OSCP (OFFENSIVE SECURITY CERTIFIED PROFESSIONAL) / STUDY GUIDE Give your study a direction.
Build knowledge that lasts.
Pass the OSCP exam with proven study strategies. Master penetration testing skills and lab preparation to get certified.
Published by PrepForCerts · Editorial responsibility and sources
How to Pass the OSCP Exam
Current exam and certification facts
The OSCP+ exam is a hands-on penetration test, not a multiple-choice question bank. Allow 23 hours and 45 minutes for the practical and a further 24 hours to submit the report. You need 70 points out of 100 and the required documentation. Bonus points were removed in November 2024. The OSCP credential remains valid for life. The separate OSCP+ designation expires after three years unless you meet current OffSec maintenance and renewal requirements. Loss of the + designation does not remove the lifetime OSCP credential.
Study schedules below are planning examples. Confirm current fees, exam delivery, and eligibility with the provider before booking.
Master penetration testing skills and conquer the most respected offensive security certification with our comprehensive study guide.
Start OSCP Practice TestThe Offensive Security Certified Professional (OSCP) is widely considered the gold standard for penetration testing certifications. Unlike traditional multiple-choice exams, the OSCP is a hands-on, practical assessment that tests your ability to identify vulnerabilities and exploit systems in a controlled environment. This guide will help you prepare effectively and pass on your first attempt.
Understanding the OSCP Exam
Before diving into preparation, understand what makes the OSCP unique:
- Duration: 23 hours and 45 minutes of active testing
- Format: Practical penetration testing in a VPN-connected lab
- Passing Score: 70 points out of 100
- Report: Professional penetration testing report required within 24 hours
- Machines: Multiple target machines with varying difficulty
Prerequisites and Foundation
Before starting OSCP preparation, ensure you have:
Technical Prerequisites
- Solid understanding of TCP/IP networking
- Linux command-line proficiency
- Basic Windows administration knowledge
- Scripting skills in Python and Bash
- Understanding of common vulnerabilities
Recommended Prior Experience
- CompTIA Security+ or equivalent knowledge
- Hands-on experience with virtual machines
- Familiarity with penetration testing tools
- Practice on platforms like HackTheBox or TryHackMe
Study Plan: 4-6 Month Timeline
Month 1-2: Foundation Building
- Complete PEN-200 course materials
- Set up your attack environment (Kali Linux)
- Master enumeration techniques
- Practice basic exploitation methods
- Learn privilege escalation fundamentals
Month 3-4: Lab Practice
- Work through PWK lab machines systematically
- Document every machine thoroughly
- Develop your methodology
- Practice buffer overflow exploitation
- Master Active Directory attacks
Month 5-6: Exam Preparation
- Complete as many lab machines as possible
- Practice report writing
- Time yourself on full penetration tests
- Review weak areas
- Practice with Proving Grounds machines
Essential Skills to Master
1. Enumeration
Enumeration is the foundation of successful penetration testing. Master these techniques:
- Network scanning with Nmap
- Service enumeration and fingerprinting
- Web application enumeration
- SMB, SNMP, and other protocol enumeration
- Directory and file bruteforcing
2. Exploitation
Develop proficiency in various exploitation methods:
- Web application attacks (SQL injection, file inclusion, etc.)
- Buffer overflow exploitation
- Password attacks and credential reuse
- Client-side attacks
- Using Metasploit effectively
3. Privilege Escalation
Master both Windows and Linux privilege escalation:
- Linux enumeration scripts (LinPEAS, LinEnum)
- Windows enumeration (WinPEAS, PowerUp)
- Kernel exploits
- Service misconfigurations
- SUID/SGID and DLL hijacking
Pro Tip: Try Harder
The OSCP motto "Try Harder" isn't just a slogan—it's a methodology. When you're stuck, enumerate more, research deeper, and try different approaches. Never give up on a machine without exhausting all possibilities.
