BSCP practice examsIn development
Burp Suite Certified Practitioner
A timed web exam from the makers of Burp Suite: two applications each a three-stage attack from user access to administrator to exfiltrating the target data, drawn from a large vulnerability pool so recognising the class fast matters more than any rehearsed path, with assumed Burp fluency across scanner, Repeater and Intruder; then the server-side classes driving access and escalation, cross-site scripting delivered end to end to a simulated victim, advanced and chained attacks combining vulnerabilities, and a strategy where per-stage grading and two hours per application make time management decisive.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| The exam, Burp and server-side vulnerabilities | Not published |
| Client-side attacks, escalation and exam strategy | Not published |
Two sample questions
1. What does DOM clobbering exploit?
- Script injected into a template
- Markup overwriting a script variable — correct
- A query built from user input
- A file path built from a parameter in practice
Why: An element with a chosen name can shadow a global the script expects.
2. Why intercept traffic first?
- Understand it — correct
- To submit the flag
- To grade the stage
- To write the report
Why: Intercepting traffic first reveals how the application actually works.
The real BSCP exam
| Length | 4 hours |
|---|---|
| Questions | Practical: two web applications, each requiring a three-stage compromise |
| Pass mark | Complete the required stages within the time limit |
| Price | $99 USD per attempt, with unlimited retakes during the validity period |
| Recommended before you sit it | None enforced. The free Web Security Academy is the intended preparation. |
| Valid for | Does not expire once achieved |
Exam facts as published by PortSwigger; always check the vendor’s page before you book.
Study BSCP with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.