Track
BSCP
BSCP is a practical exam: you are asked to understand a small application and exercise it inside a lab. These notes build the mental model and the Burp workflow. They do not contain exploit scripts. When a topic needs a concrete input, do that step in an official lab you are allowed to use. Planning date for Burp Pro access: 21 December 2026.
0 done · 0 in progress · 38 not started
Family
Notes
Progress
Showing 38 of 38
Method
How to study this track, how to stay in scope, and how to map an app before changing anything.
- How to study this trackReadyNot startedHow to use these notes with PortSwigger Academy labs and a Burp project, without turning the desk into a script book.16 min
- Scope and ethicsReadyNot startedWritten permission, lab scope, and how to handle the secrets a proxy inevitably sees.12 min
- Reading a web applicationReadyNot startedMap endpoints, parameters, identities, and trust boundaries before you change a request.18 min
- API testingOutlineNot startedOutline only. APIs are the same trust decisions as pages, with less UI to hide a missing check.8 min
Burp workflow
What Proxy, Repeater, Intruder, Logger, and Collaborator are each for.
- Burp ProxyReadyNot startedProxy is the map. Use history and scope first. Intercept is for a single request you mean to pause.14 min
- Burp RepeaterReadyNot startedRepeater is where you change one thing and compare the response. It is the default tool once the map exists.14 min
- Burp LoggerReadyNot startedLogger is the session tape. Use it to reconstruct what every Burp tool sent, especially after a long lab.10 min
- Burp IntruderReadyNot startedIntruder iterates a list you can explain. Learn the placement modes, then keep the list short and the target in scope.16 min
- Burp CollaboratorReadyNot startedCollaborator shows out-of-band interactions when the bug is a request the server makes, not a response you can read.12 min
Server-side
Bugs where the server trusts input, a parser, or an object the client should not control.
- Access control and IDORReadyNot startedAccess control fails when the server uses an identifier the client sent and does not check it against the caller.18 min
- SQL injectionReadyNot startedSQL injection is what happens when untrusted input changes the structure of a query instead of staying a value.18 min
- Cross-site scriptingReadyNot startedXSS is attacker-controlled content executing in a victim's browser because a page mixed data into a markup or script context.18 min
- Cross-site request forgeryReadyNot startedCSRF is a state-changing request the browser will send with the victim's cookies, started from another site, with no secret the attacker cannot see.14 min
- Server-side request forgeryReadyNot startedSSRF is the server fetching a location a user influenced, so the request comes from inside a trust boundary the user does not occupy.16 min
- Path traversalReadyNot startedPath traversal is a file path built from user input that escapes the directory the developer had in mind.14 min
- OS command injectionReadyNot startedCommand injection is user input concatenated into a shell command so the shell parses it as syntax rather than as data.14 min
- File uploadReadyNot startedUpload bugs are about what the server believes a file is, where it stores the bytes, and whether anything later executes or parses them.15 min
- XML external entitiesReadyNot startedXXE is an XML parser that will load external entities, so a document the user supplied can make the parser read files or fetch URLs.14 min
- Server-side template injectionReadyNot startedSSTI happens when user input is built into a template that the server executes, so the input is code in that template language.13 min
- Insecure deserializationReadyNot startedDeserialization turns bytes back into objects. If those bytes came from the client, the client is choosing which objects the server builds.14 min
- HTTP request smugglingReadyNot startedRequest smuggling is a disagreement between two HTTP parsers about where a request ends, so one party's bytes become the next party's request.15 min
- Information disclosureReadyNot startedDisclosure is any channel that tells an outsider something the application meant to keep: errors, backups, comments, and overly honest headers.12 min
- Race conditionsReadyNot startedA race is a check-then-act gap. Two requests both pass a limit before either update lands.14 min
- Business logic flawsOutlineNot startedOutline only. Logic flaws are rules the application forgets to enforce, not a parser bug.8 min
- Web cache poisoningOutlineNot startedOutline only. Cache poisoning is a shared cache storing a response that was varied by an unkeyed input.8 min
- Host header attacksOutlineNot startedOutline only. The Host header is client-influenced, and some apps still use it to build links or pick a tenant.8 min
Authentication
Sessions, passwords, MFA, OAuth, and tokens — checks that fail when the server trusts the wrong proof.
- Sessions and cookiesReadyNot startedA session is the server's memory of who you are. Cookies are only the handle the browser presents.16 min
- Authentication failuresReadyNot startedPassword attacks are an economics problem. Online guessing, offline cracking, and reused passwords fail in different places, and the controls are different too.16 min
- MFA bypass conceptsReadyNot startedMFA fails when the second factor can be phished, fatigued, skipped, or checked on a step the attacker does not have to repeat.12 min
- OAuth flawsReadyNot startedOAuth hands a grant to another application. The flaws are loose redirects, missing state, and tokens that leak or that mean more than the user agreed.15 min
- JWT issuesReadyNot startedA JWT is a signed set of claims. The bugs are trusting the header's algorithm, skipping the signature check, or not binding the token to this service.15 min
Client-side
Browser rules: what the client enforces, what it ignores, and what the server still has to check, including model features that follow untrusted text.
- CORSReadyNot startedCORS is the browser's rule for when a script on one origin may read a response from another. It is not a server-side firewall.14 min
- Content Security PolicyReadyNot startedCSP is a browser allow list for where a page may load code and who may frame it. A policy that allows inline script does not contain XSS.13 min
- ClickjackingReadyNot startedClickjacking is a visible, trusted page framed by an attacker's page so the victim's click lands on a control they did not mean to use.11 min
- DOM-based issuesReadyNot startedDOM-based bugs are a source and a sink in the browser. The server response may never contain the dangerous value.14 min
- WebSocketsReadyNot startedA WebSocket is a long-lived channel. The handshake still needs an origin check, and each message still needs authorization.15 min
- Web LLM featuresReadyNot startedA site that lets a model read untrusted text and call tools has turned that text into instructions with the model's privileges.16 min
- Prototype pollutionOutlineNot startedOutline only. Prototype pollution is a merge of untrusted fields into an object's shared prototype.8 min