Prerequisites:#

  1. Be unemployed
  2. Play CTFs and main web challenges for 1+ years
  3. Have 99 USD on hand
  4. Get your hands on Burp Pro

How to meet prerequisites#

  1. Pretty easy to do. Some options include: quitting your job, getting laid off, or never being employed in the first place
  2. Go to https://ctftime.org/event/list/upcoming, maybe join a team or go solo and play one or more of these every week
  3. Can be done in a plethora of ways, preferably legally
  4. Mandatorily legally

BSCP what?#

The Burp Suite Certified Practitioner exam involves two targets, and each target has three stages, with each stage requiring you to find and exploit a web vulnerability. The first stage is to get into a normal user account, the second stage is to get into an administrator account, and the third and final stage is to exploit a vulnerability to read /home/carlos/secret. I gave myself a month to get through the material and pass it.

The plan is simple#

This summer, I knew I wanted to get a cert, and I decided on the BSCP because I wanted more web experience that wasn’t just super niche techniques and attacks that show up in CTFs. So, on August 6, 2026, I started going through the BSCP labs.

The plan was:

  1. For topics that I knew, speedrun as many labs as possible and read through the material if I got stuck
  2. For topics that I didn’t know, thoroughly learn all the material, attempt the labs, and write quick notes consisting of identification, exploitation, and a working payload
  3. Research and find the best way to prep for the exam

Weeks 1-2: speedrun#

I worked through the content as if it were a full-time job, spending 8+ hours on days I didn’t have anything else to do. I started with the topics I already knew, then went fully topic by topic. A lot of the content I could speed through from my prior experience, going from 0% -> 67% completion in about 2 weeks.

Week 3: slowrun#

The third week I spent learning about topics I didn’t know much about, such as HTTP request smuggling, WebSockets, OAuth, and cache poisoning. To really keep this info in my head, I dug deep into what was going on behind the scenes of each vulnerability. After each lab, I would write down a quick note about how I identified the vulnerability, how I exploited it, along with a working payload. Here is an example of one I wrote for forced OAuth profile linking:

Detail to notice: no `state` parameter to prevent csrf in `/oauth-linking` request


What allows: We can make our victim link our social media account to their account and then login to their account with our social media account


Solved by linking account -> intercept requests -> send `/auth` request through -> copy the `/oauth-linking` request so that the code isn't used and send it to admin so that they complete the request for us -> login with our social media and delete carlos

After going through all of that, I got to the point where I had all the Apprentice and Practitioner labs completed.

portswigger level progress

Week 4: building confidence#

Here, I researched other people’s experiences, mostly through blogs or Reddit posts, and how they messed up or succeeded. A lot of the time, I found that these were the main causes of failure:

  • Rabbit-holing: spending too long forcing one idea instead of pivoting.
  • Finding the vuln but not finishing the exploit: even if you find the vuln, you have to know how to exploit it to get to the next stage.
  • Memorizing labs instead of understanding them: exam scenarios often require adapting known techniques and bypassing filters.
  • Weak discovery: normal labs tell you the topic, while the exam does not, which can give you a false sense of confidence in your recon and vulnerability discovery skills.
  • Misusing Burp Scanner: either relying on it too much or not using targeted scans enough.
  • Missing functionality: overlooking an endpoint, parameter, cookie, or feature can waste huge amounts of time. This could also be caused by having too strict of a filter for your traffic, maybe causing you to miss important JS files for something like XSS.
  • Poor time management: stress and tunnel vision caused otherwise capable people to run out of time.
  • Forgetting OAST/Collaborator: an error response does not necessarily mean an out-of-band payload failed.
  • Bad exam setup: mixing up the two apps, using a temporary Burp project, or changing environments caused avoidable problems.

There is also a niche cause of failure that PortSwigger warns you about: accidentally deleting your own account or doing something destructive to the instance with the functionality you find. So yeah, don’t rm -rf / if you find command injection.

THE method#

At this point, I figured the way to get over these pitfalls was to spam mystery labs to get my recon time down and blind exploitation skills up. I went through enough mystery labs to the point where I could complete at least 10 mystery labs in an hour.

My process was basically using all the pattern recognition I had built up to test things. For example, if there was a search feature, it usually meant XSS or SQLi, so I would immediately go to the request, highlight the proper parameter, click Scan selected insertion point, and scan for XSS and SQLi. During the scan, I would check out other features on the site and make sure I didn’t miss anything. If I suspected anything there, I would use a similar process of scanning or testing whatever I had a hunch about.

Once something weird showed up in a response or the scanner came up with something, it was go time to see if I could get an exploit working quickly. I would only keep a mental note of what I checked and what I didn’t. Sometimes it was actually useful to forget, go back to a feature later, and find something new instead of writing it off as a complete dead end.

