The Burp Suite Certified Practitioner (BSCP) is a four-hour, hands-on exam from PortSwigger, and most of the work that decides the result happens in the preparation steps before you buy it. This guide sets out what PortSwigger publishes about the BSCP: who it is for, how the two-application exam is structured, the Burp Suite Professional requirement, the four preparation steps, the proctoring and system rules, purchase terms, validity and where the credential fits in a web security career. It is written for penetration testers, application security engineers and the managers who fund their training. Exam facts were checked on PortSwigger's own certification pages in November 2026; prices and rules change, so confirm them with PortSwigger before you book.
This is an independent guide from NHI Mgmt Group, based on PortSwigger's public certification documentation as of November 2026. It is not sponsored or reviewed by PortSwigger. Exam details change, so confirm them against PortSwigger's current documentation.
Key takeaways
- Two applications, three stages each, four hours. In each application you gain access to a user account, then the admin interface, then read a secret file from the server and submit it.
- Exploitation, not identification. PortSwigger is clear that finding a vulnerability is not enough: a cross-site scripting finding has to steal a simulated user's session and a SQL injection has to yield credentials you then use.
- Burp Suite Professional is required. You need an active Professional licence at exam time, Community Edition cannot be used, and you must keep a Burp project file that PortSwigger may ask for up to a week later.
- Preparation is structured and free to repeat. The experienced path is four steps: a list of Web Security Academy labs, eight named labs, five mystery labs and a passed practice exam.
- The certification lasts five years. PortSwigger states validity of five years from when it is acquired, with start and end dates on a verifiable digital certificate.
Who the certification is for
PortSwigger describes the BSCP as an official certification from the makers of Burp Suite that demonstrates knowledge of web security vulnerabilities, the mindset to exploit them and skill with Burp Suite. It names penetration testers and the organisations that employ them as the main audience.
- Web application penetration testers: the exam mirrors a time-boxed assessment in which you must chain findings to reach a clear objective. See the Penetration Tester Career Guide for the wider route.
- Application security engineers: the preparation labs give a working feel for how injection, authentication and request smuggling flaws are actually exploited, which makes code review and threat modelling sharper. The Application Security Engineer Career Guide shows where that fits.
- Bug bounty hunters: people already testing web targets under programme rules can use the BSCP to show a verifiable, tool-specific skill. See the Bug Bounty Hunter Career guide.
- Testing managers and buyers: the certificate carries a unique code that employers can validate online, which helps when checking the skills of a testing team.
- Earlier-career learners: PortSwigger publishes a separate, longer learner path that works through every apprentice and practitioner lab first, so newcomers have a clear way in.
Everything the Web Security Academy and the exam teach is for use in the PortSwigger labs or on systems where you hold written permission from the owner. The Penetration Testing Guide covers how authorised engagements are scoped.
Exam format and domains
What PortSwigger publishes about the exam
| Item | What PortSwigger states | Source page |
|---|---|---|
| Duration | Four hours; the timer cannot be paused or reset once started | How it works; FAQs |
| Structure | Two applications, each with deliberate vulnerabilities and three stages | How it works |
| Stage 1 | Access any user account | How it works |
| Stage 2 | Access the admin interface at /admin, by escalating privileges or compromising the administrator account | Exam hints and guidance |
| Stage 3 | Read /home/carlos/secret from the server and submit it with "submit solution" | How it works |
| Outbound traffic | Restricted to the public Burp Collaborator server and the integrated exploit server | Exam hints and guidance |
| Tooling | Active Burp Suite Professional licence; full exam recorded in a Burp project file, which may be requested up to a week afterwards | How it works; FAQs |
| Proctoring | Automated proctoring with a government-issued photo ID; you cannot pass until the ID is verified | How it works |
| Language | English | How it works |
| Results | By email, with a certificate link on a pass and re-booking resources on a fail; check your account if nothing arrives within 3 to 5 working days | How it works |
| Conduct | Work alone and do not share exam addresses; cheating results in a permanent ban | How it works |
What the exam covers
PortSwigger does not publish a weighted domain list. The scope is the practitioner-level content of the Web Security Academy, and the exam hints page names specific areas to be ready for. The table groups those areas and links the NHI Mgmt Group defensive guide for each, so the knowledge carries over into fixing what you find.
