A Burp practitioner candidate's notes, organised by exploit stage

The table of contents mirrors the exam structure

The organisation of the notes is the first thing worth noticing, because it is not alphabetical by vulnerability class. It groups scanning separately, then labels Foothold, Privilege escalation and Data exfiltration as stages 1, 2 and 3.

Scanning covers enumeration, split into focus scanning and scanning non-standard data structures. Foothold, labelled stage 1, holds content discovery, DOM-based XSS, cross-site scripting, web cache poisoning, host headers, HTTP request smuggling, brute force and authentication. Privilege escalation, stage 2, holds CSRF account takeover, password reset, SQL injection, JWT handling, prototype pollution, API testing, access control, GraphQL endpoints and CORS. Data exfiltration, stage 3, holds XXE, SSRF, server-side template injection, server-side prototype pollution, file path traversal, file uploads, deserialization and OS command injection.

Each vulnerability entry follows a recognisable shape: a one or two line explanation in the author's words, a screenshot from the lab, sometimes a request payload, and a link to the specific PortSwigger lab. That consistency makes the repository usable as a checklist, walking top to bottom and ticking off what you have hands-on experience with rather than having read about.

The appendix holds a Python scripts section, a payloads directory with its own README, a wordlists directory, notes on focus target scanning, a description of the author's approach, and a section of exam tips.

Scanning narrowly is the first lesson

The scanning section is short, and the reason is stated plainly: engagements and the exam run on a tight time limit, so you scan defined insertion points for specific requests rather than pointing an automated scan at the whole target.

The first lab demonstrates the payoff. The scanner reports an XML injection vulnerability on a storeId parameter, and the note records that this lead is what allowed reading a file on the server. The payload shown is an XInclude document pointing at a local file path:

<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///home/carlos/secret"/></foo>

The second payload is described as an out-of-band XInclude request using a hosted DTD. Both are one line, and the note's value is in the sequence: run a targeted scan, read what the scanner reports, then hand-craft.

The second lab covers non-standard data structures, where an insertion point sits somewhere other than a parameter, inside selected text in a request or response. Here the scanner finds the issue and the author takes it further manually.

If you take one habit from this section, it is narrowing the scan scope to insertion points you have already found, which is the time-conscious approach the notes recommend.

Content discovery: wordlists, robots.txt and version control

The content discovery entry is the most directly reusable part of the repository, because it ships the wordlist it uses.

The author downloads the compiled list from the repository's own wordlists directory and runs it through ffuf against the target:

wget https://raw.githubusercontent.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study/main/wordlists/burp-labs-wordlist.txt

ffuf -c -w ./burp-labs-wordlist.txt -u https://TARGET.web-security-academy.net/FUZZ

The same list can be loaded into Burp's engagement tools content discovery feature as a custom file list, which is the practical note for anyone who wants one wordlist working in both tools. The entry also mentions checking `robots.txt` and `sitemap.xml`, which frequently reveal paths.

The second half of that entry covers a different kind of disclosure: recovering information from a version control history. It downloads the `.git/` directory of the target and then inspects the cloned repository locally, in the example with `git-cola`, using an undo-last-commit view to read an admin password out of a diff. The lesson is that a leaked repository is an information disclosure finding even when the working tree looks clean, and the tooling shown is ordinary desktop git tooling rather than anything exotic.

Both approaches are cheap, and in a timed engagement they are the ones to run before anything heavier.

What this repository is not

It helps to be precise, because the topic list in the repository metadata could be read as a toolkit.

It is a set of notes. The author describes them as study notes covering more than 110 PortSwigger Academy labs, written while preparing for the 2023 certification, and repeatedly redirects readers to PortSwigger Academy for the latest learning materials. There is no scanner, no automation framework and no code that targets anything by itself. The `code/` and `python/` directories hold the scripts the author wrote for specific labs, and the `payloads/` directory holds the request snippets quoted in the notes.

That also means the ceiling is the ceiling of one person's preparation. The notes record what worked in Academy labs, on applications built to be vulnerable in specific ways. A lab is designed so a particular technique produces a particular result; a real application under a real engagement rarely cooperates that precisely, and the repository does not claim otherwise.

Two further limits are worth stating. The licence is not declared: there is no LICENSE file among the top-level entries, which means there is no stated permission to reuse the wordlists or payloads even though they are downloadable. And the repository has no releases, so there is no version to pin and no upgrade path, only commits on the main branch.

The last push was on 2026-08-19, so the notes are being touched, but the material is pinned to a 2023 exam.

Editorial conclusion

Adopt this repository as a checklist and a source of lab wordlists if you are preparing for the PortSwigger Burp Suite Certified Practitioner exam and want one candidate's progression rather than the official syllabus. Do not treat it as a substitute for PortSwigger Academy itself, which the notes repeatedly point you back to for current material. Verify first that the labs it references still match the current Academy, since the notes were written against the 2023 exam, and note that the repository declares no license and has no releases, so there is nothing to pin.

Frequently asked questions

Official sources

1. botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study on GitHub
2. Issues
3. README