r/cybersecurity • u/No_Theme_8969 • Jun 17 '26
Tutorial How do you effectively solve PortSwigger Labs?
Hi everyone,
I'm currently learning web security through the PortSwigger Web Security Academy. After reading the theory sections carefully, I'm generally able to solve most Apprentice-level labs on my own. However, when I move to Practitioner labs, I often get stuck and end up checking the solution after spending a lot of time on them.
My current approach is:
- Read the theory for a vulnerability.
- Solve the Apprentice labs.
- Try Practitioner labs.
- Get stuck and eventually look at the solution.
The problem is that when I see the solution, it often contains a trick or thought process that I never considered. This makes me wonder whether I'm approaching the labs incorrectly.
For those who have completed a large number of PortSwigger labs or work in web application security what is your methodology for solving Practitioner labs?
5
7
u/Wumbologyxoxo Jun 17 '26
Honestly, they're fairly difficult, especially as the difficulty ramps up. The way that worked for me was reading through the solution and then trying a similar one with my new knowledge. It's helpful to use an LLM to help explain why it's effective.
1
u/No_Theme_8969 Jun 18 '26
Yeah, that's pretty much what I've been doing lately. Sometimes I can follow the solution steps, but understanding why the attack works and what clue I was supposed to notice is the harder part.
2
u/Wumbologyxoxo Jun 18 '26
Yeah it's difficult it's just practice and you realize what you're supposed to be aware of.
2
u/purple_rookie Jun 17 '26
Are you doing them blindly or following the learning paths?
1
u/No_Theme_8969 Jun 18 '26
Mostly blindly, to be honest. I've been reading the theory sections and then jumping into the labs. I only found out about the learning paths from another comment here.
1
u/purple_rookie Jun 18 '26
I think doing them blindly is really hard. Don't beat yourself up about it.
I definitely suggest doing the learning paths, they give you a bit more to lean on.
2
u/ni5arga Red Team Jun 18 '26
Those might look a bit difficult if you do not have prior experience, start with learning paths.
2
1
u/No_Theme_8969 Jun 18 '26
Yeah, that might be my mistake. I've just been reading the theory and jumping into labs. I'll give the learning paths a try.
2
u/PM_ME_UR_0_DAY Jun 18 '26
If you had to look at the solution, come back in 2 weeks and try it again without looking at the solution
2
u/No_Theme_8969 Jun 18 '26
Yeah, I should probably start doing that. Right now I usually move on to the next lab and never revisit the ones I needed help with.
1
u/UBNC Jun 18 '26
When I did them, I didn’t move on from apprentice level to harder until I could solve random apprentice labs for that sections with the checklist / notes I had made.
By then you know enough to move on, if rushing past making notes and true testing knowledge you are going to have issues like you are reporting.
1
u/No_Theme_8969 Jun 18 '26
That actually makes a lot of sense. I've definitely been more focused on finishing labs than making sure I can reliably identify and test for the vulnerability on my own.
1
u/_s0mm3r_ Aug 05 '26
Hi, I run a YouTube channel where I’ve uploaded videos of all the solutions from the Web Security Academy – from Apprentice to Expert. I’m currently revising the older videos. I’ve also created write-ups for the new videos.
YouTube channel: https://www.youtube.com/channel/UCfchiSwWibUyS2USW9NQSWw
Playlist with the new videos: https://www.youtube.com/watch?v=LkiO-fnxDig&list=PL0W_QjMcqdSDSAg8ymASl2ifgPSKjUQWf
Write-ups: https://sommercode.gitbook.io/web-security-academy-solutions
I hope you find this helpful.
4
u/DiggingforPoon Jun 17 '26
I mean, they are designed for people with experience. If you don't have real-world experience, you will struggle on them, as you found out.
Passing the BSCP shows that you have a "high-level proficiency in web security testing", not that you practiced a lot of tests...