What is PortSwigger?#
PortSwigger is the company behind Burp Suite, the tool most web application penetration testers reach for first. Burp sits between your browser and the target web app as an intercepting proxy, letting you inspect, modify, and replay HTTP requests sort of the bread and butter of finding and exploiting web vulnerabilities
Burp Suite comes in a few flavours#
- Burp Suite Community Edition : free, and enough to complete nearly all of the training labs.
- Burp Suite Professional : the paid version, with an automated scanner, advanced tooling, and everything you need for real engagements.
- Burp Suite Enterprise : a scaled-up, CI/CD friendly version aimed at organizations.
The company's credibility runs deep PortSwigger's Chief Swig is Dafydd Stuttard, author of The Web Application Hacker's Handbook, and their in house research team regularly publishes original techniques that shape how the whole industry tests web apps
The Web Security Academy free labs that actually teach you#
This is where PortSwigger earns its reputation with learners. The Web Security Academy is a free, self paced training platform for web application security no paywall, no ads, no upsell. You create a free account, read the material, and then prove you understood it by exploiting a deliberately vulnerable app in a browser based lab.
A few things make it stand out:
It's genuinely free. The reading and the interactive labs cost nothing, and you can complete almost all of them with the free Community Edition of Burp. PortSwigger's business is selling Burp Pro, so the Academy doubles as world-class education and marketing at the same time a rare win-win.
The coverage is huge. There are 200+ hands-on labs spanning the full modern web security curriculum:
-
Server-side: SQL injection, authentication flaws, access control, path traversal, command injection, SSRF, XXE, business logic vulnerabilities, information disclosure.
-
Client-side: Cross-site scripting (XSS), CSRF, CORS, clickjacking, DOM-based bugs, WebSocket vulnerabilities.
-
Advanced: Insecure deserialization, HTTP request smuggling, JWT attacks, OAuth flaws, GraphQL and API vulnerabilities, race conditions, prototype pollution, web cache poisoning, and newer classes like web LLM attacks.
Labs are graded by difficulty. They're sorted into Apprentice, Practitioner, and Expert tiers, so you can start gently and work your way up. Each lab pairs theory with a concrete objective you're not just reading about a vulnerability, you're exploiting a live instance of it.
It's constantly updated. Unlike a static textbook, new labs and topics land regularly as the research team publishes new attacks, so what you learn stays current.
There's also a Mystery Lab challenge: it spins up a random lab with the vulnerability type hidden, forcing you to do your own recon and analysis with no hints exactly the kind of pressure you'll face on a real test or a real engagement.
The BSCP: PortSwigger's certification#
Once you're comfortable working through Practitioner-level labs without peeking at the solutions, the natural next step is the Burp Suite Certified Practitioner (BSCP) PortSwigger's official, fully hands-on certification for web security professionals.
Unlike multiple choice exams, the BSCP is entirely practical. Here's the shape of it:
- Format: Two live, intentionally vulnerable web applications.
- Structure: Each app has three sequential stages — first gain access to any user account, then escalate to the admin interface, then read a protected file from the server (
/home/carlos/secret). Order matters; you can't skip ahead. - Total: Six vulnerabilities to find and exploit across both apps.
- Time limit: 4 hours roughly 45 minutes per vulnerability, which is where the real pressure comes from.
- Cost: $99 USD per attempt.
- Proctoring: Remote and automated (via a third-party identity-verification service).
- Requirement: An active Burp Suite Professional license is needed to sit the exam, even though all the study material is free.
- Validity: The certification is valid for several years, and once you buy an attempt you have 12 months to use it.
Because each exam attempt pulls dynamic, randomized vulnerabilities, no two sittings are quite the same which keeps the certification credible even if specific labs get discussed online.
For anyone serious about web application security, PortSwigger is about as good a place to start as it gets.