BSCP guide: preparing for the Burp Suite practical exam
BSCP is a four-hour practical web security exam. Learn the two-application structure, required Academy labs and a Burp Suite Professional workflow.
- AUTHOR
- Karol Rapacz / CEO of Breachroad · OSCP · PNPT
- PUBLISHED
- 18 June 2026
- READING TIME
- 9 min read
- TOPIC
- Careers and Certifications
BSCP — Burp Suite Certified Practitioner is PortSwigger’s practical web-security exam. The current format gives four hours and two vulnerable applications. Each requires three stages: access any account, reach administration and read /home/carlos/secret.
Required level
PortSwigger recommends completing every Web Security Academy lab at Practitioner level or below without solutions and strong familiarity with XSS. An active Burp Suite Professional subscription is required.
There are no clues naming the vulnerability category. Mix access control, authentication, SSRF, deserialization, request smuggling, race conditions, XSS, SQLi and business logic during preparation.
Four-hour workflow
Use early minutes for functions and roles. Work through target map, proxy history, Repeater and Comparer. Re-test objects and functions after every new privilege context.
Keep minimal notes: endpoint, parameter, hypothesis and result. A full report is not required, but the Burp project file must be retained and may be requested for analysis.
Readiness
Repeat the practice exam and complete Practitioner labs without solutions. Recognise response differences quickly, chain weaknesses and maintain time control.
BSCP is narrower than OSWA but tests Burp fluency intensely. The current PortSwigger page states a five-year certificate validity.
Exam structure and priorities
PortSwigger states that the four-hour exam contains two applications. Each has three stages: gain access as a regular user, become an administrator, and finally read the designated secret from /home/carlos/secret. The format requires a complete chain rather than one isolated vulnerability.
Map authentication, roles, objects and administrative functions quickly. Record which behaviours could lead to the first stage and which require an authenticated session. If a hypothesis yields no measurable signal after a few controlled attempts, mark it and move on instead of spending the entire window on one parameter.
Burp Suite as an organised workspace
Filter Proxy history by host, method, status and file type. Use Repeater for comparison: retain a baseline, change one element and record the observation. Intruder helps with narrow, purposeful tests, but request volume cannot replace an application model. The Burp project must preserve the complete workflow because PortSwigger may request it for review.
Before the exam, verify the Burp Suite Professional licence, application version, project saving and proctoring requirements. Do not update the environment or add untested extensions during the session. Every extension increases failure surface and may modify requests.
Practice and time control
Complete topic-focused Practitioner labs first, then mix categories and solve them without hints. Finish with the full practice exam under time constraints. After every attempt, record the signal that should have identified the correct vulnerability class and the steps that produced no information.
Readiness means working across two applications, preserving useful sessions, reversing a bad change quickly and tracking all three stages. Payload familiarity is not enough: you must understand data flow and the implications of each server response.
Stage completion checklist
Confirm that you are using the correct application and expected user context, and that the effect survives another request. Save the smallest request and response proving the cause, not dozens of nearly identical attempts. When a stage requires administrative access, verify an actual privilege rather than relying on a cookie name or interface message.
Name Repeater tabs by application and hypothesis. Keep an unchanged baseline and duplicate it for experiments. Across two targets, this simple discipline prevents sending a parameter to the wrong host and losing a working chain.
Reserve the final minutes for completed-stage checks, project saving and proctoring status. Do not rebuild a working exploit then. Organised evidence remains useful for review even where a hypothesis could not be confirmed.
Practise reversing changes as well: restore a baseline request, sign in again and rebuild a session. During a practical exam, a stable workspace recovers from a bad hypothesis faster than one more exotic payload.
Sources: PortSwigger BSCP, How the BSCP exam works.
