Hints and guidance for the Burp Suite Certified Practitioner exam
Summary: PortSwigger's guidance for the Burp Suite Certified Practitioner exam states candidates get four hours to work through two applications, each with deliberate vulnerabilities, in three ordered stages: access any user account, reach the /admin interface, then read /home/carlos/secret from the server's filesystem and submit it. Outbound traffic from the vulnerable servers is restricted to the internet except for the public Burp Collaborator server and the integrated exploit server, and candidates must exploit vulnerabilities rather than merely identify them, such as stealing a simulated user's session via XSS or extracting credentials through SQL injection.
What's compelling: The exam's structure mirrors real attack chains: a foothold, then privilege escalation to admin, then data exfiltration - and PortSwigger notes a full application scan won't fit in the four-hour window, so candidates must scan selected pages and insertion points instead. The victim user runs Chromium, so XSS vectors that only work outside Chrome will fail against the simulated user.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026