PortSwigger Web Security Academy

What is PortSwigger Web Security Academy?

PortSwigger Web Security Academy is a free online training centre for web application security, created by PortSwigger, the company behind Burp Suite. It combines carefully written explanations with hundreds of interactive labs: real vulnerable applications deployed in the cloud for you, which you must exploit to solve the challenge. It is maintained by PortSwigger's research team, so new techniques are added regularly. For many professionals it is simply the best free resource there is for learning web hacking.

What the Web Security Academy is used for

• Learning web pentesting from scratch with a solid theoretical base.
• Preparing for bug bounty: many techniques from the labs show up in real programmes.
• Mastering Burp Suite, since the labs are designed to be solved with it.
• Preparing for the BSCP certification (Burp Suite Certified Practitioner), PortSwigger's hands-on exam.
• Training developers: each topic also explains how to prevent the vulnerability.

Getting started

1. Create a free account at portswigger.net. You need it to launch labs and save progress.
2. Install Burp Suite Community (free) or Professional and open its built-in browser.
3. Choose a topic, read the theory and open the first lab. Each lab states its goal (for example, "log in as administrator" or "delete the user carlos").
4. Once you solve it, the lab is marked as completed.

Labs are graded in three levels: Apprentice, Practitioner and Expert. The usual advice is to do all the Apprentice labs in a topic before moving on to Practitioner.

Recommended learning path

The academy offers its own learning path, but this order works well for most people:

1. Server-side fundamentals: SQL injection, authentication, path traversal, command injection, business logic, information disclosure, access control, file upload.
2. Advanced server-side flaws: SSRF, XXE, race conditions, NoSQL injection, API testing.
3. Client side: XSS, CSRF, CORS, clickjacking, DOM-based vulnerabilities, WebSockets.
4. Advanced topics: insecure deserialisation, SSTI, web cache poisoning, HTTP request smuggling, JWT, OAuth, prototype pollution, GraphQL and attacks on LLM-powered applications.

Practical example: an SQLi lab

In one of the first SQL injection labs, the shop filters products by category using a URL parameter. The approach is to intercept the request with Burp, send it to Repeater and check how the application reacts to special characters:

GET /filter?category=Gifts' HTTP/1.1

If a quote triggers an error, you try altering the query logic, for example by adding an always-true condition and commenting out the rest:

GET /filter?category=Gifts'+OR+1=1-- HTTP/1.1

From there the labs level up: UNION to extract data from other tables, blind injections based on conditions or timing, and out-of-band techniques. These techniques are only for the labs or for systems you are authorised to test.

Pro tips

• Attempt each lab without the solution for at least 30–60 minutes. Official solutions exist, but using them straight away wastes the lab.
• Keep notes of payloads and patterns: they will help with bug bounty and the exam.
• Use the "Mystery labs": the academy launches a random lab without telling you the vulnerability type, just like the real world.
• Some Expert labs depend on Burp Professional features (such as Collaborator). With Community you can do the vast majority.

Pros and cons

Pros	Cons
Completely free	Covers web security only
Excellent, up-to-date theory	Content in English only
Hundreds of real labs	Isolated labs per topic, not full scenarios
Seamless Burp Suite integration	The BSCP certification is paid

Alternatives and complements

• PentesterLab Pro: very hands-on paid web exercises, with a good focus on code review.
• Root-Me: free web challenges among many other categories.
• TryHackMe: guided rooms on the OWASP Top 10.
• HackTheBox: to apply what you learn on full machines.

Frequently asked questions

Is PortSwigger Web Security Academy free?

Yes, all content and labs are free with an account. Only the BSCP certification exam is paid.

Do I need Burp Suite Professional?

No. You can solve most labs with Burp Suite Community. Some advanced ones require Professional features.

What is the BSCP certification?

Burp Suite Certified Practitioner is a hands-on exam where you must exploit several applications within a time limit. It requires Burp Suite Professional; check the conditions and price on the PortSwigger website.

Where should I start in the Web Security Academy?

With the Apprentice labs for SQL injection, authentication and access control, then follow the official learning path.

If you want to strengthen the technical basics (terminal, HTTP, methodology) with hands-on exercises, the Hackers en Acción Academy will help.