BSCP Study Plan

Chain web bugs into full compromise, PortSwigger style. A free, day-by-day BSCP schedule built from the official Web Security Academy syllabus, scaled to your exam date and weekly hours.

Approx. cost: $99–$600
Difficulty: ♥♥♥♥♥
Study time: about 166h
Start level: Junior

▶ Build my BSCP plan

> How long does BSCP take?

The plan assumes about 166 study hours. Here is how that stretches across different weekly schedules.

Hours per week	Time to finish
5 hours	about 34 weeks (7.9 months)
10 hours	about 17 weeks (3.9 months)
15 hours	about 12 weeks (2.8 months)
20 hours	about 9 weeks (2.1 months)
30 hours	about 6 weeks (1.4 months)

> BSCP exam format

PortSwigger · Web Security Academy

4-hour hands-on exam, two vulnerable applications
Each app: reach a low-priv account, escalate to admin, then read a secret file
Identity-verified via automated proctoring
Requires an active Burp Suite Professional license
Certification valid for 5 years

Official BSCP page ↗

> BSCP syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

Server-Side Fundamentals

The core vulnerability classes to learn first.

SQL injection8h · learn
Authentication7h · learn
Path traversal3h · learn
Command injection3h · learn
Access control6h · learn
File upload vulnerabilities4h · learn

Server-Side Deep Dives

Broader server-side coverage once the basics are solid.

Business logic vulnerabilities5h · learn
Information disclosure3h · learn
Race conditions4h · learn
Server-side request forgery (SSRF)4h · learn
XXE injection5h · learn
NoSQL injection2h · learn
API testing3h · learn
Web cache deception3h · learn

Client-Side Attacks

The browser's half of the attack surface.

Cross-site scripting (XSS)12h · learn
Cross-site request forgery (CSRF)5h · learn
Cross-origin resource sharing (CORS)2h · learn
Clickjacking2h · learn
DOM-based vulnerabilities4h · learn
WebSockets2h · learn

Advanced: Protocols & Auth

Where a lot of the exam-level difficulty lives.

Web cache poisoning6h · learn
HTTP Host header attacks4h · learn
HTTP request smuggling9h · learn
OAuth authentication4h · learn
JWT attacks4h · learn

Advanced: Modern Attack Surface

Newer and less common, but fair game on the exam.

Insecure deserialization5h · learn
Web LLM attacks4h · learn
GraphQL API vulnerabilities3h · learn
Server-side template injection4h · learn
Prototype pollution5h · learn

Mystery Labs & Practice Exams

Recon and solve with no contextual clues, just like exam day.

Mystery lab challenges across every topic15h · lab
Practice exams under the real format8h · lab

Final Boss Prep

Sharpen recon and the exploit-chain workflow.

Recon checklist for an unfamiliar app4h · review
Rehearse the three-stage chain4h · review

> Where to practise for BSCP

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

All Web Security Academy labs (PortSwigger)
Mystery lab challenge (PortSwigger)
Juice Shop (practice app) (OWASP)

> BSCP exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

Schedule your exam and add the start time, time zone and deadline to your calendar
Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
Confirm your Burp Suite Professional licence is active and runs on your exam machine
Practise the three-stage flow: low-privilege access, admin, then reading the secret file
Complete a full-length timed practice run (4 hours if you can) on your exam setup
Finalize your note-taking setup and templates (see the notes starter below)
Build and review your cheat sheets and command references
Arrange time off, tell people you will be unavailable, and plan your meals ahead
Check your ID is valid and matches the name on your exam account

Machine and network

Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
Plug in your laptop and turn off sleep, updates and notifications for the exam
Test access to the exam platform and check any browser or device requirements
Install and test every tool you plan to use, and check none of them are banned
Test your screenshot hotkeys and make sure you have plenty of free disk space

Proctoring and room

Test your webcam, microphone and screen sharing on the proctoring platform
Clear your desk and room as the rules require, and tell housemates not to interrupt
Confirm what is allowed at your desk (second monitor, phone, notes, paper) and follow it exactly
Learn the rules for breaks and for leaving the camera view
Have your ID ready and know the check-in steps

During the exam

Sleep well the night before, and skip last-minute cramming
Prepare food and water, and set timers for break reminders
Read the brief and scope carefully before you touch anything
Write notes and capture proof as you go, not at the end
Time-box each target and move on when stuck. You can come back later
Stop new attacks with enough time left to verify your evidence

Finishing

Review how your results are submitted or scored so nothing is missed before you close the lab

Suggested exam-day rhythm

First 10 minutes. Connect, read the brief, set up your notes and start a timer.
Minutes 10 to 210. Split the time by target or application before you start, and stick to each slice. Move on when you hit the limit.
Every hour. Stand up, drink water and look away from the screen for a couple of minutes.
Last 30 minutes. Stop new attacks. Confirm your evidence, screenshots and answers are saved.

▶ Open the interactive BSCP exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed BSCP with PWN PATH

No BSCP debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Frequently asked questions

How long does it take to prepare for BSCP?

PWN PATH builds the BSCP plan on about 166 study hours. At 10 hours a week that is roughly 17 weeks, and at 20 hours a week roughly 9 weeks. Your own timeline depends on how much of the material you already know.

What is the BSCP exam like?

4-hour hands-on exam, two vulnerable applications. Each app: reach a low-priv account, escalate to admin, then read a secret file. Identity-verified via automated proctoring. Requires an active Burp Suite Professional license. Certification valid for 5 years.

How hard is BSCP?

We rate BSCP 3 out of 5. It suits anyone serious about web security who wants a cheap, highly respected credential. Comfort with HTTP and Burp. The free Academy teaches the rest.

How much does BSCP cost?

The exam costs $99 per attempt and the Academy is free, but you need a Burp Suite Professional licence (about $499 per year). Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for BSCP?

Start with the "Server-Side Fundamentals" phase: SQL injection, Authentication, Path traversal. The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for BSCP?

Comfort with HTTP and Burp. The free Academy teaches the rest.

What should I do the week before the BSCP exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and exam platform access, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the BSCP exam?

First 10 minutes: Connect, read the brief, set up your notes and start a timer. Minutes 10 to 210: Split the time by target or application before you start, and stick to each slice. Move on when you hit the limit. Every hour: Stand up, drink water and look away from the screen for a couple of minutes. Last 30 minutes: Stop new attacks. Confirm your evidence, screenshots and answers are saved.

What should I take after BSCP?

Common next steps are OSWE, CWEE. See the roadmap to compare them.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Good stepping stones before BSCP:

Where it leads: