BSCP study plan
BSCP · Give each week a clear focus.
8 weeks · About 7 hours per week
Web security vulnerability classes and exploitation
Map the OWASP-style vulnerability classes to how they actually appear in HTTP requests and responses, writing a one-line detection signature for each class
Set up an isolated lab (local target app plus Burp Suite Professional) and confirm proxy interception works end to end
Practise reading raw request/response traffic to identify injection points, parameters, and trust boundaries by eye
Build a personal vulnerability-class checklist that you will re-use in every later week
Your checkpoint
A 10-15 page personal vulnerability-class notebook with a detection signature and one lab-tested example per class, plus a working proxy lab screenshot-free written setup log
Web security vulnerability classes and exploitation
Exploit reflected and stored cross-site scripting in the lab, then write the exact payload reasoning for each step
Demonstrate how output encoding context (HTML, attribute, JavaScript, URL) changes which payload succeeds
Practise bypassing a basic client-side and server-side XSS filter in your lab
Write remediation notes that name the correct encoding or CSP control for each case
Your checkpoint
A written XSS exploitation report covering at least 4 distinct contexts with payload rationale and remediation for each
Web security vulnerability classes and exploitation
Exploit SQL injection to bypass authentication, then extract data using UNION-based and blind techniques in the lab
Practise a NoSQL or command-injection variant to generalise the injection mental model
Identify and exploit a server-side request forgery case against an internal-only lab service
Document detection signals and defensive controls for each injection family
Your checkpoint
An injection and SSRF lab report with reproducible request sequences and a defence table mapping each flaw to its primary mitigation
Web security vulnerability classes and exploitation & Burp Suite Professional practical skills
Exploit access-control flaws: horizontal and vertical privilege escalation, and insecure direct object references
Configure Burp Suite Professional project options, scope, and session-handling rules so scanning stays inside the authorised target
Use Burp Repeater and Comparer to confirm an access-control finding manually rather than trusting a scanner
Write up one access-control finding in a client-style format with impact and remediation
Your checkpoint
A client-style finding write-up for one access-control vulnerability plus an exported Burp project configuration that enforces scope and session rules
Burp Suite Professional practical skills
Drive the Burp Proxy, HTTP history filtering, and target scope features fluently without touching the mouse-only menus you have not learned
Use Burp Intruder with at least three attack types and configure payload processing and grep matching
Use Burp Repeater, Decoder, and Sequencer for a token-analysis task in the lab
Automate a repetitive manual test with a Burp extension or a simple scripted request loop
Your checkpoint
A written Burp Suite workflow guide you authored, covering scope, Intruder attack types, and an extension or script you actually ran, with results
Burp Suite Professional practical skills & Web security vulnerability classes and exploitation
Use Burp Scanner on an authorised lab target and triage its output, discarding false positives with written justification
Configure authentication for scanning and handle session refresh during an authenticated scan
Chain two vulnerability classes (for example XSS plus CSRF, or SSRF plus access control) into a single impact narrative
Practise explaining a chain to a non-technical stakeholder in under 200 words
Your checkpoint
A triaged scanner output document with at least 3 accepted and 3 rejected findings, each with a one-paragraph justification, plus one written chained-exploit narrative
Web security vulnerability classes and exploitation & Burp Suite Professional practical skills
Complete a timed, full-scope practice engagement against a lab target using only Burp Suite Professional as your tooling
Write findings as you go so the report is a by-product of testing, not a separate task
Review your own report against a checklist of impact, reproduction steps, and remediation specificity
Re-test your two weakest vulnerability classes from earlier weeks and close the gaps
Your checkpoint
A complete practice engagement report with at least 6 findings, reproduction steps, and remediation, produced within a single timed session
Web security vulnerability classes and exploitation & Burp Suite Professional practical skills
Re-drill every vulnerability class and Burp feature you scored weakest on in week 7
Practise articulating methodology and tooling choices aloud, as you would in a practical assessment
Run one final half-length timed engagement to confirm pacing and report quality
Consolidate your notebook and reports into a single revision artifact for the final week before the exam
Your checkpoint
A consolidated revision pack: corrected notebook, week 7 and week 8 reports, and a one-page methodology summary you can recite from memory
Milestones
Week 2: You can explain and demonstrate cross-site scripting in four encoding contexts without notes, and your written payload rationale is specific enough that another tester could reproduce it.
Week 4: You have completed at least one finding in every major web vulnerability class in the lab, and your Burp project configuration enforces scope and session rules correctly.
Week 6: You can triage scanner output with written justification for both accepted and rejected findings, and you have documented one chained exploit with a coherent impact narrative.
Week 8: You have produced two timed engagement reports meeting your own quality checklist, and your consolidated revision pack is complete and self-consistent.