our custom BCheck language. Best for quick, lightweight checks.

To help you get started, we provide the following:

• Built-in starter templates in the editor.

• Inline suggestions and error highlighting in the editor.

• A range of community and reference resources.

Creating script-based checks

To create a new custom scan check using Java:

1. Go to Extensions > Custom scan checks.

2. Click New and select Blank script or From template.

3. If you selected From template:

   1. Select the Script mode tab.

   2. Select a template from the list.

   3. Click Create using this template.

4. Select the script Type. You can choose from Active or Passive.

5. Select when the Script runs. You can choose from Per insertion point, Per request, or Per host.

6. Write the script in Java.

7. Click Validate. Any errors are shown in the Errors panel. You must resolve these before you can use your scan check. For more information, see Troubleshooting scripts.

8. [Optional] Test the script against real HTTP messages. For instructions, see Testing custom scan checks.

9. Click Save & close.

The check is saved to your custom scan checks library for use in scans and across projects.

Creating BCheck-based checks

To create a custom scan check using our custom BChecks language:

1. Go to Extensions > Custom scan checks.

2. Click New and select either Blank BCheck or From template.

3. If you selected From template:

   1. Select the BCheck mode tab.

   2. Select a template from the list.

   3. Click Create using this template.

4. Write the script in our BCheck language. For reference documentation, see BCheck definitions.

5. Click Validate. Any errors are shown in the Errors panel. You must resolve these before you can use your scan check.

6. [Optional] To standardize the indentation and whitespace, right-click the editor and select Format BCheck.

7. [Optional] Test the BCheck against real HTTP messages. For more information, see Testing custom scan checks.

8. Click Save & close.

The check is saved to your custom scan checks library for use in scans and across projects.