We recently launched the Burp challenge, to give our customers a unique opportunity to demonstrate their skills with Burp Suite Professional. Not only that, but the challenges involved put your web vulnerability skills and knowledge, recon, and efficiency to the test.

To keep things fun along the way, we're also introducing unique mini challenges every week. If you complete the mini challenge, within the given time frame, you'll be entered into a prize draw to win exclusive Burp Suite swag.

How does the Burp challenge work?

If you can complete all four stages of the Burp challenge, by 31 December 2022, you'll be awarded an exam credit for our Burp Suite Certified Practitioner certification completely free of charge. That's because by completing all four stages, we believe you're well and truly prepared to take and pass the exam.   

Stage one - complete one practitioner-level lab from each of the required topics.

Stage two - complete eight specific labs.

Stage three - complete five different practitioner-level mystery labs.

Stage four - take and pass the practice exam.

The mini challenges

Launch date: Friday 11 November.
Challenge: Complete the new discovering vulnerabilities quickly with targeted scanning lab within 10 minutes, by Thur 17 November, to be entered into the prize draw.
Closing date: Thursday 17 November (CLOSED).
Winners: Congratulations to our five mini challenge winners this week. Mika, Bennie, @unactionjackson, @Mi1So, and Tijmen.

Launch date: Friday 18 November.
Challenge: Solve three mystery lab challenges, all at "Practitioner" level or higher, by Thursday 24 Nov, to be entered into the prize draw.
Closing date: Thursday 24 November (CLOSED).
Winners: Congratulations to our five mini challenge winners this week. Dillan, Khong, Konstantin, Sanket, and Maksym.

Launch date: Friday 25 November.
Challenge: Complete the SQLi with filter bypass via XML encoding lab, and the blind SQLi with out-of-band data exfiltration lab, by Thur 1 Dec, to be entered into the prize draw.
Closing date: Thursday 1 December (ACTIVE).
Winners: Chosen on Mon 5 Dec at 3pm (GMT).

Launch date: Friday 2 December.
Challenge: Complete one "Practitioner" level lab from each of these topics - CSRF, Clickjacking, CORS, XXE, DOM-based vulnerabilities - by Thursday 8 December, to be entered into the prize draw.
Closing date: Thursday 8 December (UPCOMING).
Winners: Chosen on Mon 12 December at 3pm (GMT).

Launch date: Friday 9 December.
Challenge: Complete these five specific labs, by Thurs 15 Dec, to be entered into the prize draw. Specific labs to complete: exploiting XSS to steal cookies, forced OAuth profile linking, brute-forcing a stay-logged-in cookie, exploiting HTTP request smuggling to capture other user's requests, SSRF with blacklist-based input filter.
Closing date: Thursday 15 December (UPCOMING).
Winners: Chosen on Mon 19 December at 3pm (GMT).

Launch date: Friday 16 December.
Challenge: Complete one "Practitioner" level lab from each of these topics - OS command injection, Server-side template injection, WebSockets, Access control vulnerabilities, directory traversal - by Thursday 22 December, to be entered into the prize draw. 
Closing date: Thursday 22 December (UPCOMING).
Winners: Chosen in the new year (January 2023).

Launch date: Friday 23 December.
Challenge: Complete one "Practitioner" level lab from each of these topics - Web cache poisoning, Insecure deserialization, Information disclosure, Business logic vulnerabilities, HTTP Host header attacks - by Thursday 29 December, to be entered into the prize draw. 
Closing date: Thursday 29 December (UPCOMING).
Winners: Chosen in the new year (January 2023).

Your challenge progress