Practice exams

Before you start your practice exam ...

Make sure you are comfortably able to do all of the below:

• Complete all of the labs within the Web Security Academy labeled "Practitioner" or lower without requiring access to the solutions provided.

• Capably perform the exploits outlined within the exploiting XSS labs, in the XSS topic.

• Have a go at solving labs generated by the mystery lab challenge.

• Use Burp Suite Professional to quickly identify weaknesses and potential attack points.

• Confidently use Burp Suite Professional's manual tools to aid exploitation.

• Utilize the correct tools to perform out-of-band attacks.

We've created a guide to using Burp Scanner during manual testing, to make sure you've got to grips with the full scope of scanning you'll need to perform during the exam. The exam also requires you to be able to adapt your attack methods to bypass broken defenses - specifically - obfuscating attacks using encodings.

Mystery lab challenge

Unlike when you complete labs on the Web Security Academy, during the exam you'll have no prior knowledge of the type of vulnerability that you need to find and exploit. Use the mystery lab challenge below to spin up a randomized lab that you'll have to try and work out how to solve with no context, just like in the exam.

In some of the labs, you have access to your own account with the credentials wiener:peter. If you can enumerate usernames, you may also be able to brute-force the login using the following username and password wordlists.

How is the practice exam different to the real exam?

Practice exam:

• You can restart the exam as often as you need, and retake the exam as many times as you like until you feel prepared.
• You have two hours to complete the practice exam.
• There is one vulnerable application for you to exploit.

Real exam:

• You cannot restart the exam - as soon as your exam timer starts you are committed to the exam session.
• You have four hours to complete the real exam.
• There are two vulnerable applications for you to exploit.

Make sure that you take the practice exams as many times as is necessary before you attempt the real exam - your revision and preparation are in your hands.

Part of being a professional is handling responsibility. While exploiting each application, you will gain access to powerful functionality. If you use this to delete your own account or a core system component, you may make your exam impossible to complete.