All topics

If you're new to web security, it can be difficult to know where to begin. We recommend working through the topics available, completing the labs as you go, but don't be afraid to move on to the next topic if you get stuck. You can go back to the more challenging labs once you've developed your skills further. If you want more guided support, please see our learning paths.

Server-side topics

For complete beginners, we recommend starting with our server-side topics. These vulnerabilities are typically easier to learn because you only need to understand what's happening on the server. Our materials and labs will help you develop some of the core knowledge and skills that you will rely on time after time.

SQL injection

SQL injection is an old-but-gold vulnerability responsible for many high-profile data breaches. Although relatively simple to learn, it can potentially be used for some high-severity exploits. This makes it an ideal first topic for beginners, and essential knowledge even for more experienced users.

Go to topic

^{18 Labs}

Client-side topics

Client-side vulnerabilities introduce an additional layer of complexity, which can make them slightly more challenging. These materials and labs will help you build on the server-side skills you've already learned and teach you how to identify and exploit some gnarly client-side vectors as well.

Cross-site scripting (XSS)

Simply put, XSS is one of the most important vulnerabilities out there. It's both incredibly common and extremely powerful, especially when used as part of a wider exploit chain. This is a huge topic, with plenty of labs for complete beginners and seasoned pros alike.

Go to topic

^{30 Labs}

Cross-site request forgery (CSRF)

Go to topic

^{12 Labs}

Cross-origin resource sharing (CORS)

Go to topic

^{4 Labs}

Clickjacking

Go to topic

^{5 Labs}

DOM-based vulnerabilities

Go to topic

^{7 Labs}

WebSockets

Go to topic

^{3 Labs}

Advanced topics

These topics aren't necessarily more difficult to master but they generally require deeper understanding and a wider breadth of knowledge. We recommend getting to grips with the basics before tackling these labs, some of which are based on pioneering techniques discovered by our world-class research team.

Insecure deserialization

Deserialization has a reputation for being difficult to get your head around but it can be much easier to exploit than you might think. We'll guide you through the process step-by-step so you can pick off some high-severity bugs that even experienced testers may have missed altogether.

Go to topic

^{10 Labs}

Web LLM attacks

New topic

Go to topic

^{4 Labs}

GraphQL API vulnerabilities

Go to topic

^{5 Labs}

Server-side template injection

Go to topic

^{7 Labs}

Web cache poisoning

Go to topic

^{13 Labs}

HTTP Host header attacks

Go to topic

^{7 Labs}

HTTP request smuggling

Go to topic

^{22 Labs}

OAuth authentication

Go to topic

^{6 Labs}

JWT attacks

Go to topic

^{8 Labs}

Prototype pollution

Go to topic

^{10 Labs}

Essential skills

Go to topic

^{2 Labs}

Burp Suite Certified Practitioner

The Burp Suite Certified Practitioner exam is challenging, and heavily focused on problem-solving. To pass the exam, you will need to demonstrate a number of skills and abilities. We advise that you need to be able to complete all "Apprentice" and "Practitioner" level labs, so at this point in the learning path you're in a great position to give it a go.

Mystery lab challenge

Unlike when you complete labs on the Web Security Academy, during the exam you'll have no prior knowledge of the type of vulnerability that you need to find and exploit. Use the mystery lab challenge below to spin up a randomized lab that you'll have to try and work out how to solve with no context, just like in the exam.

In some of the labs, you have access to your own account with the credentials wiener:peter. If you can enumerate usernames, you may also be able to brute-force the login using the following username and password wordlists.

Level

Category

Challenge me

Javascript is required to launch the labs.

The certification exam

In order to become a Burp Suite Certified Practitioner, you will need to undertake (and successfully pass) a four hour exam. This exam will consist of multiple practical challenges, designed to test your knowledge of vulnerabilities as well as your ability to exploit them.

Find out more

Prepare with the practice exam

Take practice exam

Understand the exam process

Find out more

Want the latest from the Web Security Academy?

Learning about web security @WebSecAcademy and don't know how I made it this long in the web design world without getting into this. Now I am hooked. Can't stop playing around in their labs. Just spent an entire long weekend in front of the laptop #websec

@CodeWithFrida

All topics

Server-side topics

SQL injection

Authentication

Path traversal

Command injection

Business logic vulnerabilities

Information disclosure

Access control

File upload vulnerabilities

Race conditions

Server-side request forgery (SSRF)

XXE injection

NoSQL injection

API testing

Client-side topics

Cross-site scripting (XSS)

Cross-site request forgery (CSRF)

Cross-origin resource sharing (CORS)

Clickjacking

DOM-based vulnerabilities

WebSockets

Advanced topics

Insecure deserialization

Web LLM attacks

GraphQL API vulnerabilities

Server-side template injection

Web cache poisoning

HTTP Host header attacks

HTTP request smuggling

OAuth authentication

JWT attacks

Prototype pollution

Essential skills

Mystery lab challenge

The certification exam

Prepare with the practice exam

Understand the exam process

Want the latest from the Web Security Academy?

User dashboard

Hall of Fame

Getting started guide