BSCP study guide
BSCP · Work through your exam, one topic at a time.
The Burp Suite Certified Practitioner (BSCP) is a web security certification issued by PortSwigger, the company behind Burp Suite. According to the official certification page, it is an official certification for web security professionals, and passing it demonstrates a deep knowledge of web security vulnerabilities, the correct mindset to exploit them, and the Burp Suite skills needed to carry this out. The credential is aimed at penetration testers and the organizations that employ them: candidates can use it to prove proficiency to employers and the community, and teams can use it to demonstrate testing proficiency to clients and to identify new talent. The exam is practical in nature and is taken with Burp Suite Professional; an active Burp Suite Professional subscription is required to sit it. Topics on this exam: Web security vulnerability classes and exploitation and Burp Suite Professional practical skills. The BSCP study guide has 2 sections and about 694 words.
01Web Security Vulnerability Classes and Exploitation
The BSCP exam tests whether you can find and exploit real bugs in two target applications under a four-hour limit. Detection is not enough: you must reach a concrete goal such as privilege escalation, data exfiltration, or code execution. The exam emphasizes access control, injection, client-side trust, and server-side request flaws, often chained. Enumerate roles, endpoints, parameters, cookies, headers, and state transitions before exploiting.
330 words, about 2 min02Burp Suite Professional Practical Skills
This domain tests fluent use of Burp Pro as an exploitation workbench: intercepting, replaying, fuzzing, decoding, and out-of-band collaboration. The exam expects you to configure Burp so it does not fight you, then use Repeater, Intruder, and Collaborator deliberately. Proxy: set target scope, filter noise, intercept only in-scope traffic; use match/replace for headers; enable TLS pass-through for client certificates. Repeater: use tab groups and renaming; send requests from Proxy; use Request in browser for CSRF PoCs; compare responses with Comparer.
364 words, about 2 min