My Personal Experience with the BSCP Exam
For me personally, the exam was easy — but only because I prepared really thoroughly. Interestingly, when I was about one-third through my preparation, a practice exam took me 2 hours and I managed to exploit only one vulnerability. As I mentioned earlier, on the actual exam, the first application took me just 14 minutes (14 minutes for 3 vulnerabilities vs. 2 hours for 1 vulnerability). So, as you can see, it wasn’t easy, but the hard work paid off. If I passed on my first try, you can too! Good luck and enjoy the read!
In this article I will present tips and how I prepared. You can see my certificate here: Burp Suite Certification — PortSwigger
It took me only a month and a half to prepare, but I must point out that before I started preparing I had already completed 90% of the labs needed for the exam. During that time, I spent several hours each day (sometimes even more) studying.
Highlights of the exam: You have 2 applications, each containing 3 security flaws. To pass, you must successfully exploit all 3 issues in both applications — that means exploiting 6 in total. Partial completion isn’t enough: missing even one will result in failure. You have 4 hours to finish the entire exam.
Stage 1: Get access to any user, mostly it will be carlos (or always, that’s likely too)
Stage 2: Get access to the administrator account
Stage 3: Access the /home/carlos/secret file, as far as I know, the vulnerability related to accessing this file is always in the admin panel.
Let me move on to the most important — how to prepare?
First, complete all the labs from the APPRENTICE and PRACTITIONER levels. Labs from the Expert level do not appear on the exam. I highly recommend taking detailed notes — personally, I completed the labs twice during my preparation, this time making thorough notes to reinforce my understanding.
There are less important classes of vulnerabilities that, as far as I know, do not appear on the exam:
Web Sockets, Clickjacking, GraphQL, LLM, NoSQL, Web Cache Deception
These vulnerabilities most likely do not occur on the exam, although I recommend completing these labs anyway — this may change in the future, or some of these vulnerabilities do occur, and I just don’t have the knowledge.
Here is a list of the most important labs — these are the ones you should focus on the most, but I still recommend doing ALL labs. If I’ve shared a link to an entire topic, you should make sure to focus on all the vulnerabilities covered within it.
All labs | Web Security Academy — Web Cache Poisoning
All labs | Web Security Academy — Authentication
Lab: CSRF where token validation depends on token being present | Web Security Academy
Lab: CSRF where Referer validation depends on header being present | Web Security Academy
Lab: Exploiting Java deserialization with Apache Commons | Web Security Academy
All labs | Web Security Academy — It’s best to complete all the labs using SQLmap — just learn how to use SQLmap and basic WAF bypass techniques, for example, the
--random-agentoption.
Lab: CORS vulnerability with trusted insecure protocols | Web Security Academy
Lab: Exploiting HTTP request smuggling to capture other users’ requests | Web Security Academy
Lab: Exploiting HTTP request smuggling to deliver reflected XSS | Web Security Academy
Lab: DOM XSS using web messages and JSON.parse | Web Security Academy
Lab: Reflected XSS into HTML context with most tags and attributes blocked | Web Security Academy
Lab: Blind OS command injection with out-of-band data exfiltration | Web Security Academy
Lab: Basic server-side template injection (code context) | Web Security Academy
Lab: User role can be modified in user profile | Web Security Academy
Tips:
Most importantly: complete as many mystery labs as you can. I personally completed exactly 1,000 — yes, one thousand, not one hundred — which probably helped me finish the entire exam in just one hour, and the first application in only 14 minutes. When working on mystery labs, don’t be afraid to use the scanner — on the contrary, use it to learn how it works.
If you’re having trouble with the initial Mystery Labs, don’t be afraid to use hints (but not the full solution). There’s nothing wrong with that, as hints only tell you what you need to do — for example, delete the
morale.txtfile — but they don’t tell you which vulnerability to use to do it.
It’s also similar to the exam, because in both cases the objective is clearly defined.
