BSCP Review

TL;DR

The BSCP is the best value for money I’ve found in any certification, full stop. The learning platform is free, the labs are superb, the exam is demanding, and the whole thing costs about the price of a dinner out. My only real complaint has nothing to do with quality: hardly anyone recognises it yet, which is a genuine shame for how good it is. If you do any kind of web security, do this one.

My background before the BSCP

I came into the BSCP straight off the back of the OSCP+ and the OSWP. My web knowledge at that point came mostly from the fairly shallow web side of the OSCP, so this was where I actually learned web application security properly. If you’ve read my OSCP review, you’ll know I think the web content there stays basic. The BSCP is the fix for that.

Why I took it

Two reasons. I wanted to turn the surface-level web skills from the OSCP into something real, and the BSCP is the obvious route for that. And honestly, the price made it a no-brainer: when the learning material is free and the exam is this cheap, there’s very little reason not to.

Preparation

The Web Security Academy is the star of the show, and it’s completely free. I worked through all 273 labs across every topic. I barely touched the written theory, because I learn by doing and the labs teach you everything you need anyway. If you live in the labs, the material does its job.

Then came the part I enjoyed most: the mystery labs. I did close to 100 of them to forge a real methodology, the same way I built my own mock exams for the OSCP. That’s where you stop solving labs you already know the answer to and start training the actual exam skill, which is recognising a vulnerability fast when nobody tells you what it is.

One thing that saved me real time: not every vulnerability category is in scope, and there’s a reliable way to tell which are. Look at which topics have Practitioner-level labs (the blue ones) and which show up as selectable categories in the mystery labs. That’s your actual syllabus. I’d assumed prototype pollution was fair game, for example, but it isn’t a selectable mystery category, so I ruled it straight out. I’ve seen the odd unverified claim of more exotic categories turning up, but I wouldn’t bank on them.

On tooling I used Burp Pro with the extensions that end up doing a lot of the heavy lifting: JWT Editor, Hackvertor, Param Miner, HTTP Request Smuggler and Freddy. I also did both practice exams before sitting the real thing. Worth knowing: the BSCP is open book, internet included, and the only hard rule is that you can’t talk to another person. One genuinely annoying gap, though: the rules never actually say whether AI tools are allowed or not. It’s left completely ambiguous, and for an exam sat in 2026, that’s something PortSwigger really should spell out.

The exam experience

The exam itself is demanding and fair, but a few things caught me off guard, and I’d rather you hear them from me first.

My main gripe is on the prep side: there’s very little clear information about what the exam actually expects from you. Everyone knows the shape (two apps, three stages each), but beyond that I felt like I was going in blind, and that’s not a great feeling with the clock running.

The proctoring was the first surprise. Every guide I’d read made it sound like a quick five-minute check and then you were left alone. That was not my experience. It was fully proctored for the entire exam, microphone included, which none of the write-ups mentioned. Go in expecting to be watched the whole time.

The second surprise nearly sank me, and it’s entirely avoidable. I used the same browser for everything, so FoxyProxy and Burp happily started intercepting every request from the proctoring software’s tab as well. Burp ballooned to 17 GB of RAM with the CPU pinned at 100%, and I lost about 20 minutes digging myself out. Use a separate browser (or at least a clean profile with no proxy) for the proctoring tool, and scope Burp to the target only. Learn from my mistake here.

One mindset shift matters more than any single technique: the stages are far more connected than they look. It’s tempting to treat each one as a sealed box with its own app and its own bug, but that isn’t how it plays out. A function or a token you picked up earlier can be exactly what unlocks a later stage, even when it lives in what looks like an earlier stage’s app. And landing a session as your target user isn’t the finish line, it’s the start of the next question: now what do you actually do with it? Sometimes the answer is back where you started. Keep a running map of every function and every credential you come across, and don’t write anything off just because it seems to belong to a different stage.

Why I failed the first attempt

I’ll be straight about this, because it’s the most useful part of the review. What sank me wasn’t a technique I didn’t know. It was tunnel vision.

In the stages built around authentication, brute force and similar, the account you need to compromise is whatever the exam specifies, and it can be any user from the list you’re handed. I’d spent so many practice labs going after the same default victim that I did it on pure autopilot and aimed everything at the wrong target. Read the brief for each stage carefully and confirm who you’re actually meant to be after before you start firing. That single habit cost me the first attempt.

I resat it two days later, went in with the proctoring and browser setup sorted and my head straight about reading each target, and passed.

What I’d do differently

Sort the boring logistics out before exam day, not during it: a clean browser for the proctoring tab, Burp scoped tight, and a clear routine for reading what each stage is actually asking. The hacking was never the problem. The problem was everything around it that I hadn’t rehearsed.

Who should take it

Take it if:

• You do any web security at all, especially if you’re a junior. What this teaches you is not to be missed.
• You want to turn shallow web knowledge into something solid, methodically and cheaply.

Skip it (or you won’t need it) if:

• You already have serious miles in web pentesting. That said, I genuinely think the BSCP covers your first couple of years of experience comfortably, so the bar for “too experienced for this” is higher than you’d think.

Final verdict

Totally worth it. It might not be the most recognised cert out there, and it disappoints me that it’s recognised as little as it is, but the quality is incredible and it’s absurdly cheap. For the content, the labs and the exam you get, I doubt you’ll find anything better at this price. If the OSCP is the badge you buy for recognition, the BSCP is the one you do for the skills.