Professional

Learning with Burp AT in Academy labs

• Last updated: November 5, 2026

• Read time: 3 Minutes

Burp AT can help you build your security testing skills as you work through Web Security Academy labs.

Ways to use Burp AT in the Academy

Burp AT can support your work on a lab, from exploring ideas to understanding your results. To get started, you could ask it to:

• Discuss your ideas to decide what to test next and what evidence to look for.

• Explore possible causes of an unexpected response and ways to investigate them.

• Attempt to solve a lab, then examine its approach and discuss its reasoning.

Using Burp AT with Web Security Academy labs

To work on a lab with Burp AT:

1. Go to Proxy > Intercept and click Open browser. Open your lab in Burp's browser so you can inspect its traffic in Burp.

2. In the same Burp project, click Burp AT in the top-right corner.

3. Tell Burp AT that you have a lab open and what you want help with. Include what you have tried and any observations you want to discuss.

Burp AT can usually identify the lab URL from your Proxy traffic. You can also supply the running instance URL to identify a specific lab. Use the URL from your running lab's browser tab, for example https://YOUR-LAB-ID.web-security-academy.net/.

If Burp AT needs to add the lab to scope, then it asks for your approval.

You can share relevant requests and responses to give Burp AT evidence from your investigation.

Using the Academy lab mentor skill

The Academy lab mentor skill guides how Burp AT helps you work through a lab.

When using the mentor skill, you attempt to solve the lab as you normally would and share your observations. Burp AT asks questions and offers small clues to help you work out your next step.

To use the skill, run /academy-lab-mentor.

Tell the mentor skill which lab you are working on and describe what you have tried. It can use your observations and lab traffic in Burp to help interpret results and tailor its questions and clues. You can share your running lab instance URL with Burp AT directly to help it identify relevant traffic. Burp AT can use the URL to check whether you have completed the lab at the end of the process.

After completing the lab

Once you have completed the lab, the mentor skill asks three open questions, one at a time. These explore why the vulnerability was possible, what evidence demonstrates it, and how the application could prevent it.

Answer using observations from your own tests. Use the discussion to identify what you would look for when testing another application for the same vulnerability.