How the Burp Suite Certified Practitioner exam process works

Summary: PortSwigger's Burp Suite Certified Practitioner exam is a four-hour practical test in which candidates must compromise two deliberately vulnerable applications, each in three stages: access any user account, use it to reach the admin interface, then read /home/carlos/secret from the server's filesystem. Candidates must first pass an automated identity check with a government-issued photo ID, hold an active Burp Suite Professional subscription, and submit their Burp project file for analysis, with any cheating resulting in a permanent ban.
Bottom line: The exam's integrity rests on proctoring and mandatory project-file submission, which PortSwigger may request up to a week after the test - a model built on the assumption that hands-on offensive skill can be verified rather than self-reported.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026