Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Struggling with Burp Suite Certified Practitioner Exam

Samuel, | Last updated: Apr 29, 2022 11:27AM UTC

Hello, I just failed my attempt on the Burp Suite Certified Practitioner Exam. This was a rather frustrating experience, as I managed to solve the first App in ~1.5 hours, giving me a lot of time for App 2. After quickly getting access to two users in App 2, I got stuck and didn't manage to find a single exploitable vulnerability in the remaining 2.5 hours. Obviously, I must have missed something but cannot think of what it might be. I solved all of the Apprentice and Practitioner Labs of your Web Security Academy and felt rather confident having passed the practice exam already. I know you cannot publish solutions to the exam but would it be possible to give a hint how App 2 should have been solvable? Best regards, Konstantin

Michelle, PortSwigger Agent | Last updated: Apr 29, 2022 01:10PM UTC

Hi Unfortunately, we aren't able to provide hints or solutions for exam components as this would be unfair to other exam participants. The exam components are also chosen at random. That said, we can offer some general advice on what to do when your solution doesn't work as expected: - If you're attacking the victim user, test the attack out on your own browser first. Pay close attention to the HTTP traffic sequence in Burp. - If your solution is adapted from an Academy lab, try to analyze how the application differs from the lab - Try to identify any assumptions you're making, and put them to the test. - Refer back to the skillset the certification aims to prove: "Detect and prove the full business impact of a wide range of common web vulnerabilities - such as XSS, SQLi, OWASP Top 10, and HTTP Request Smuggling. Adapt your attack methods to bypass broken defences, using your knowledge of fundamental web technologies like HTTP, HTML, and encodings. Quickly identify weak points within an attack surface, and perform out-of-band attacks to attack them, using manual tools to aid exploitation." We'd also recommend using the mystery lab feature in the Web Security Academy for some extra help with your exam preparations. https://portswigger.net/web-security/all-labs

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.