Exam Day Strategy
Before the Exam
- Get adequate sleep the night before
- Prepare your snacks and drinks
- Test your VPN connection and tools
- Have your report template ready
- Set up your note-taking system
During the Exam
- Start with thorough enumeration of all targets
- Begin with machines you feel confident about
- Take breaks to avoid burnout
- Document everything as you go
- Don't spend too long on any single machine
Critical: Documentation
Take screenshots of EVERY step. Your report is worth significant points, and you cannot recreate screenshots after the exam ends. Document proof of exploitation, IP addresses, timestamps, and all commands used.
After the Exam
- Write your report immediately while details are fresh
- Use a professional format and clear structure
- Include all required proof elements
- Proofread carefully before submission
Recommended Resources
- PEN-200 Course: The official Offensive Security course
- Proving Grounds: Practice machines from OffSec
- HackTheBox: Additional practice machines
- TryHackMe: Guided learning paths
- IppSec YouTube: Excellent walkthrough videos
- PrepForCerts: Practice questions for theory knowledge
Common Mistakes to Avoid
- Insufficient enumeration: Most failures come from missing something obvious
- Not documenting: Poor documentation leads to failed reports
- Tunnel vision: Getting stuck on one approach or one machine
- Ignoring the basics: Complex exploits are rarely needed
- Poor time management: Spending too long on difficult machines
- Skipping the course material: The PEN-200 materials are essential
Frequently Asked Questions
How long should I prepare for the OSCP exam?
Most candidates spend 3-6 months preparing for the OSCP, depending on prior experience. The PEN-200 course includes 90 days of lab access, and many candidates extend this to fully practice all techniques.
What is the OSCP exam format?
The OSCP exam is a 23-hour and 45-minute practical exam where you must compromise multiple machines in a controlled environment. You need 70 points to pass and must submit a professional penetration testing report within 24 hours after the exam.
Do I need programming skills for OSCP?
Basic scripting skills in Python and Bash are essential for OSCP. You should be able to read and modify existing exploits, automate tasks, and write simple tools to aid in enumeration and exploitation.
Is OSCP harder than CISSP or CEH?
OSCP is a completely different type of exam. While CISSP and CEH are knowledge-based multiple-choice exams, OSCP is entirely practical. You must actually hack into systems, not just answer questions about hacking. Most consider OSCP significantly more challenging.
Related Resources
OSCP (Offensive Security Certified Professional) study details
Want to pass OSCP (Offensive Security Certified Professional) on your first attempt? Start with this structured approach designed for 6-12 months of intensive study.
Quick Facts
Average Salary
Varies by role, location, and experience
Difficulty
Expert
Study Time
Exam Cost
$1,649 (includes 90 days lab access + exam)
Pass Rate
Not published by the provider
Exam Length: 24 hours hands-on + 24 hours for report
Proven OSCP (Offensive Security Certified Professional) Study Strategy
Strategy Overview
OSCP requires 6-12 months of intensive preparation. The key is not just learning techniques, but developing a systematic methodology and the persistence to "Try Harder" when stuck. Plan to spend 15-25 hours per week on preparation. Compromise at least 40-50 machines across platforms before attempting the exam.
The Right Mindset for OSCP (Offensive Security Certified Professional)
Embrace the "Try Harder" philosophy. When stuck, step back and enumerate more thoroughly—you likely missed something. The exam tests methodology and persistence as much as technical skill. Stay calm during the 24 hours; frustration leads to tunnel vision. Take breaks to reset your thinking when stuck.
Recommended Study Resources
Official Materials
•PEN-200 Course Materials (included with lab access)
•PWK Lab Environment (essential for preparation)
•Offensive Security Proving Grounds (additional practice)
•Offensive Security Discord community
Books
•Penetration Testing by Georgia Weidman
•The Hacker Playbook 3 by Peter Kim
•RTFM: Red Team Field Manual by Ben Clark
•Linux Privilege Escalation for Beginners (TCM Security)
Practice Platforms
•HackTheBox (TJ Null's OSCP-like list)
•TryHackMe OSCP prep path
•VulnHub OSCP-prep machines
•Proving Grounds Practice (Offensive Security)
Community Resources
•IppSec YouTube channel (HackTheBox walkthroughs)
•OSCP subreddit and Discord
•0xdf hacks blog
•HackTricks documentation
Practice Question Strategy
The OSCP+ exam is a hands-on penetration test, not a multiple-choice question bank. Allow 23 hours and 45 minutes for the practical and a further 24 hours to submit the report. You need 70 points out of 100 and the required documentation. Bonus points were removed in November 2024.
