The Burp Suite Certified Practitioner was one of the certifications I wanted the most because it is so directly tied to practical web application penetration testing. Burp Suite is everywhere in web app pentesting, and PortSwigger has built one of the best hands-on learning platforms in the field around it.
Burp Suite is to web application pentesting what a socket set is to a mechanic: not the only tool you’ll ever use, but one of the core pieces of the trade. PortSwigger has built an industry-standard platform around it, and the BSCP is a practical way of proving you can actually use it.
What the BSCP Is
The BSCP is a practical web application hacking certification from PortSwigger. It is not a multiple-choice exam where knowing definitions is enough. You actually have to find vulnerabilities, understand what is happening, and exploit them. The material covers a wide range of web application vulnerabilities, including XSS, SQL injection, authentication and access control issues, SSRF, HTTP request smuggling, deserialization, path traversal, file upload vulnerabilities, business logic issues, and quite a bit more.
That is one of the biggest reasons I wanted the certification. It tests whether you can actually use the material instead of just recognize terminology.
Exam Format
When I took the exam, it was open book, open notes, and open internet. Obviously, check PortSwigger’s current rules before taking it because those can change. You have to complete both web applications, each of which has three vulnerabilities following the same Phase 1, 2, and 3 format. Only after getting 6/6 are you able to pass after two days of review to ensure you were not cheating, etc.
The basic progression of the exam is pretty straightforward:
- Phase 1 — Foothold: Get access to an account.
- Phase 2 — PrivEsc: Escalate your access or hijack an administrator account.
- Phase 3 — Data Exfil: Get to the backend and read the target file.
What is not straightforward is figuring out how you are supposed to get through each phase.
What I Noticed During the Exam
One thing I noticed is that when you move into a new phase, whatever you suddenly have access to matters. If you get access to a new part of the application, start seeing new requests in your HTTP history, or the scanner starts showing you something you could not see before, pay attention to it. In my experience, the scanner findings were very often related to the direction I needed to go. That does not mean blindly trust the scanner, but it effectively tells you what technique and endpoints you should be looking at.
Another thing I learned the hard way is not to get stuck trying to force an attack path just because you think it should work. There were situations where I thought, “Well, why wouldn’t I just target the administrator account with this technique?” This was in a password reset poison. Logically, it should. That does not mean it is the path the exam is giving you. So you have to learn specifically how to prepare for the exam format itself. Phase 1 always targets a low-level account.
If you have been hammering on the same idea for too long and getting nowhere, go back through the application and look at what changed. Also, check the endpoints you are targeting and make sure they are correct in spelling and capitalization. This had ruined one of my attempts where I believe I could have passed.
How Much I Studied
My preparation took about three months. The first two months were moderate studying. The last month was much more intense, and the final six days were basically nothing but studying, testing, and grinding through labs. PortSwigger recommends working through the non-expert labs in the Web Security Academy. There are around 240 of them, and I did all 240.
Were all of them absolutely necessary to pass? Probably not. Was doing all of them worth it? I think so. I spent a lot of my later study time going back through the areas where I knew I was weak instead of just repeating the things I was already comfortable with.
How I Organized My Notes
The biggest thing that helped me was how I organized my notes. I made folders for each topic and then broke the labs down by what was actually different about them. So for XSS, for example, I would have the main XSS section and then separate notes for different contexts, encoding issues, escaping quotes, and other variations. I numbered the labs so they went from simpler concepts into more complicated ones, and I kept a master cheatsheet for each topic.
When I solved a lab, I tried to write down more than just the final payload. I noted what functionality I should have noticed, what the scanner found, what request was actually important, what clue led me in the right direction, and why the payload worked. I also started putting quick identifiers and quick payload ideas at the top of the cheatsheet. The point was that if I saw something similar under exam pressure, I could recognize it quickly instead of rereading ten pages of notes.
I do recommend making your own cheatsheets instead of relying entirely on someone else’s, but either one is viable. You’ll probably benefit more in the long term from making your own.
