The OSCP Certification: What It Is and What to Expect

What Is the OSCP?

The Offensive Security Certified Professional (OSCP) is a penetration testing certification issued by OffSec (formerly Offensive Security). It is widely considered the gold standard entry-level certification for penetration testers, and it has held that reputation since its introduction in 2006.

What makes the OSCP different from most IT security certifications is its exam format. There are no multiple-choice questions. Instead, you're given 24 hours to hack into a set of target machines in a controlled network, followed by another 24 hours to write a professional penetration testing report documenting your findings. You either compromise the machines and prove it, or you don't. There's no guessing your way through.

The certification comes bundled with OffSec's PEN-200 course (formerly known as "Penetration Testing with Kali Linux" or PWK), which provides the training material and lab access needed to prepare for the exam.

Why the OSCP Matters

The cybersecurity certification market is crowded. CompTIA Security+, CEH, CISSP, and dozens of others compete for your attention and money. The OSCP stands out for one reason: it proves you can actually hack things.

Multiple-choice certifications test whether you can recognize correct answers. The OSCP tests whether you can find vulnerabilities, exploit them, escalate privileges, and document the entire process professionally. Hiring managers at security firms understand this distinction, which is why "OSCP preferred" or "OSCP required" appears on so many penetration testing job listings.

The certification also signals persistence. The exam is deliberately grueling. Completing it tells employers you can work under pressure, manage time across a long engagement, and produce deliverables when exhausted. These are real skills that matter in consulting and penetration testing work.

That said, the OSCP isn't magic. It won't guarantee you a job, and it's not the right certification for every security career path. If you want to work in security operations, incident response, or governance, other certifications are more relevant.

The PEN-200 (PWK) Course

The PEN-200 course is the training component that accompanies the OSCP exam. It covers the fundamentals of penetration testing methodology, from reconnaissance through exploitation and post-exploitation.

graph TD
    subgraph Course["PEN-200 Course Modules"]
        A[Penetration Testing Methodology] --> B[Information Gathering]
        B --> C[Vulnerability Scanning]
        C --> D[Web Application Attacks]
        D --> E[Buffer Overflow Attacks]
        E --> F[Client-Side Attacks]
        F --> G[Working with Exploits]
        G --> H[Antivirus Evasion]
        H --> I[Privilege Escalation]
        I --> J[Password Attacks]
        J --> K[Port Redirection and Tunneling]
        K --> L[Active Directory Attacks]
        L --> M[Report Writing]
    end
    subgraph Practice["Hands-On Components"]
        B --> P1[Lab Machines]
        D --> P2[Exercise Sets]
        I --> P3[Challenge Labs]
        L --> P4[AD Lab Sets]
    end

PEN-200 course structure - each module builds on the previous, with hands-on exercises throughout.

Course topics include:

• Penetration testing methodology and planning
• Information gathering and enumeration (passive and active reconnaissance)
• Vulnerability scanning with tools like Nmap and Nessus
• Web application attacks (SQL injection, file inclusion, file upload vulnerabilities)
• Buffer overflow attacks (Windows and Linux)
• Client-side attacks
• Finding and modifying public exploits
• Antivirus evasion techniques
• Privilege escalation (Windows and Linux)
• Password attacks and cracking
• Port redirection and SSH tunneling
• Active Directory enumeration and attacks
• Report writing

The course material is delivered through PDF/video modules and a set of exercises for each topic. OffSec updated PEN-200 significantly in recent years, adding more Active Directory content and modernizing the curriculum. The current version is substantially harder than the original PWK course.

A critical piece of advice: don't just read the material. Do every exercise. The exercises force you to apply concepts immediately, and the muscle memory you build is what carries you through the exam.

The Lab Environment

Your PEN-200 subscription includes access to a lab network containing dozens of vulnerable machines. These machines range from straightforward (exploit a known CVE, get root) to complex (require pivoting through multiple machines, cracking passwords, and chaining vulnerabilities).

The lab is designed to simulate a corporate network. Some machines have dependencies on others - you might need credentials found on one machine to access another. There are also "big four" machines that are notoriously difficult and considered a benchmark for exam readiness.

Lab time is limited by your subscription tier (30, 60, or 90 days, with extensions available). This creates time pressure that's actually useful - it forces you to be efficient rather than spending days on a single machine.

How many lab machines should you complete before attempting the exam? The common advice is at least 30-40 machines, including some medium-to-hard difficulty ones. If you can complete a lab machine from scratch in 2-4 hours without hints, you're likely ready to attempt the exam.

