BSCP Study Guide — Burp Suite Practitioner | FsKnockouT

The Burp Suite Certified Practitioner (BSCP) is PortSwigger's hands-on web-security certification. It is a rare exam in the industry because it is fully practical, run against custom vulnerable web applications, and designed to verify that you can chain real vulnerabilities to steal admin credentials. This guide covers the exam format, the labs that matter, a 60-day study plan, the three traps that fail most candidates, and how FsKnockouT's walkthroughs help on the final stretch.

What BSCP is

BSCP is a 4-hour practical exam where you attack two custom-built web applications. Your goal is to find a chain of vulnerabilities in each application that leads to full admin compromise — specifically, you must steal the administrator's cookie or password, then use it to delete a sensitive file on the server. The exam is live-proctored by Examity and graded automatically by the lab environment.

The cert is issued by PortSwigger, the company behind Burp Suite Professional, and the entire preparation path uses their free Web Security Academy — which is one of the most respected free security training resources in the industry.

Who BSCP is for

  • Web application pentesters wanting a vendor-respected credential.
  • Bug-bounty hunters who want to formalise their web-exploitation knowledge.
  • Backend developers moving into security engineering.
  • Candidates stacking BSCP alongside OSWE or CEH to build web-focused depth.
  • Red-teamers specialising in external-perimeter web attacks.

Exam format and scoring

You get 4 hours to attack two separate applications. Each application has a defined progression:

  1. Find a low-privileged user's credentials and log in.
  2. Escalate to the admin account by finding and exploiting a vulnerability chain.
  3. Steal the admin's cookie or use their session.
  4. Delete the sensitive file /home/carlos/secret (or equivalent) using admin privileges.

Each application contributes a set of flags. Passing requires completing both applications fully — partial completion of both apps typically fails, while fully solving one but not the other may also fail depending on flag coverage. Most pass stories complete both apps, not one.

Common failure points

  1. Lab-method tunnel vision. Candidates memorise the PortSwigger academy lab solutions but miss that the exam combines techniques in non-obvious chains. Understand WHY each lab works, not just HOW.
  2. SSRF and prototype pollution gaps. These two topic areas appear frequently and have the lowest lab-completion rates among candidates. Both are must-know for exam day.
  3. Time panic. 4 hours sounds like a lot until you spend 90 minutes on one app without finding the chain. Keep a hard pivot rule — if you're stuck 45 minutes on one step, switch apps.
  4. Burp Suite fluency. Exam-day Burp Suite proficiency means knowing Repeater, Intruder with custom payloads, Collaborator, and Macros instinctively. Candidates who hunt menu items for basic operations burn through time.
  5. Overreliance on scanners. Burp Pro's active scan is allowed but rarely finds the chain. You must manually hunt the vulnerabilities — scanner findings are starting points, not solutions.

Study timeline (8-12 weeks)

A realistic plan assuming 1.5 hours per weeknight and 4 hours per weekend:

  • Weeks 1-4: Complete every apprentice- and practitioner-level lab on the PortSwigger Web Security Academy. Skip nothing.
  • Weeks 5-8: Repeat the hardest practitioner labs (SSRF, DOM-based XSS, prototype pollution, server-side template injection, OAuth, access-control chains) until you can solve them from scratch without hints.
  • Week 9: Take the official Mystery Lab Challenge — a simulated exam environment PortSwigger provides.
  • Week 10: Review BSCP exam reports from past candidates; practice time-boxed exploitation drills.
  • Week 11-12: Simulated 4-hour mock exam, then book the real exam once you can complete the mystery lab in under 2 hours.

Recommended practice

FsKnockouT maintains a complete BSCP walkthrough covering all known exam-pool scenarios: the SSRF chain, prototype pollution chain, access-control bypass chain, and admin-cookie theft paths. See the BSCP Latest Exam Walkthrough for the detailed scenario library, or book a pay-after-pass remote session for live assistance during the 4-hour exam window.

Frequently asked questions

How much does the BSCP exam cost?

Current pricing is $99 USD per attempt, making BSCP one of the most affordable hands-on security certifications. Retakes cost the same.

How many attempts do I get?

Unlimited retakes at $99 each. There is no mandatory waiting period between attempts, though a short break between attempts is strongly recommended.

Do I need Burp Suite Professional?

Yes. The exam requires the paid Burp Suite Professional edition. PortSwigger offers a 30-day free trial if you want to attempt the exam without a long-term license.

Is the Web Security Academy enough?

For most candidates, yes — the academy is the single best preparation resource and covers the majority of exam topics. Supplementing with real-world CTF labs and the Mystery Lab Challenge closes the exam-readiness gap.

How does BSCP compare to OSWE?

OSWE is harder, longer (48 hours vs 4), and more expensive. BSCP is tighter, cheaper, and focused specifically on classic web vulnerabilities. Both are respected; BSCP is the better entry point. See the OSWE study guide for the next step.

What is the pass rate?

PortSwigger has stated roughly 50% first-attempt pass rate historically. The exam is designed to be failable — don't be discouraged by a first-attempt fail.

How do I use FsKnockouT's walkthrough?

Study each scenario before exam day so you recognise the chain patterns instantly. On exam day you'll still need to adapt, but the base patterns are consistent across exam pool updates.

Ready to prepare?

Get the BSCP walkthrough for scenario coverage, then message @FsKnockouT on Telegram if you want live exam support. Related reading: OSWE study guide and OSCP study guide 2026.