PortSwigger Web Security Academy: Beginner's Guide (2026)

What Is the PortSwigger Web Security Academy?

The PortSwigger Web Security Academy is a free online training platform for web application security, created by PortSwigger, the company that makes Burp Suite. It teaches vulnerability classes such as SQL injection, XSS and SSRF through written lessons paired with interactive labs: real, deliberately vulnerable web apps that you exploit to mark the lab as solved.

The content is written by PortSwigger's research team, the same people who publish new attack techniques at conferences like Black Hat. That is why it goes deeper than most free material. The SQL injection topic alone has 16 labs, and cross-site scripting has 30.

What the Academy Covers

The Academy's topic list currently has 31 entries. Grouped roughly by how a beginner should meet them:

• Server-side classics: SQL injection, authentication, path traversal, OS command injection, business logic flaws, information disclosure, access control, file upload, SSRF, XXE, NoSQL injection, API testing and race conditions.
• Client-side: cross-site scripting, CSRF, CORS, clickjacking, DOM-based vulnerabilities and WebSockets.
• Advanced: HTTP request smuggling, web cache poisoning and deception, insecure deserialization, server-side template injection, prototype pollution, OAuth, JWT attacks, GraphQL, HTTP Host header attacks and web LLM attacks.
• Essential skills: a short topic on working faster with Burp, which is worth doing once you have a few labs behind you.

New topics keep appearing. Web LLM attacks and web cache deception are among the newer additions, so the Academy tracks what attackers do today, not what they did in 2015.

Is PortSwigger Academy Really Free?

Yes. PortSwigger describes the Academy as "100% free", and that holds up: every lesson, every lab and every official solution is available with a free account. There is no paywall halfway through a topic and no trial that expires.

Money only enters the picture in three places:

• Burp Suite Professional ($499): most labs are solvable with the free Community Edition. A handful need Burp Collaborator, which ships with Professional. The Academy's firewall blocks lab traffic to arbitrary external servers, so for those out-of-band labs a free alternative does not work. Skip them as a beginner.
• Burp Intruder speed: Community Edition only includes a demo version of Intruder, the brute-force and fuzzing tool. Labs that need you to try a few hundred passwords are slow but still possible.
• The BSCP certification ($99): optional, and it requires an active Burp Suite Professional license on top. More on that below.

Our take: do not buy anything until you have solved at least 50 labs on Community Edition. By then you will know whether web security is your thing, and the Pro-only labs will be the only ones left blocking you.

How the Labs Work

Each topic page reads like a short textbook chapter, with lab links embedded where they fit. When you click "Access the lab", the Academy spins up a private copy of a vulnerable web app just for you, usually a fake online shop or blog, on its own subdomain. The lab description tells you the goal, and the banner at the top flips to "Solved" the moment you achieve it.

Apprentice, Practitioner and Expert

Every lab carries one of three difficulty labels:

• Apprentice: the textbook case. The lesson right above it tells you almost exactly what to do. Most take 5 to 15 minutes.
• Practitioner: a real step up. You get the bug class but have to work out where it hides, chain two ideas, or handle a filter. PortSwigger expects you to beat these before attempting its certification.
• Expert: research-grade. Some are hard for working professionals. Leave them alone for your first few months.

The Lab Conventions You Will See Everywhere

A few recurring details confuse new players, so here they are up front:

• wiener:peter is your own test account in labs that give you one. Log in with it to see what a normal user sees.
• carlos is the usual victim. Many labs are solved by deleting his account or stealing his data.
• administrator is the account you are usually trying to become.
• The exploit server is a page PortSwigger hosts for you in client-side labs (XSS, CSRF, clickjacking). You put your malicious HTML there and "deliver" it to a simulated victim.

Solutions, Community Videos and Mystery Labs

Under every lab sits a collapsed official solution, plus links to community video walkthroughs by creators such as Rana Khalil, z3nsh3ll and Michael Sommer. Rana Khalil's videos in particular are famous among beginners because she explains why each step works, not just what to type.

Once you know a topic, the mystery lab challenge serves you a random lab with no title or description, so you have to figure out the bug yourself. That is much closer to real testing, and to the certification exam. The Academy also keeps a Hall of Fame: the first users to solve each newly released lab get their name listed and some Burp swag.

Setting Up: Burp Suite Community and the Built-In Browser

You can solve a few Apprentice labs with nothing but the address bar, but you will need an intercepting proxy within the first hour. Burp Suite Community Edition is free, and setup takes about five minutes:

1. Download and install Burp Suite Community Edition from PortSwigger's site. The installer bundles its own Java runtime.
2. Start a temporary project with Burp's default settings. Community Edition cannot save projects, so do not worry about that screen.
3. Open Burp's browser from the Proxy tab ("Open browser"). It is a Chromium build that already trusts Burp's certificate, so you skip the proxy and certificate setup that trips up most beginners.
4. Log in to the Academy inside that browser, open a lab, and watch the requests appear in Proxy > HTTP history.

If you want the longer tour of Proxy, Repeater and Intruder first, our Burp Suite tutorial for beginners walks through each tool with screenshots of what to expect.

Your First PortSwigger Lab, Step by Step

Start with the very first SQL injection lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data. The lab description tells you the app runs a query like this when you pick a product category:

SELECT * FROM products WHERE category = 'Gifts' AND released = 1

Your goal is to make the shop display unreleased products, the ones with released = 0.

1. Find the input: click any category in the shop. In Burp's HTTP history you will see a request like GET /filter?category=Gifts.
2. Send it to Repeater: right-click the request and choose "Send to Repeater". This lets you edit and resend it as many times as you like.
3. Break the query: change the parameter to category=Gifts' and send it. A single quote that causes a server error is the classic first sign of SQL injection.
4. Inject the payload: change it to category=Gifts'+OR+1=1-- and send. The + signs are URL-encoded spaces.
5. Load it in the browser: paste the same URL into Burp's browser. The page lists every product, and the lab banner turns to "Solved".