Also, once you’ve done this, make sure to complete BOTH practice exams that PortSwigger provides. They are very similar to the exam environment, and at this point you should be able to do them blind. These exams are also the same each time, so don’t look up the answer and waste your opportunity to gauge your skills.

exam preparation steps

Even though I got to this point, I still didn’t feel fully prepared.

Burp setup and useful resources#

Extensions#

Extensions can save a lot of time in Burp Pro. The ones I had installed at the start of my exam were:

  1. Param Miner
  2. Java Deserialization Scanner
  3. CO2
  4. JWT Editor

Resources#

During my prep, I did more research and found some extremely helpful resources to have open during the exam:

But don’t forget PortSwigger resources as well, such as the XSS cheat sheet.

These resources were mainly useful because they show which types of vulns may show up at each stage of the exam, and they have quick payloads to use in case you don’t exactly remember one. Most of the time, you’ll be able to write the exploit yourself or adapt the scanner result.

The XSS cheat sheet was useful as well in case you ever need to bypass a filter.

How to not go broke#

Burp Pro is normally 499 USD, which may be quite a hefty sum for some. One thing you can do so that you only pay the exam fee of 99 USD is get a 30-day free trial of Burp Pro instead. “But how do I learn the content without Burp Pro?” you may ask. Well, you can actually learn all the content for free and complete most of the labs with the Community Edition or by writing your own Python exploit scripts, which I did for the blind SQLi labs. IIRC, the only labs that you can’t complete are the OAST ones, which require Burp Collaborator if you don’t have access to an exploit server.

Once you do get your Burp Pro trial or subscription, make sure you learn how to use the scanner effectively. Targeted scanning and the Scan selected insertion point feature are a massive part of how quickly you can identify and exploit vulnerabilities. Along with that, learn how to use Intruder properly instead of sending everything to Repeater, especially for stuff like SQLi, fuzzing, or brute forcing. I also recommend that once you complete a lab, look at the official solution so that you can see how to use Burp Suite in the intended way. This helps you learn the tool while you don’t have all the Pro features.

AI usage verdict as of 09-07-2026#

This section exists because I couldn’t find anything online about what PortSwigger considered acceptable AI usage during the exam. Since Burp Pro itself includes Burp AI, which can send requests and interact with targets, I wanted to know where they drew the line before using it. Hopefully this helps someone else out there looking for the same answer.

I’m a very meticulous guy, so I still wanted clarification on what counted as cheating or not, especially in this age of LLMs.

So, I emailed PortSwigger about AI usage, and this is the response I got:

email

I emailed after work hours on a Friday, so I wouldn’t get a response until next week.

Fuck it we ball#

Turns out I’m also a very eager typa guy and after all this prep, I could NOT wait until Monday to get a response from support, so I purchased an exam voucher and decided to take it then and there. So I didn’t really end up using AI.

I made sure to pre-load all my Burp extensions and create a non-temporary project. I opened the proctoring site, where you have to upload identification and share your screen(s), microphone, and camera.

Before clicking the button to launch the exam instance, my heart was racing, but once I opened the target in Burp, I was locked in. I cannot disclose what vulnerabilities were on the exam, but trust me when I say my pattern recognition kicked in. I immediately found the vulnerability, passed the first stage, then the second, then the third. I completed the first target in an hour.

I then moved on to the second target, which took me a bit longer in the second stage because of some functionality I initially missed but later found. All said and done, I ended up finishing the whole exam in 3 of the 4 hours allotted.

Since I completed this on Friday after work hours, I had to wait until Monday for my result, and this is what I received on said Monday:

passed email

I passed!

Cert: https://portswigger.net/web-security/e/c/bcf87f2c9e6545e9

If I did it again (green splits)#

I would say the most impactful practice was first completing all the Apprentice and Practitioner labs, then spamming the mystery labs, and finally solving the practice exams blind.

As for what I would do differently, I would JUST START. I wasted a decent amount of time trying to figure out the perfect way to prepare before I had even really started. That alone was probably a few days of free time save.

Also, most of the process I ended up with came from noticing inefficiencies in how I worked, as well as researching issues that other people had. For example, in the first week, I was taking really long notes on stuff I already knew, which had me bored out of my mind. Eventually I switched to writing much quicker notes as I went through each lab. They basically followed: why -> identify -> exploit, which was way more useful. If I had started earlier, I probably would’ve found even more inefficiencies and time saves along the way.

I wouldn’t try to speedrun everything though. The reason this worked was because I only sped through the stuff I already knew. When I got to topics I didn’t know much about, I slowed down and actually learned what was going on.

If I ran this route again, I think I could probably get a sub 4 week PB:

Week 1: spam the stuff I already know

Week 2: learn the stuff I don’t know

Week 3: spam mystery labs -> practice exams blind -> full send

So basically:

known stuff -> new stuff -> spam mystery labs

Also, being unemployed definitely helps 😊

Thanks for reading!