The 24-Hour Exam

The exam gives you 23 hours and 45 minutes to compromise a set of target machines and collect proof files. You then have an additional 24 hours to write and submit a penetration testing report.

The current exam format (as of the most recent updates) includes:

• Three standalone machines worth 20 points each (10 for user access, 10 for root/admin)
• One Active Directory set worth 40 points (a chain of machines in a domain environment)
• Bonus points (up to 10) for completing course exercises and lab report
• Passing score: 70 points

The exam is proctored via screen sharing and webcam. You can take breaks, eat, and sleep (though most people limit breaks to stay focused). You're allowed to use the internet for research but cannot use automated exploitation tools like sqlmap or Metasploit's autopwn (with limited exceptions - you can use Metasploit on one machine only).

The report is a critical component. Even if you compromise every machine, submitting a poor report can fail you. OffSec expects a professional document that includes screenshots, step-by-step reproduction instructions, and remediation recommendations - the same deliverable a real penetration testing client would receive.

Skills Tested

sequenceDiagram
    participant Student
    participant Target
    participant AD as Active Directory
    
    Note over Student,AD: Exam Timeline (23h 45m)
    
    Student->>Target: Port scanning and enumeration
    Target-->>Student: Open services identified
    Student->>Target: Web app testing / service exploitation
    Target-->>Student: Initial shell obtained
    Student->>Target: Local enumeration (LinPEAS/WinPEAS)
    Target-->>Student: Privilege escalation vector found
    Student->>Target: Escalate to root/admin
    Target-->>Student: Proof.txt captured (20 pts)
    
    Student->>AD: Enumerate domain from foothold
    AD-->>Student: Users, groups, policies mapped
    Student->>AD: Exploit AD misconfigurations
    AD-->>Student: Domain admin achieved (40 pts)
    
    Note over Student: 24h report writing period
    Student->>Student: Document findings with screenshots
    Student->>Student: Write remediation recommendations
    Student->>Student: Submit professional report

The OSCP exam flow - from enumeration through exploitation to professional reporting.

The exam tests a specific set of practical skills:

• Enumeration - Thorough port scanning, service identification, and information gathering. This is where most exam attempts are won or lost. Missing an open port or overlooking a service version can mean missing the entire attack path.
• Web application attacks - SQL injection, local/remote file inclusion, command injection, authentication bypasses, and other common web vulnerabilities.
• Public exploit identification and modification - Finding appropriate exploits for identified services and modifying them to work in the target environment. This isn't about running automated tools; it's about understanding exploit code well enough to adapt it.
• Privilege escalation - Identifying misconfigurations, vulnerable services, and escalation vectors on both Linux and Windows systems.
• Active Directory attacks - Enumerating domains, abusing trust relationships, exploiting Group Policy, Kerberoasting, AS-REP roasting, and lateral movement.
• Password attacks - Cracking hashes, password spraying, and credential reuse.
• Pivoting - Using compromised machines to reach otherwise inaccessible network segments.
• Report writing - Documenting everything in a clear, professional format.

How to Prepare

The PEN-200 course alone may not be enough, especially if you're new to security. Here's a practical preparation strategy:

Before starting PEN-200:

• Be comfortable with Linux command line (navigate directories, edit files, use common tools)
• Understand basic networking (TCP/IP, DNS, HTTP, common ports)
• Know how to write simple scripts in Python or Bash
• Complete at least 10-15 easy HackTheBox or TryHackMe machines

During PEN-200:

• Complete every course exercise, not just the ones that seem relevant
• Take detailed notes (many candidates use tools like Obsidian, CherryTree, or Notion)
• Document your methodology for each type of attack
• Complete at least 30 lab machines, taking notes on each one
• Practice the report format before the exam

Supplementary resources:

• TJ Null's OSCP-like HackTheBox machine list (widely regarded as the best supplementary practice)
• IppSec's YouTube walkthroughs (for methodology, not solutions)
• HackTricks (comprehensive cheat sheets for enumeration and exploitation)
• GTFOBins (for Linux privilege escalation via SUID/sudo misconfigurations)
• LOLBAS (Living Off the Land Binaries for Windows)

Realistic Timeline

How long does preparation take? It depends heavily on your starting point.

Complete beginner (no security experience): 9-12 months total. Spend 3-4 months on fundamentals (TryHackMe, OverTheWire, basic networking) before starting PEN-200. Then 3-4 months on the course and labs, plus 1-2 months of additional practice before the exam.

