Complete a CTF Challenge and Publish a Methodology Write-Up

Proof required

Submit: screenshots of at least fifteen completed PortSwigger Web Security Academy labs (the completion badge for each, not just the lab page) spanning at least five vulnerability categories; a written lab journal (at least 100 words per lab) documenting the vulnerability, exploitation approach, and remediation; and evidence the labs were completed by you (your PortSwigger account username visible in the screenshots). A security practitioner, penetration tester, or CS lecturer with security experience must confirm the lab journal is accurate.

What gets checked

• At least fifteen PortSwigger labs completed across at least five vulnerability categories — screenshots showing completion badges
• Lab journal entries explain the exploitation approach, not just describe what the vulnerability is
• A security practitioner has confirmed the lab journal is accurate

Common mistakes

• Lab journal entries that describe what the vulnerability type is without explaining how the specific lab was exploited
• Screenshots showing the lab page without the completion confirmation — must show the completed state

Resources

What a verifier looks for

• Are at least fifteen labs complete across at least five categories — completion badges visible?
• Does each lab journal entry explain the exploitation approach — not just the vulnerability type?
• Ask: 'in the SQLi lab, what prevented you from using a boolean-based approach instead of error-based?' — tests genuine engagement with the lab

You'll sign in first, then come straight back here.

Proof required

Submit: timestamped working notes covering every phase of the penetration test (reconnaissance through cleanup); screenshots of the nmap scan output, the vulnerability identified, the exploitation step with terminal showing your controlled target IP (private range), and the post-exploitation privileges achieved; and a one-paragraph explanation of what access you achieved and what would have been the highest-risk next step. A security practitioner or penetration tester must confirm the methodology is sound.

What gets checked

• Working notes are timestamped and cover every phase — not a retrospective write-up after the fact
• Screenshots confirm the controlled target's private IP — proving you own the target
• A security practitioner has confirmed the methodology is sound

Common mistakes

• Testing on a target you do not own — all testing must be on systems in your controlled environment
• Retrospective documentation written after the test rather than timestamped working notes taken during it

Resources

What a verifier looks for

• Are working notes timestamped and cover every phase — not a retrospective write-up?
• Do screenshots confirm the controlled target's private IP?
• Ask: 'what would the highest-risk post-exploitation step have been, and why?' — tests understanding of the attack chain

You'll sign in first, then come straight back here.

Proof required

Submit: a professional penetration test report (at least 1,200 words) with executive summary, CVSS-scored findings with vector string and sub-score justification, proof of exploitation with screenshots and reproducing steps, and specific remediation recommendations; and a recording or transcript of a presentation to a security practitioner who challenged at least two severity ratings or remediations.

What gets checked

• CVSS scores include the vector string and sub-score justification — not just the overall score
• Reproducing steps are specific enough that a different person could follow them on the same target
• A security practitioner challenged at least two severity ratings in the documented presentation

Common mistakes

• CVSS scores without the vector string or without justifying individual sub-scores
• Reproducing steps that describe the general approach without the specific commands and inputs used

Resources

What a verifier looks for

• Do CVSS scores include the vector string with sub-score justification?
• Are reproducing steps specific enough to follow independently?
• Were at least two severity ratings challenged in the documented presentation?

You'll sign in first, then come straight back here.