BSCP Practice Test

BSCP practice test: what's covered

• SQLi
• XSS
• Access Control
• SSRF
• Deserialization
• JWT
• Request Smuggling
• Burp Repeater/Intruder/Collaborator

Free BSCP sample questions

1. During recon you map an application's attack surface. Burp's passive crawler found /admin returns 401, but a JavaScript file references the path /admin-panel-7f3a. After visiting it directly the page loads. Which Burp feature most directly helped you discover this hidden endpoint?

   • A. Reviewing the JavaScript responses surfaced by the target's site map and the 'Linked from' analysis
   • B. Brute-forcing the path with Intruder using a sniper attack on the Host header
   • C. Sending the request to Sequencer to analyse token entropy
   • D. Enabling the Collaborator client to capture out-of-band DNS
   Show answer

   Correct: A. Client-side JavaScript often references endpoints that are not linked from rendered HTML; Burp surfaces these in the site map and shows where each item was linked from. Sequencer analyses token randomness, Collaborator captures OOB interactions, and the Host header is unrelated to path discovery.

2. An application returns a verbose stack trace when you submit a malformed parameter: HTTP/1.1 500 Internal Server Error ... org.apache.struts2.dispatcher... at com.acme.shop.OrderServlet.java:142 What is the primary value of this information disclosure to an attacker?

   • A. It reveals the backend technology and code paths, narrowing which exploits to attempt
   • B. It proves the server is vulnerable to SQL injection
   • C. It confirms the session cookie lacks the HttpOnly flag
   • D. It indicates the WAF has been disabled
   Show answer

   Correct: A. Verbose errors leak the framework (Struts/Java) and class names, letting an attacker fingerprint the stack and choose technology-specific attacks. A stack trace alone does not prove SQLi, cookie flags, or WAF state.

3. You want to find files and directories that are not linked anywhere in the app. Which approach using Burp is most appropriate for content discovery without an external wordlist tool?

   • A. Use Burp's 'Discover content' (engagement tools) session to spider and guess paths from a built-in list
   • B. Use Sequencer to enumerate directory names
   • C. Use Comparer to diff two responses
   • D. Use the Decoder to expand the URL into candidate paths
   Show answer

   Correct: A. Burp's 'Discover content' engagement tool performs recursive content discovery using built-in and learned wordlists. Sequencer, Comparer and Decoder serve token analysis, response diffing and encoding respectively.

4. While fingerprinting a target you want to identify the technology stack and possible WAF. Which TWO signals are reliable indicators worth recording during recon? (Choose TWO)

   • A. Response headers such as Server, X-Powered-By and Set-Cookie naming conventions (e.g. PHPSESSID, JSESSIONID)
   • B. Distinctive error pages and framework default paths (e.g. /actuator, /wp-login.php)
   • C. The exact CPU model of the origin server
   • D. The colour scheme of the login page
   • E. The number of words in the page footer
   Show answer

   Correct: A and B. Server/X-Powered-By headers, cookie names and framework default paths reliably fingerprint the stack. CPU model, colour scheme and footer word count carry no security-relevant fingerprint value.

5. A login form responds differently for valid vs invalid usernames: Invalid user → 'Invalid username' Valid user, wrong password → 'Incorrect password' Which attack does this design directly enable, and which Burp tool best automates it?

   • A. Username enumeration via Intruder using the differing response messages/lengths as the criterion
   • B. Session fixation via Repeater by reusing the session cookie
   • C. Clickjacking via the Burp browser's frame buster
   • D. CSRF via Intruder pitchfork on the CSRF token
   Show answer

   Correct: A. Distinct error messages let an attacker enumerate valid usernames; Intruder automates the wordlist and flags differing responses by length or content. The other options describe unrelated attacks.

Last updated: 2026-10-19

BSCP practice test FAQ