The Burp Suite Certified Practitioner (BSCP) is PortSwigger's hands-on web security certification, and it's one of the few certs I point people to without qualification. There's no multiple choice, no memorized acronym soup — you sit down with Burp Suite and exploit real, deliberately vulnerable web applications under a time limit. I hold it, everyone on our testing team is encouraged to get it, and this is the prep advice I give them.

Why the BSCP is worth it

Most security certifications tell an employer you studied. The BSCP tells them you can actually break a web application. The whole certification path — the free Web Security Academy curriculum plus the practical exam — is built by the people who make Burp Suite, and it shows: the material is the same vulnerability classes we exploit on real web application penetration tests, taught against working labs instead of slides.

It's also cheap as certifications go, and the Academy itself is free. If you do the work, the exam fee is nearly the whole cost of the credential.

What the exam actually is

The exam is a timed, proctored, fully practical test. You get two web applications and a few hours. Each application is a staged scenario: enumerate and find an entry point, exploit it to gain a foothold, escalate — typically to an admin-level account — and finish by exfiltrating something that proves you got there, usually via SQL injection. Points accumulate per stage; you need most of them to pass.

Two properties define the experience:

  • It's a time trial. The vulnerability classes are the ones from the Academy. The difficulty isn't knowing the technique — it's executing it fast, without going down rabbit holes, twice in a row.
  • The stages build on each other. If you can't find the foothold, there is no partial credit to collect elsewhere on that application. Getting unstuck quickly is a skill, and it's trainable.

Do every lab. All of them.

This is the whole preparation strategy, and it's non-negotiable: work through every exercise in the Web Security Academy. There are well over a hundred of them across the topic areas — SQL injection, XSS, CSRF, SSRF, XXE, command injection, path traversal, access control, authentication, business logic, and the rest. Do all of them, including the ones in categories you think you already know.

Three rules for getting real value out of the labs:

  1. Solve before you read. Struggle with each lab before opening the community solution. The exam doesn't have a hint button, and the struggle is where the learning happens.
  2. Understand, don't pattern-match. When you solve a lab, be able to explain why the payload worked. The exam applications are variations, not copies — recognition of shapes transfers, memorized payloads don't.
  3. Keep a notebook. For every topic, write down the tell (what made you suspect the bug class), the probe (the minimal payload that confirms it), and the exploit (how you turn confirmation into impact). That notebook is what you'll actually use in the exam.

The labs I see candidates skip are the ones that cost them: the "boring" topics like HTTP request smuggling prerequisites and access-control edge cases show up constantly as the foothold stage. Do those too.

Use the cheat sheets

The exam is open-book in the ways that matter, and nobody is watching how many browser tabs you have. Build your reference stack before exam day:

  • PortSwigger's SQL injection cheat sheet — the per-database syntax reference you'll want open during the exfiltration stage. Knowing that you need it, and where it is, saves real minutes.
  • PortSwigger's XSS cheat sheet — contexts, tags and event handlers for when the foothold is client-side.
  • The XXE topic page and the other Academy topic references — each topic page is effectively a condensed cheat sheet with the payloads inline.
  • Your own notes from the labs (see above). Organized by bug class, ordered "tell → probe → exploit". This is the highest-value tab you can have open.

The goal isn't to avoid memorizing things out of laziness — it's that under time pressure, nobody reliably remembers whether this database wants ::int or CAST(). The people who pass are the ones who can look things up in thirty seconds and move on.

Exam day tactics

  • Recon both applications first. Spend the first twenty minutes mapping both targets — pages, parameters, forms, anything that reflects input or touches a database — before committing to an exploit path on either.
  • Timebox your rabbit holes. If a stage hasn't moved in thirty minutes, write down what you've tried, go work the other application, and come back. Stuck is a state, not a verdict.
  • Chain deliberately. The staged design means every finding is a step, not a destination. A reflected XSS you can't weaponize further is probably not the intended path — keep enumerating.
  • Don't fight Burp. Do your lab work in the same Burp setup you'll test in. Repeater muscle memory is worth more than any single payload.

You will probably fail the first time

Say this out loud before you book: you will probably fail your first attempt, and that's okay. Almost everyone does, including people who are genuinely good at this work. The time pressure is real, one stubborn foothold can eat an hour, and nothing in the labs quite replicates the clock.

Here's the reframe: the first attempt is the best practice exam money can buy. You now know exactly what the environment feels like, where the time went, and which topic let you down. That's a study plan handed to you. Go back to the Academy, redo the labs in your weak areas until they're boring, tighten your cheat sheets, and book the retake. The pass rate on second attempts is dramatically better than on firsts, precisely because failing is diagnostic.

The only real failure mode is letting a failed attempt talk you out of finishing. Keep trying. The cert is absolutely achievable — it's a skills test, and skills respond to practice.

Key takeaways

  • The BSCP is a timed, hands-on exam: exploit two vulnerable applications end to end. No multiple choice, no memorization shortcuts.
  • Preparation is simple and absolute: do every Web Security Academy lab — all 100+ of them — solving before reading, keeping notes by bug class.
  • Build your cheat-sheet stack before exam day: PortSwigger's SQLi and XSS cheat sheets, the topic references, and your own lab notebook.
  • Timebox rabbit holes and recon both applications before committing to an exploit path.
  • Expect to fail the first attempt, treat it as diagnostics, and go again. Keep trying — it works.