BSCP case studies
BSCP · Put your knowledge to work in context.
The Burp Suite Certified Practitioner (BSCP) is a web security certification issued by PortSwigger, the company behind Burp Suite. According to the official certification page, it is an official certification for web security professionals, and passing it demonstrates a deep knowledge of web security vulnerabilities, the correct mindset to exploit them, and the Burp Suite skills needed to carry this out. The credential is aimed at penetration testers and the organizations that employ them: candidates can use it to prove proficiency to employers and the community, and teams can use it to demonstrate testing proficiency to clients and to identify new talent. The exam is practical in nature and is taken with Burp Suite Professional; an active Burp Suite Professional subscription is required to sit it. The BSCP case studies are 5 cases and about 2,813 words.
1Sequential Relay IDs in a GraphQL API
You are assessing a B2B SaaS application with a GraphQL endpoint at /graphql. You have two accounts you created: [email protected] in tenant 1042 and [email protected] in tenant 1043.
613 words, about 3 min2Single-Use Coupon Under Parallel Checkout
An e-commerce checkout exposes POST /api/cart/coupon with JSON {"code":"SAVE50"}. The coupon is advertised as one use per account.
606 words, about 3 min3Boolean Oracle in a Product Sort Parameter
A retail API exposes GET /api/products?category=books&sort=price. The sort value is concatenated into an ORDER BY clause.
559 words, about 3 min4OAuth Redirect URI Allowlist Bypass via Path Traversal
A client application at app.example.com uses OAuth 2.0 authorization code flow with an authorization server at auth.example.com. The client registers redirect uri https://app.example.com/callback.
543 words, about 3 min5SSRF Through an Allowlisted Image Fetcher
An application lets users import a profile image by URL at POST /api/import-image with JSON {"url":"https://www.trusted-cdn.com/avatar.png"}. The server fetches the URL, resizes the image, and returns a PNG.
492 words, about 2 min