Mystery Labs
Mystery labs were a huge part of my preparation. After I finished the roughly 240 regular labs, I probably did more than 60 mystery labs on top of that. Those ended up being some of the best practice because the normal labs tell you what category you are working on.
If the title tells you that you are dealing with XSS, half of the identification process has already been done for you. A mystery lab makes you look at the application first and figure out what is actually vulnerable. Toward the end, I was not just trying to solve mystery labs. I was trying to see how quickly I could identify what type of vulnerability I was looking at.
That felt much closer to the real skill being tested. In a real pentest, nobody hands you a page and says, “There is an XSS vulnerability here. Go find it.”
Practice Exams
I also treated both practice exams like real exams. I timed them, used the notes I planned on using during the actual exam, and tried to approach them seriously instead of casually working through them. Afterward, I reviewed what I missed and went back through the topics that slowed me down. I took the practice material more than once.
Where I Think PortSwigger Could Improve
There are a few areas where I think PortSwigger could improve the learning path.
Payload Construction
The biggest one for me is payload construction. There is a pretty large gap between learning something like <script>alert(1)</script> and being expected to create an XSS payload for a strange context with quotes, encoding, filters, JavaScript, or HTML attributes. If you do not already have much of a coding background, that jump can be rough.
PortSwigger is very good at teaching what a vulnerability is and showing you examples of how to exploit it, but I think there could be more material specifically about how to build a payload from scratch. Things like figuring out what context your input is in, what characters you control, what syntax you need to break out of, what the application is adding after your input, and what is being encoded.
That way of thinking becomes extremely important once you stop working on labs where the answer is obvious.
HTTP Request Smuggling
HTTP request smuggling was another area that stood out. It is a hard topic in general, and a lot of outside resources basically amount to, “This is difficult. Good luck.”
There is a decent amount of what I would call RNG involved when you are learning it because small differences in behavior can send you in completely different directions. I think a few more stepping-stone labs between the basic material and the harder request smuggling labs would help.
The Certification Roadmap
I also think the official certification preparation path could be clearer. On one part of the site, the recommendation is essentially to complete all of the non-expert labs. Then the certification dashboard gives you a smaller set of specific labs, mystery labs, and a practice exam. When you are first trying to figure out how much preparation is actually expected, it can be confusing.
If I were designing the path, I would make it more explicit: learn the topic, complete the normal labs, work through the harder variations, do mystery labs, take a practice exam, identify weak areas, then go back and drill those weak areas before taking the real exam. That is basically what I ended up doing anyway.
Resources I Used
Community Resources
A couple of community resources I found useful while preparing were:
PortSwigger Resources
Obviously, I would suggest taking a look at:
Make sure to check out the Dashboard page as well, so this can confuse you too in comparison to the “How to Prepare” page.
Burp Suite provides you with the cheatsheets you need as far as payloads for brute forcing and XSS, granted the XSS page I only used for checking what payloads were allowed by the application, as it had restrictions.
Other Tools and Wordlists
This is a directory bust payload list for the exam.
I also suggest being familiar with SQLmap.
Final Thoughts
Overall, I think the BSCP is a great certification. It is easily one of the certifications I am most proud of earning because I had to understand the material well enough to actually use it.
PortSwigger does an extremely good job explaining vulnerabilities in the Web Security Academy, and I especially like the diagrams and graphics they make for a lot of the topics. The techniques, the topics, and Burp Suite itself are industry standards for a reason.
More importantly, I came out of the process much more comfortable looking at an unfamiliar web application and trying to figure out what it was doing. That is more valuable to me than just adding another certification to a list.
If you are preparing for it, my biggest advice is pretty simple: do not just memorize payloads. Learn why they work. Practice figuring out what you are looking at before somebody tells you the vulnerability class. Make your own notes. Work the areas you suck at.
If you need two or more attempts before things start clicking, I would not feel bad about that. The exam is, at the time of writing this, $99 USD, and knowing what the real exam is like is definitely the best practice test you can get.
The certification is great, but the amount you can learn getting there is the part that really makes it worth doing.