Exam Day Success Tips
OSCP (Offensive Security Certified Professional) Study Plan Overview
1Month 1-3: Fundamentals & PWK Course3 months
Complete the PEN-200 (PWK) course materials
Practice with course lab machines
Master enumeration and information gathering
Learn privilege escalation techniques
2Month 4-6: Buffer Overflows & Exploitation3 months
Master buffer overflow exploitation
Practice on TryHackMe and HackTheBox
Compromise as many lab machines as possible
Document your methodology
3Month 7-9: Advanced Topics3 months
Study Active Directory attacks
Practice lateral movement and pivoting
Work on HackTheBox retired machines
Focus on time management
4Month 10-12: Exam Preparation3 months
Compromise 30+ lab machines
Build your methodology checklist
Take mock exams (TJ Null list on HackTheBox)
Week-by-Week OSCP (Offensive Security Certified Professional) Study Schedule
Follow this detailed weekly breakdown to stay on track and cover all exam objectives systematically.
Complete all PEN-200 course modules and videos
Take detailed notes on each topic
The OSCP+ exam is a hands-on penetration test, not a multiple-choice question bank. Allow 23 hours and 45 minutes for the practical and a further 24 hours to submit the report. You need 70 points out of 100 and the required documentation. Bonus points were removed in November 2024.
Set up note-taking system (CherryTree, Obsidian)
Begin familiarization with lab environment
Master Nmap scanning and service enumeration
Learn web application enumeration (Gobuster, Nikto)
Practice identifying common vulnerabilities
Start compromising easy lab machines
Document methodology for each service type
Master Linux privilege escalation techniques
Master Windows privilege escalation techniques
Practice with dedicated priv esc labs (TryHackMe, HackTheBox)
Create privilege escalation checklists
Compromise 10-15 lab machines end-to-end
Study buffer overflow theory and mechanics
Practice the PWK buffer overflow exercises repeatedly
Develop custom exploit scripts
Practice until you can complete BOF in under 1 hour
This is a guaranteed exam topic—master it completely
Practice SQL injection (manual and SQLMap)
Master file inclusion (LFI/RFI) exploitation
Learn command injection techniques
Practice authentication bypass methods
Compromise 10+ web-focused lab machines
Aim to compromise 30+ lab machines total
Practice complete attack chains (recon to root)
Document each machine thoroughly
Build your personal methodology notes
Identify patterns across different machine types
Set up AD lab environment for practice
Master AD enumeration with BloodHound
Practice Kerberoasting and AS-REP Roasting
Learn lateral movement and domain escalation
Complete the PWK AD lab set multiple times
Master port forwarding techniques
Practice SSH tunneling and proxychains
Learn to pivot through compromised machines
Practice multi-hop attack scenarios
Complete network-based lab challenges
Complete TJ Null's OSCP-like HackTheBox list
Practice on Proving Grounds (Offensive Security platform)
Work through VulnHub OSCP-prep machines
Time yourself on each machine (aim for 2-3 hours max)
Achieve 40+ total machines compromised
Take mock 23-hour 45-minute practical exam attempts
Practice under time pressure
Refine your methodology and notes
Identify and address remaining weak areas
Practice switching between machines when stuck
Write professional reports for completed machines
Create report templates for efficiency
Practice screenshot documentation
Include proof of concept code in reports
Review Offensive Security report requirements
Review all notes and methodology
Ensure all tools and scripts are ready
Practice BOF one more time for confidence
Schedule exam for optimal time (when well-rested)
Prepare exam environment (snacks, breaks planned)
Try a Sample Question
Test your knowledge with this practice question
Which of the following is most important when preparing for the OSCP (Offensive Security Certified Professional) exam?
