# A Burp practitioner candidate's notes, organised by exploit stage > This repository is one person's study notes for the PortSwigger Burp Suite Certified Practitioner exam, written while working through more than 110 Academy labs and arranged around scanning and three labelled stages. It is a notebook with payload and wordlist attachments, not a tool, and its value is the sequencing rather than anything you can install. **botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study** — Burp Suite Certified Practitioner Exam Study - Repository: https://github.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study - Stars: 1,500 · Forks: 383 - Language: Python - License: not declared - Published: 2026-10-16 · Updated: 2026-10-16 · Language: en - Canonical page: https://hysenlabs.com/projects/botesjuan-burp-suite-certified-practitioner-exam-study ## The table of contents mirrors the exam structure The organisation of the notes is the first thing worth noticing, because it is not alphabetical by vulnerability class. It groups scanning separately, then labels Foothold, Privilege escalation and Data exfiltration as stages 1, 2 and 3. Scanning covers enumeration, split into focus scanning and scanning non-standard data structures. Foothold, labelled stage 1, holds content discovery, DOM-based XSS, cross-site scripting, web cache poisoning, host headers, HTTP request smuggling, brute force and authentication. Privilege escalation, stage 2, holds CSRF account takeover, password reset, SQL injection, JWT handling, prototype pollution, API testing, access control, GraphQL endpoints and CORS. Data exfiltration, stage 3, holds XXE, SSRF, server-side template injection, server-side prototype pollution, file path traversal, file uploads, deserialization and OS command injection. Each vulnerability entry follows a recognisable shape: a one or two line explanation in the author's words, a screenshot from the lab, sometimes a request payload, and a link to the specific PortSwigger lab. That consistency makes the repository usable as a checklist, walking top to bottom and ticking off what you have hands-on experience with rather than having read about. The appendix holds a Python scripts section, a payloads directory with its own README, a wordlists directory, notes on focus target scanning, a description of the author's approach, and a section of exam tips. ## Scanning narrowly is the first lesson The scanning section is short, and the reason is stated plainly: engagements and the exam run on a tight time limit, so you scan defined insertion points for specific requests rather than pointing an automated scan at the whole target. The first lab demonstrates the payoff. The scanner reports an XML injection vulnerability on a storeId parameter, and the note records that this lead is what allowed reading a file on the server. The payload shown is an XInclude document pointing at a local file path: ```xml ``` The second payload is described as an out-of-band XInclude request using a hosted DTD. Both are one line, and the note's value is in the sequence: run a targeted scan, read what the scanner reports, then hand-craft. The second lab covers non-standard data structures, where an insertion point sits somewhere other than a parameter, inside selected text in a request or response. Here the scanner finds the issue and the author takes it further manually. If you take one habit from this section, it is narrowing the scan scope to insertion points you have already found, which is the time-conscious approach the notes recommend. ## Content discovery: wordlists, robots.txt and version control The content discovery entry is the most directly reusable part of the repository, because it ships the wordlist it uses. The author downloads the compiled list from the repository's own wordlists directory and runs it through ffuf against the target: ```bash wget https://raw.githubusercontent.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study/main/wordlists/burp-labs-wordlist.txt ffuf -c -w ./burp-labs-wordlist.txt -u https://TARGET.web-security-academy.net/FUZZ ``` The same list can be loaded into Burp's engagement tools content discovery feature as a custom file list, which is the practical note for anyone who wants one wordlist working in both tools. The entry also mentions checking `robots.txt` and `sitemap.xml`, which frequently reveal paths. The second half of that entry covers a different kind of disclosure: recovering information from a version control history. It downloads the `.git/` directory of the target and then inspects the cloned repository locally, in the example with `git-cola`, using an undo-last-commit view to read an admin password out of a diff. The lesson is that a leaked repository is an information disclosure finding even when the working tree looks clean, and the tooling shown is ordinary desktop git tooling rather than anything exotic. Both approaches are cheap, and in a timed engagement they are the ones to run before anything heavier. ## What this repository is not It helps to be precise, because the topic list in the repository metadata could be read as a toolkit. It is a set of notes. The author describes them as study notes covering more than 110 PortSwigger Academy labs, written while preparing for the 2023 certification, and repeatedly redirects readers to PortSwigger Academy for the latest learning materials. There is no scanner, no automation framework and no code that targets anything by itself. The `code/` and `python/` directories hold the scripts the author wrote for specific labs, and the `payloads/` directory holds the request snippets quoted in the notes. That also means the ceiling is the ceiling of one person's preparation. The notes record what worked in Academy labs, on applications built to be vulnerable in specific ways. A lab is designed so a particular technique produces a particular result; a real application under a real engagement rarely cooperates that precisely, and the repository does not claim otherwise. Two further limits are worth stating. The licence is not declared: there is no LICENSE file among the top-level entries, which means there is no stated permission to reuse the wordlists or payloads even though they are downloadable. And the repository has no releases, so there is no version to pin and no upgrade path, only commits on the main branch. The last push was on 2026-08-19, so the notes are being touched, but the material is pinned to a 2023 exam. ## Conclusion Adopt this repository as a checklist and a source of lab wordlists if you are preparing for the PortSwigger Burp Suite Certified Practitioner exam and want one candidate's progression rather than the official syllabus. Do not treat it as a substitute for PortSwigger Academy itself, which the notes repeatedly point you back to for current material. Verify first that the labs it references still match the current Academy, since the notes were written against the 2023 exam, and note that the repository declares no license and has no releases, so there is nothing to pin. ## FAQ ### What is this repository for? It is study notes for the PortSwigger Burp Suite Certified Practitioner exam, written while working through more than 110 PortSwigger Academy labs, with a link to the author's own certification. ### How is the study material organised? By test stage rather than alphabetically: scanning and enumeration, then foothold (stage 1), privilege escalation (stage 2) and data exfiltration (stage 3), followed by an appendix of scripts, payloads, wordlists and exam tips. ### Can I use the wordlists in this repository? The wordlists directory is downloadable and the notes show it being used with ffuf and with Burp's content discovery, but the repository declares no license, so there is no stated permission for reuse beyond reading it. ### Is this a penetration testing tool? No. It is a notebook of notes, screenshots, payload snippets and wordlists from lab work, not an automated tool. The repository itself directs readers to PortSwigger Academy for current learning materials. ## Sources - [botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study on GitHub](https://github.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study) - [Issues](https://github.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study/issues) - [README](https://github.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study/blob/main/README.md) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/botesjuan-burp-suite-certified-practitioner-exam-study