Why it works: the query becomes WHERE category = 'Gifts' OR 1=1--' AND released = 1. Since 1=1 is always true, every row matches, and the -- comments out the released = 1 check entirely. You did not guess anything. You read the query, then rewrote its logic.

The next lab, SQL injection vulnerability allowing login bypass, uses the same idea on a login form: a username of administrator'-- comments out the password check. Two labs in, you have learned the single most famous web attack there is. For the wider picture, including UNION and blind techniques, our SQL injection tutorial goes further than the first Academy labs do.

A Beginner Route Through the Academy

PortSwigger now offers curated learning paths, and they are a reasonable default. But the biggest beginner mistake is working through the topic list top to bottom and hitting request smuggling in week two. Here is the order we recommend, doing only Apprentice labs in each topic before moving on:

1. SQL injection: the cleanest introduction to "my input changed the server's logic". The Apprentice labs are short and satisfying.
2. Authentication: username enumeration, broken 2FA and password reset flaws. It teaches you to read responses closely, including tiny differences in error messages.
3. Path traversal: only a few labs, and the idea (../../../etc/passwd) sticks forever.
4. Access control: the most common real-world bug class. Changing an ID, a cookie value or a hidden form field is all most of these need.
5. OS command injection and file upload: your first taste of running code on the server.
6. Cross-site scripting: do the reflected and stored Apprentice labs. Leave the DOM-based and Practitioner XSS labs for your second pass, because XSS has 30 labs and it is easy to drown in them.
7. SSRF: a short, modern topic that shows up constantly in cloud bug bounty reports.

After that, go back to the start and do the Practitioner labs in the same seven topics. Only then branch out to CSRF, XXE, business logic, and the advanced list. Request smuggling, cache poisoning and prototype pollution are brilliant, but they assume you already think in raw HTTP requests.

A sensible pace: five Apprentice labs a week while working or studying full time. In practice, one topic per weekend is a pace that survives a busy month, and at that rate the seven-topic core takes about two months. Trying to finish the whole Academy in a month is how people burn out somewhere in the middle of XSS.

Is PortSwigger Academy Good for Beginners?

Yes, with one caveat: it assumes you already understand how the web works. The lessons do not explain what an HTTP request is, how cookies keep you logged in, or what a 302 redirect does. If those terms feel fuzzy, spend a week on web fundamentals first or the Apprentice labs will feel like magic tricks instead of lessons.

What it does very well:

• Accuracy: the material is technically exact and current, written by people who find these bugs for a living.
• Lesson-then-lab rhythm: you read about a bug and exploit it within the same five minutes, which is how it sticks.
• Realistic tooling: you learn on Burp Suite, the same proxy professional web testers use daily.

Where beginners struggle:

• No hints between "nothing" and "full solution": most labs give you either the description or the complete answer. There is rarely a nudge in the middle.
• Dense text: some topic pages are long walls of explanation. Read the section, do the lab, come back. Do not read a whole topic in one sitting.
• The Practitioner jump: Apprentice labs follow the lesson almost word for word. Practitioner labs expect you to adapt, and the difficulty step is steep.

Our rule for the solutions: give every lab 20 honest minutes before you open the answer. If you still need it, read only the first step, close it, and try again. Reading the full solution and copying it gets the lab marked solved, but you will not be able to repeat it next week.

Burp Suite Certified Practitioner (BSCP): Is It Worth It?

The Academy leads into PortSwigger's own certification, the Burp Suite Certified Practitioner. According to PortSwigger's certification pages, the format looks like this:

• Price: $99 per exam attempt. A retake means buying another exam.
• Format: four hours, two vulnerable applications, each completed in three stages. You must actually exploit each bug to progress, not just detect it.
• Requirements: an active Burp Suite Professional license (Community Edition is not allowed), plus a webcam and microphone for the automated ID check.
• Practice exam: free, unlimited attempts, two hours, one application.
• Validity: five years once you pass.

PortSwigger's own advice is to complete every lab labeled Practitioner or lower without needing the solutions before attempting it. Take that literally. The exam does not tell you which vulnerability class you are looking at, which is why mystery labs are the best preparation.

Is it worth it? For a beginner, not yet. Total cost is $99 plus a year of Burp Pro, and the exam is pitched at people who already test web apps. Once you have cleared the Practitioner labs, though, it is one of the cheapest hands-on certifications with real credibility among web testers, and it pairs well with a bug bounty profile. Until then, the free Academy itself is the asset.

PortSwigger Academy vs Other Free Ways to Learn Web Hacking

The Academy is not the only free option, and it is not the best first step for everyone. Here is how it compares with the alternatives beginners usually weigh:

These work best together. The Academy is the textbook: it teaches each bug in isolation. OWASP Juice Shop is the realistic app where nobody tells you what the bug is. CTF-style labs make you chain recon, exploitation and privilege escalation into a full attack. Most good web testers have done all three.

Legal and Ethical Considerations

• Attack the lab, not the platform: your target is the lab subdomain you were given. Do not scan or fuzz portswigger.net itself or other users' lab instances.
• Keep payloads inside the Academy: the exploit server and Burp Collaborator exist so your attacks stay contained. Do not point exploit code at real third-party sites.
• Do not reuse techniques on live sites: adding ' OR 1=1-- to a real shop's URL "just to see" is unauthorized testing in most countries. Use bug bounty programs, with their written scope, when you want real targets.
• Respect the exam rules: BSCP is open book, but sharing exam content or solutions breaks PortSwigger's terms and devalues everyone's certificate.

Frequently Asked Questions