Focus on the 3 most difficult topics: XSS, DOM-based vulnerabilities, and request smuggling. These are the ones most likely to give you the most trouble.
Remember that the BSCP exam is an open book exam — you can use any resources you like, as long as you don’t get help from other people.
Learn how to use Burp Suite Pro scanner. Be sure to use it in conjunction with ActiveScan++ — the latter handles some vulnerabilities better, particularly Host Header and Web Cache Poisoning attacks. Personally, I only found one vulnerability using a scanner during the exam, but it was still very useful. It can easily detect issues like web cache poisoning, HTTP request smuggling, OS command injection, XSS, path traversal, CSRF, CORS, XXE, and host header vulnerabilities. The scanner also often detects suspicious headers such as
X-Forwarded-Host,X-Forwarded-For, etc.
Complete both practice exams and review the XSS Cheat Sheet from PortSwigger. Practical exams are a great way to learn how to effectively bypass WAFs when dealing with XSS — and they also give you a solid understanding of the exam structure.
The Java Deserialization Scanner extension allows the standard Burp Suite scanner to detect deserialization-related vulnerabilities as well.
Learn to use tools like sqlmap (along with basic WAF bypass techniques such as the
--random-agentparameter), PHPGGC, ysoserial, Smuggler, and www.jdoodle.com/execute-ruby-online.
Install these Burp Suite extensions and get familiar with them: ActiveScan++, HTTP Request Smuggler, Hackvertor, Deserialization Scanner, Param Miner, JWT Editor, Flow, and XSS Cheat Sheet.
If you’re having trouble with the practice exam, watch these videos: https://www.youtube.com/watch?v=yC0F05oggTE and https://www.youtube.com/watch?v=Cyv3dEQcxM8&t
Right after starting the exam, run the Burp Suite scanner on the GET / request. If HTTP request smuggling or web cache poisoning vulnerabilities are present there, they will be detected. Also, immediately run a Target scan on the search term parameter to detect XSS.
Right after starting the exam, check the application’s source code for DOM-based vulnerabilities.
Look out for suspicious signs that may indicate vulnerabilities. Outdated Angular? Probably XSS. JWT tokens? Likely a JWT attack. The page loads an image? Possibly path traversal, and so on.
If you’re having trouble with request smuggling (which you definitely will), I recommend this YouTube series: https://www.youtube.com/watch?v=4S5fkKJ4SM4&list=PLGb2cDlBWRUX1_7RAIjRkZDYgAB3VbUSw
Learn how to exfiltrate data using Collaborator. For example, when doing a standard SSTI lab, put in extra effort and craft a payload that exfiltrates
/etc/passwdto your Collaborator server. This will be necessary in Stage 3 of the exam.
Useful resources: https://github.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study and https://github.com/DingyShark/BurpSuiteCertifiedPractitioner. I especially recommend the second one.
Learn how to exploit RFI and LFI. PortSwigger Academy doesn’t cover this, but it will be useful.
If you encounter XSS, one way to bypass the WAF might be using compiled payloads. Focus on learning this technique.
Write your short plan for the exam — for example:
1. Run the scanner on
GET /
2. Check the source code for DOM-based vulnerabilities
3. Run the scanner on
searchTerm
etc.
This will be helpful, trust me. But don’t rely on this cheat sheet 100% — other vulnerabilities might also appear.
If you encounter SSRF, the flag will be here: http://localhost:6566/
Additional tips
If you don’t have Burp Suite Pro, you can request a 30-day trial from PortSwigger.
Remember to save your project and upload it to PortSwigger website after finishing the exam.
Conclusion
I hope this article helps you. I shared everything I could to help you pass the exam. The exam itself and the preparation for it were genuinely enjoyable. It’s one of those rare certifications where you actually learn practical, real-world skills. Stay consistent, practice a lot — especially with mystery labs — and don’t get discouraged if something doesn’t work right away. Good luck, and enjoy the journey!
If you’d like to connect or have any questions, feel free to add me on LinkedIn: https://www.linkedin.com/in/karolczubernat/