IT professional (sysadmin, network engineer): 4-6 months. You already understand networking and operating systems. Focus time on the offensive skillset - enumeration methodology, exploitation techniques, and privilege escalation.

Security professional (SOC analyst, security engineer): 3-4 months. You understand security concepts but may need to develop offensive skills. The transition from defensive to offensive thinking takes practice.

CTF player with experience: 2-3 months. CTF skills transfer well, especially web exploitation and binary knowledge. Focus on OSCP-specific methodology and the Active Directory component.

These timelines assume you can dedicate 15-20 hours per week to study. Working full-time while preparing is common but requires discipline. Burning out before the exam is a real risk - pace yourself.

Common Mistakes

Based on community feedback and publicly shared exam experiences, these are the most common reasons people fail:

• Insufficient enumeration. This is the number one cause of failure. People run a quick Nmap scan and start attacking the first thing they see instead of thoroughly mapping all services and potential attack surfaces. Run full port scans. Check UDP. Enumerate web directories thoroughly.
• Spending too long on one machine. If you're stuck for more than 2 hours, move on. You can come back later with fresh eyes. Time management is critical in a 24-hour exam.
• Not practicing report writing. Many people fail not because they didn't hack the machines but because their report was incomplete or poorly documented. Practice writing reports during your lab time.
• Relying too heavily on Metasploit. You can only use Metasploit on one machine. If all your lab practice used Metasploit, you'll struggle with the other machines. Learn to use manual techniques and standalone tools.
• Ignoring Active Directory. The AD set is worth 40 points. Skipping it effectively means you need perfect scores on the standalone machines to pass. Practice AD enumeration and attacks extensively.
• Poor sleep management. Some people try to stay awake for the entire 24 hours. This rarely works well. Planning a 2-3 hour sleep break (after setting up a notes system so you can resume efficiently) often leads to better results.

Cost Analysis

The OSCP isn't cheap:

• PEN-200 Course + 90 days lab access + exam attempt: $1,749 (the most popular package)
• PEN-200 Course + 365 days lab access + 2 exam attempts: $2,499 (Learn One subscription)
• Additional exam retake: $249
• Lab extensions: Available at additional cost

Factor in the opportunity cost of study time (hundreds of hours) and potentially supplementary resources (HackTheBox VIP subscription for practice machines, additional courses). The total investment including time can be substantial.

Many employers will sponsor OSCP certification for employees. If you're already working in IT or security, ask about training budgets before paying out of pocket.

Alternatives to Consider

The OSCP isn't the only hands-on security certification:

• eJPT (eLearnSecurity Junior Penetration Tester): Easier than OSCP, practical exam format, good stepping stone. Significantly cheaper. Good first certification.
• CPTS (HackTheBox Certified Penetration Testing Specialist): Newer but gaining recognition. Similar practical format to OSCP. Backed by HTB's content quality.
• PNPT (Practical Network Penetration Tester): TCM Security's certification. Covers external and internal pen testing with a practical exam and report. More affordable than OSCP.
• CRTP/CRTE (Certified Red Team Professional/Expert): Focused on Active Directory attacks. Excellent if you know AD is your career direction.
• GPEN (GIAC Penetration Tester): SANS-backed, well-recognized, but very expensive and less hands-on than OSCP.

If budget is a concern, consider eJPT or PNPT first. They build relevant skills at lower cost, and having them on your resume when applying for the OSCP shows commitment to the field.

Is It Worth It?

For penetration testing careers specifically, yes. The OSCP remains the most widely requested certification in penetration testing job listings. It opens doors that other certifications don't, particularly at security consulting firms and managed security service providers.

More importantly, the preparation process itself is valuable. The hundreds of hours you spend learning enumeration, exploitation, and privilege escalation build a skill set that directly applies to professional penetration testing. Many OSCP holders say they learned more during preparation than from any other single educational experience.

The certification doesn't expire (no renewal required), which means you invest once and carry it indefinitely. The knowledge will need updating as the field evolves, but the certification itself stays on your resume.

Is it worth it if you don't want to be a penetration tester? Probably not. Security architects, SOC analysts, compliance professionals, and security managers benefit more from certifications aligned with their specific career paths. The OSCP is a specialist certification for offensive security - treat it as such.

Whatever path you choose, the skills matter more than the certificate. Build your abilities through consistent practice, document your work, and the career opportunities will follow.

Building hands-on security skills before tackling the OSCP? The BLEShark Nano lets you practice WiFi auditing, handshake capture, and wireless reconnaissance - skills that complement your penetration testing toolkit.