| Area named by PortSwigger | Where it appears | Defensive counterpart |
|---|---|---|
| Cross-site scripting, with vectors that work in Chrome (the simulated victim uses Chromium) | Exam hints; preparation lab "Exploiting cross-site scripting to steal cookies" | Cross-Site Scripting (XSS) Prevention Guide |
| SQL injection, including blind and out-of-band variants and filter bypass through XML encoding | Exam hints; two preparation labs | SQL Injection Prevention Guide |
| HTTP request smuggling | Exam hints; preparation lab on capturing other users' requests | HTTP Request Smuggling Guide |
| Insecure deserialisation | Exam hints | Insecure Deserialisation Guide |
| Server-side request forgery | Preparation lab "SSRF with blacklist-based input filter" | SSRF Prevention Guide |
| OAuth and authentication flaws | Preparation labs "Forced OAuth profile linking" and "Brute-forcing a stay-logged-in cookie" | OAuth 2.0 Security Best Current Practice (RFC 9700) Guide |
| Obfuscating attacks with encodings and targeted scanning | Exam hints; preparation lab "Discovering vulnerabilities quickly with targeted scanning" | Web Application Firewall Guide |
Two points from the hints page shape how candidates should think about the exam. First, vulnerable pages and files are not hidden, so you should never need to guess folders, filenames or parameter names. Second, a full application scan is not feasible in four hours: PortSwigger recommends scanning selected requests and insertion points with Burp Scanner, especially when you are stuck. Stages should be worked in order, because attacks on the admin interface usually depend on the access gained in stage 1.
Prerequisites and experience
There is no experience verification, endorsement or application. The practical gates are a PortSwigger account, a Burp Suite Professional licence and the preparation PortSwigger asks you to complete before buying an exam.
- Account: the name on your PortSwigger account is the name printed on the certificate, so check it before you book.
- Licence: a valid, active Burp Suite Professional licence at the time of the exam. Community Edition cannot be used.
- Skills PortSwigger lists for the practice exam: solving Practitioner-level and easier Academy labs without the solutions, performing the XSS exploits in the Academy's XSS topic, attempting mystery labs, using Burp Professional's manual tools and Burp Scanner confidently, and performing out-of-band attacks and encoding-based obfuscation.
- System requirements: a desktop or laptop with webcam and microphone (tablets and mobile devices are not supported), macOS, Windows, Linux or ChromeOS, the latest Google Chrome with the pop-up blocker turned off, and at least 2 Mbps upload and download. PortSwigger advises against mobile hotspots.
- Identity check: an approved photo ID, checked against your face in real time before the exam starts. Start proctoring in a browser that is not set to use Burp Proxy.
- Third-party extensions: some Practitioner labs use ysoserial and the HTTP Request Smuggler extension, so be comfortable with both; PortSwigger advises caution with other tools that may not suit the objective.
Preparation plan
PortSwigger's "How to prepare" page offers two routes. The learner route works through every apprentice and practitioner lab topic by topic, adds mystery labs per topic and then across all topics, takes a practice exam and finishes with the hints page. The experienced route is the four steps below, and PortSwigger places no limit on how many times you repeat them.
| Step | What PortSwigger asks | How to tell you are ready |
|---|---|---|
| 1. Lab list | Work through every lab on the linked list in turn, without needing the solutions | You can solve each lab cold and explain why the exploit works |
| 2. Eight core labs | XSS cookie theft, blind SQL injection with out-of-band exfiltration, forced OAuth profile linking, brute-forcing a stay-logged-in cookie, request smuggling to capture requests, SSRF with a blacklist filter, SQL injection with XML encoding bypass, targeted scanning | Each lab solved in well under the time you would allow for one exam stage |
| 3. Mystery labs | Five randomised practitioner-level mystery labs with no context | You identify the vulnerability class from behaviour, not from the lab title |
| 4. Practice exam | Read the hints, then take and pass the two-hour practice exam with one vulnerable application; it can be restarted as often as you like | A clean pass of all three stages inside the time limit |
A six to ten week study rhythm
- Weeks 1 to 3, coverage: complete the step 1 lab list. Keep notes per topic in the same structure: how you detected it, how you confirmed it, how you exploited it, and which stage of the exam it could serve.
- Weeks 4 to 5, depth: complete the eight core labs, then repeat the ones that took longest. Practise with Burp Collaborator for out-of-band work and the integrated exploit server for victim-side attacks.
- Week 6, speed: run mystery labs in sets of five against a timer. Practise targeted scanning of single requests and insertion points instead of full crawls.
- Week 7, simulation: take the practice exam under exam conditions: one sitting, Burp project file on, no solutions, notes only.
- Weeks 8 to 10, gaps and booking: revisit weak topics, rerun the practice exam until the pass is routine, run the system check, then book. PortSwigger asks for at least 24 hours' notice in its terms.
