Burp Suite Certified Practitioner Exam Preparation Training

Identify vulnerabilities using burp suite practitioner labs, including sql injection, cross-site scripting, csrf, dom xss, and GraphQL vulnerabilities, plus misconfigurations in authentication, access control, file uploads, and web cache poisoning.

Demonstrates bypassing php extension filters by abusing an htaccess writable to map a non php extension to php, upload a web shell, and execute code to read server files.

Explore how a misconfigured oauth redirect uri enables an attacker to hijack accounts by leaking authorization codes to an attack server, then complete login to gain admin access.

Explore server side request forgery through flawed request parsing and routing-based SSRF, using host header manipulation to reach an internal admin panel and perform a delete operation with CSRF verification.

Explore cross-site scripting techniques to exfiltrate credentials by injecting a username and password box that sends data to Burp Collaborator, highlighting risks and defense considerations.

Learn to perform blind XXE with out-of-band interaction using XML parameter entities; declare and reference them with the percent sign, and verify DNS and HTTP interactions in a lab environment.

Explains multi-step clickjacking techniques in a lab setting, using iframes and overlays to simulate a delete-account flow and confirm how two-stage prompts can trap victims across browsers.

Explores server side request forgery (SSRF) and how filter bypass via an open redirect enables access to internal resources, such as an admin panel, including deleting a user.

Examine how a CORS misconfiguration with trusted insecure protocols enables an attacker to exfiltrate an administrator API key through chained vulnerabilities, including XSS and cross-domain AJAX requests.

Demonstrate insecure deserialization by manipulating a serialized user object to trigger deletion of another user's avatar file via the delete account function, using session cookies and serialized fields.

Demonstrate directory traversal concepts and how non-recursive filtering can fail, enabling bypass through multiple traversal sequences. Highlight how regex limitations may leave first filters intact while subsequent ones slip through.

Learn to bypass broken brute-force protection with an IP block by interleaving valid logins with brute-force attempts using Burp Suite intruder's pitchfork attack to log in as Carlos.

Explore manipulating the WebSocket handshake to bypass filters and expose vulnerabilities, including cross-site scripting payloads, WebSocket history analysis, and using X-forwarded-for to evade IP blocks.

Explore dom xss using web messages and a JavaScript URL, examining an unsanitized post message flow via an iframe to trigger a sink and deliver an exploit in the lab.

Demonstrate information disclosure risks in version control history by inspecting a git repository, identifying hard-coded credentials, and showing how history can reveal the admin password.

Explore blind OS command injection with output redirection, using writable folders to exfiltrate output and verify results by writing whoami output to a file in /var/www/images.

Learn to uncover vulnerabilities quickly using targeted scanning with Burp Suite Pro, performing active scans on specific requests to reveal XML parsing and XInclude issues.

Showcases exploiting a stored cross-site scripting vulnerability to exfiltrate cookies using burp collaborator, revealing secrets and session cookies for impersonation. Learn payloads, document.cookie exfiltration, and cookie editing to test access.

Demonstrates blind SQL injection with out-of-band data exfiltration, using a Burp Collaborator to exfiltrate the administrator password from a vulnerable Oracle database through an external domain.

Explore a forced OAuth profile linking vulnerability and how a missing state parameter enables an attacker to hijack an admin account via social login, highlighting CSRF protections in OAuth flows.

Demonstrates brute-forcing a state locked in cookie to impersonate another user. Analyze the stay-logged-in cookie's base64 and md5 components, and use Burp Repeater and Intruder to craft the payloads.

Explore server side request forgery through a blacklist-based input filter, bypass with URL encoding and payload tricks, and delete the user Carlos in the admin panel.

Explore SQL injection with filter bypass via XML encoding to bypass a web application firewall, reveal the users table with usernames and passwords through a stock check feature.

Use targeted scanning with Burp Suite to rapidly uncover vulnerabilities, perform active scans on specific requests, and analyze XML parsing issues like XInclude to reveal sensitive data.

Explore a reflected cross-site scripting lab by testing injectable inputs on the main page and a post, using repeater payloads to reveal escaping and reflections.

Solve mystery lab four by analyzing the user interface, logging in as Vina and Peter, manipulating password changes in Burp repeater, and exploring the admin panel.

Explore mystery lab challenges with Burp Suite, testing login and endpoints using repeater and active scans to reveal a path traversal to reach the passwd file.

Explore how a static csrf token enables a vulnerability by changing a user email via manipulated requests. Use the exploit server to craft a poc with post requests.

Explore web cash poisoning by testing x-forwarded-host headers, using cache busting, and deploying an exploit server payload to steal cookies and solve the mystery lab.

In mystery lab 9, learn to analyze login flows, inspect cookies, and manipulate payloads to access the admin portal and privilege controls within Burp Suite.

Explore a no-hint mystery lab and practice bug bounty thinking with login flows. Identify deserialization in session cookies and use burp suite to access the admin panel.

Explore an apprentice mystery lab in a shopping app, testing login via a username/password wordlist, examining API keys, session tokens, and an access control flaw revealed through a 302 redirect.

Solve the Portswigger apprentice mystery lab by exploring login, CSRF tokens, and a JSON web token, exploiting the non signing algorithm to bypass admin access, and delete Carlos.

Practice exam 1 walkthrough demonstrates Burp Suite certified practitioner prep: identifying reflected cross-site scripting, sql injection, and authenticated vulnerabilities with exploit server payloads and bypass techniques.

Walk through practice exam 2 for burp suite practitioner, illustrating cross-site scripting and prototype pollution testing with burp tools, collaborator, and sqlmap, plus admin panel and cookies.