BSCP vs CBBH
Two web exams that come up together — how they actually differ, and who each one is for.
Both are affordable, beginner-to-intermediate web certs with heavy overlap. BSCP is the cheaper, faster pick: $99, a four-hour auto-graded exam, no report, backed by PortSwigger's free Web Security Academy. CBBH costs more — a roughly $490 HTB subscription — and adds a seven-day exam plus a full written report, leaning toward bug-bounty methodology. Pick BSCP for value; CBBH for report-writing practice.
- BSCP
- intermediate, $99 exam fee, plus an active Burp Suite Pro licence (separate annual cost)
- CBBH
- intermediate, $490/yr Silver Annual (bundles the voucher)
- Harder
- about equal
| BSCP | CBBH | |
|---|---|---|
| Vendor | PortSwigger | Hack The Box |
| Level | intermediate | intermediate |
| Duration | 4-hour exam | 7-day exam |
| Format | exploit two vulnerable web apps in three stages each; auto-graded, no report | hands-on web exploitation + commercial report; renamed HTB CWES in Oct 2025 |
| Cost | $99 exam fee, plus an active Burp Suite Pro licence (separate annual cost) | $490/yr Silver Annual (bundles the voucher) |
What each one is
BSCP (Burp Suite Certified Practitioner) is PortSwigger’s entry-level web credential. It sits on top of the free Web Security Academy, and the exam is auto-graded: two deliberately vulnerable applications, three stages each, four hours, no write-up. CBBH (Certified Bug Bounty Hunter) is Hack The Box’s beginner-to-intermediate web cert, built around its Bug Bounty Hunter job-role path. Its exam runs in a live environment for up to seven days and ends with a professional penetration-test report. HTB has since rebranded CBBH as CWES (Certified Web Exploitation Specialist), but the syllabus and exam are the same thing under a new name.
The real difference
Both cover the same web fundamentals — injection, broken access control, authentication flaws, SSRF — and people who hold both describe the overlap between the courses as extensive. The split is in what each one measures. BSCP tests whether you can find and chain known vulnerability classes quickly under a clock, then grades you automatically. CBBH tests the same finding skills but adds the part BSCP skips entirely: documenting what you found in a client-ready report. If you want the discipline of writing up findings the way a real engagement demands, CBBH forces it. If you just want to prove you can exploit, BSCP is the more direct signal.
Cost and time
BSCP is the cheapest respected web cert going: the $99 fee covers the exam and a Burp Suite Professional licence for it, and every bit of study material is free. The certification stays valid for five years. CBBH is pricier — access comes through an HTB subscription (around $490 for the annual tier that includes the exam voucher), which also unlocks the training modules you study from. Budget on weeks of lab time for either; both reward hands-on practice far more than reading.
Which one to choose
Choose BSCP if cost and speed matter, you already live in Burp, or you want a low-risk first certification — it is hard to beat for $99. Choose CBBH if you are aiming at bug bounty or a junior appsec role where writing a coherent report is part of the job, and you want a credential that proves you can deliver one. A common path is BSCP first, for the cheap skills check, then CBBH (now CWES) for the reporting practice. Neither is a capstone; both are stepping stones toward heavier white-box exams like OSWE or CWEE.
What people who sat these say
Both are targeted at web application penetration testing, and the overlap between the courses is extensive.
Solving machines on Portswigger helped me get things moving in the exam when I decided to look at my BSCP records.
Full detail on each: BSCP · CBBH. For where both sit in a longer plan, see the roadmap.