Measuring progress
- Cold solve rate: share of practitioner labs solved without hints; aim for all of the step 1 list.
- Median time per mystery lab: track it per set; the trend matters more than any single result.
- Stage time on the practice exam: time to stage 1, 2 and 3, so you know where your four hours will go.
- Topic coverage: number of Academy topics in which you have solved at least one practitioner lab, which is what the experienced route asks for.
Common failure patterns
- Stopping at proof of concept: an alert box is not a pass. Practise turning each finding into session theft, credential extraction or file read.
- Scanning everything: full scans burn time. Scan the requests that matter and read the results carefully.
- Working out of order: attacking /admin before you hold a user account usually wastes effort.
- Copying lab payloads unchanged: exam applications differ from the labs. Compare the traffic in Burp, list your assumptions and test each one.
- Testing victim attacks blind: try victim-targeted attacks in your own browser first and inspect the HTTP sequence before delivering them.
- Losing the project file: keep the Burp project file for the whole exam and store it safely afterwards in case PortSwigger asks for it.
Cost, renewal and continuing education
| Item | What PortSwigger states | Source page |
|---|---|---|
| Exam price | Priced in US dollars, pounds sterling and euros on the purchase page; prices exclude VAT unless stated | FAQs; Terms and conditions 7.1 |
| Burp Suite Professional | A separate licence, required at exam time; the product page showed $499 at the time of checking | FAQs; Burp Suite Professional page |
| Exams on account | One active exam at a time, so one purchase at a time | FAQs |
| Redemption | The terms say each purchase must be redeemed within one year; the FAQ page says the purchase does not expire. Plan to sit within a year and check the current terms | Terms and conditions 7.1.5; FAQs |
| Cancellation | Consumers may cancel by email within 14 days of purchase; no refund once the exam has been taken | Terms and conditions 7.2.3 |
| Retakes | Buy another exam and begin the process again | FAQs |
| Validity | Five years from when the certification is acquired; dates shown on the certificate | Certification overview |
PortSwigger's pages checked for this guide do not describe a renewal or continuing education scheme. Because validity is a fixed five years, plan to keep current through the Web Security Academy, where PortSwigger adds new topics and labs as research develops, and confirm the route to recertify with PortSwigger as your end date approaches. If you hold credentials that do run continuing education schemes, the BSCP preparation and Academy lab work is often worth recording against them; see the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
- Specialist depth for web testers: the BSCP is focused on web applications and on Burp Suite, which makes it a clear signal for roles where most engagements are web and API testing. The Burp Suite for Authorised Web Testing Guide covers the tool itself in day-to-day work.
- A bridge for developers: developers moving into application security gain an attacker's view of the flaws they already know how to code against.
- Evidence for consultancies: the verifiable certificate helps firms show clients the skills of named testers.
- A step on a broader plan: pair it with infrastructure, cloud or code review skills depending on your target role. The Cybersecurity Certifications Guide maps the wider landscape.
- Identity relevance: stages 1 and 2 are, in practice, authentication and authorisation tests: session handling, OAuth linking, privilege escalation to an admin role. That knowledge transfers directly to reviewing how applications handle user and machine credentials.
Practitioner checklist
- Confirm your PortSwigger account name matches your photo ID and how you want the certificate to read.
- Secure an active Burp Suite Professional licence covering your exam date.
- Complete the step 1 lab list without solutions, then the eight core labs.
- Solve at least five mystery labs from cold, timed.
- Pass the two-hour practice exam under exam conditions, more than once.
- Read the exam hints and guidance page in full the week before you sit.
- Run the system check: Chrome current, pop-up blocker off, webcam, microphone, stable 2 Mbps connection, proctoring browser not proxied.
- Read the current terms for redemption, cancellation and booking notice before paying.
- Record the five-year end date and set a reminder a year before it.
Standards and references
- PortSwigger: Burp Suite Certified Practitioner certification overview
- PortSwigger: BSCP how it works
- PortSwigger: BSCP how to prepare
- PortSwigger: BSCP exam hints and guidance
- PortSwigger: BSCP practice exam
- PortSwigger: BSCP frequently asked questions
- PortSwigger: Certification terms and conditions
- PortSwigger: Burp Suite Professional
Related NHI Mgmt Group resources: Burp Suite for Authorised Web Testing Guide · Penetration Tester Career Guide · Application Security Engineer Career Guide · Cybersecurity Certifications Guide · Penetration Testing Guide