Expert Tips to Pass OSCP (Offensive Security Certified Professional)
Thoroughly enumerate - do not rush to exploitation
Practice buffer overflows until you can do them in your sleep
Take a full-length, timed practice exam at least one week before your real exam to identify pacing issues.
Read each question completely before looking at answer choices—key details often appear at the end.
Rushing into the exam without sufficient lab practice
Poor time management during the 23-hour 45-minute practical exam
Approaching the exam as a technical test when it often emphasizes management and strategy.
Over-relying on deep technical knowledge without understanding broader organizational context.
Underestimating the length and intensity of advanced certification exams.
Is OSCP (Offensive Security Certified Professional) Hard?
There is no verified provider pass-rate statistic in this guide. Use practice results to find gaps; they do not predict an exam result. With 6-12 months of dedicated study and hands-on practice, most committed candidates succeed.
Start Your OSCP (Offensive Security Certified Professional) Preparation Today
Track your progress, identify weak areas, and boost your confidence with our free practice tests.
Frequently Asked Questions About OSCP (Offensive Security Certified Professional)
Related OSCP (Offensive Security Certified Professional) Resources
Certification Comparisons
Try a sample question
More questions
Is OSCP worth it in 2026?
Absolutely. OSCP is the gold standard for hands-on penetration testing certifications. It's highly respected by employers and proves real-world skills. Pay varies by role, location, experience, and skills. Compare current job listings; certification alone does not guarantee a salary.
How hard is OSCP?
There is no verified provider pass-rate statistic in this guide. Use practice results to find gaps; they do not predict an exam result. The 23-hour 45-minute practical exam is grueling. Most successful candidates spend 6-12 months preparing and compromise 40-50+ machines before attempting the exam.
Do I need experience before attempting OSCP?
Yes. Offensive Security recommends solid Linux and Windows administration skills, understanding of TCP/IP networking, and basic scripting knowledge (Python, Bash). Most successful candidates have 2-4 years of security or IT experience.
OSCP vs CEH - which is better?
OSCP is far more challenging and hands-on, while CEH is theory-based. OSCP is more respected in the pentesting community. CEH is easier and more accessible. Get CEH first if you are new to security, then pursue OSCP when you are ready for the challenge.
What jobs can I get with OSCP?
Roles include Penetration Tester, Security Consultant, Red Team Member, Security Researcher, and Offensive Security Engineer. Pay varies by role, location, experience, and skills. Compare current job listings; certification alone does not guarantee a salary.
Does OSCP expire?
No, OSCP does not expire. Once you earn it, it is yours for life. However, Offensive Security offers optional re-certifications and advanced certifications (OSEP, OSED) to stay current with evolving techniques.
How many machines should I compromise before taking the exam?
Most successful candidates compromise 40-50+ machines across PWK labs, HackTheBox, TryHackMe, and Proving Grounds. More importantly, develop a consistent methodology that works for you.
Can I use Metasploit on the OSCP exam?
Yes, but limited to one machine only. You can use Metasploit and Meterpreter on a single target. This means you need to be able to exploit most machines manually. Save Metasploit for a machine where you are truly stuck.
What is the PWK course like?
The OSCP+ exam is a hands-on penetration test, not a multiple-choice question bank. Allow 23 hours and 45 minutes for the practical and a further 24 hours to submit the report. You need 70 points out of 100 and the required documentation. Bonus points were removed in November 2024.
How long do I have to write the OSCP report?
You have 24 hours after your exam ends to submit the penetration test report. The report must document your methodology, screenshots, and proof for each compromised machine. A poorly written report can result in failure even with sufficient points.
Related resources
Practice and exam preparation
- OSCP Practice Test
Test your offensive security knowledge
- CEH Practice Test
Certified Ethical Hacker practice
Study resources
- What is OSCP (Offensive Security Certified Professional)?
Complete certification overview
- Explore All Cybersecurity Certifications