OSCP (Offensive Security Certified Professional)
Offensive Security
Complete guide to passing the OSCP (Offensive Security Certified Professional) exam on your first attempt.
$1,599-$2,499
~25%
No expiration
Global
Offensive Security
$100k-$160k
Are you ready for OSCP (Offensive Security Certified Professional)?
Loading quiz...
Complete Overview
The OffSec Certified Professional (OSCP) is a 23 hour 45 minute hands-on penetration testing exam run by OffSec, followed by a further 24 hours to write and upload a professional penetration test report. The standalone exam without training costs $1,699 and includes two exam attempts valid for 120 days; the PEN-200 Course and Cert Bundle is $1,749 for 90 days of course access and one attempt, and the Learn One subscription is $2,749 per year with two attempts.
There are no multiple-choice questions. You connect to a private VPN with Kali Linux over OpenVPN and attack a live network. The exam is worth 100 points and you need 70 to pass. Three standalone machines carry 20 points each, split into 10 points for initial access and 10 for privilege escalation. One Active Directory set of three machines carries the remaining 40 points, awarded as 10, 10, and 20, and you are handed a username and password at the start to simulate a breach scenario rather than having to find your own foothold.
OffSec publishes the exact point combinations that reach 70. Full domain compromise of the AD set plus three local.txt flags reaches 70. So does the full AD set plus two local.txt flags and one proof.txt. So does 20 AD points with three local.txt and two proof.txt flags. So does 10 AD points plus three fully completed standalone machines. Bonus points were removed on 1 November 2024, so there is no way to arrive at the exam with a head start.
The report is scored as strictly as the exploitation. Every proof file must be shown in a screenshot displaying the file contents alongside the target IP from ipconfig, ifconfig, or ip addr, retrieved with cat or type from an interactive shell. A web shell does not count. Missing screenshots mean zero points for that target and OffSec will not request them after submission. The report goes out as a PDF inside a password-free .7z named OSCP-OS-XXXXX-Exam-Report.7z, under 200MB, uploaded to upload.offsec.com with the MD5 verified.
Every exam is proctored live by an OffSec employee. You show a physical government-issued photo ID in English, scan the room with your webcam, share all screens, and keep the webcam on for the entire session including breaks. Up to four monitors are allowed. Printed books, notes, paper, and pen are permitted, which is unusual among security certifications.
Results arrive by email within 10 business days. OffSec does not publish solutions to the exam targets and does not release pass rates or holder counts, but candidates who submit a report and fall short of 70 points are sent their score and written feedback alongside the result. Passing awards both OSCP, which never expires, and OSCP+, which expires three years from issuance unless you maintain it.
Why Get OSCP (Offensive Security Certified Professional) Certified?
OSCP has no expiration date. Passing once gives you a credential that stays valid indefinitely, with the separate OSCP+ designation carrying the three-year currency signal on top.
The exam is 23 hours 45 minutes of live exploitation against six machines, so a pass is direct evidence you compromised real systems rather than recognized correct answers.
The exam is open book for its entire 23 hours 45 minutes. OffSec permits your own notes, online resources, the OffSec Learning Platform, and printed books and paper, so preparation rewards building a reference system you can search under fatigue rather than memorizing command syntax.
The $1,699 standalone exam includes two attempts valid for 120 days, and if you exhaust included attempts a further retake costs $249 rather than a full exam price.
The PEN-200 course that prepares for it contains 321 hours of content across more than 20 modules and 9 challenge labs, three of which are built to replicate the OSCP+ exam environment.
OffSec states that completing PEN-200 may qualify learners for up to 40 ISC2 CPE credits, which helps maintain other certifications you already hold.
The mandatory report requirement means preparation produces a deliverable skill. Writing a replicable penetration test report is the part of the job that separates a tester from someone who ran a scanner.
Exam Format & Structure
Duration
23 hours 45 minutes of exam time, plus 24 hours afterward to upload the report
Questions
6 target machines: 3 standalone machines and 1 Active Directory set of 3 machines
Passing Score
70 of 100 points
Question Types
- Hands-on exploitation of live machines in a private VPN, scored on points
- Standalone machines: 20 points each, 10 for initial access and 10 for privilege escalation
- Active Directory set: 40 points total, awarded 10, 10, and 20, starting from a supplied username and password
- A written professional penetration test report submitted as a PDF
Delivery Method
Remote, over OpenVPN from a Kali Linux machine, proctored live by an OffSec employee via webcam and full screen sharing
Exam Domains & Topics
OffSec does not publish knowledge-domain percentages for the OSCP exam; points are allocated per machine instead. Enumeration is the skill that determines whether you find a foothold at all, covering passive and active information gathering, port and service discovery, and vulnerability assessment against each of the six exam targets.
Key Topics to Master:
- Nmap and the Nmap Scripting Engine, both permitted in the exam
- Service and version enumeration on unusual ports
- Directory and content discovery with tools such as DirBuster
- Nikto for web server checks
- SMB, SNMP, and NFS enumeration
- Vulnerability scanning and vulnerability assessment concepts
- Building a repeatable enumeration checklist you can run under fatigue
PEN-200 covers perimeter attacks against web and application layers in depth, and web vulnerabilities are a common route to initial access on standalone targets. The constraint that matters here is that sqlmap and similar automatic exploitation tools are banned in the exam, so injection has to be found and exploited manually.
Key Topics to Master:
- SQL injection, exploited by hand rather than with sqlmap
- Cross-site scripting
- Command injection
- Directory traversal
- Insecure file upload leading to code execution
- Burp Suite Free edition, permitted where Burp Pro is not
- Turning a web foothold into an interactive shell, since web shells do not satisfy proof requirements
Credentials recovered on one machine frequently unlock another, and the Active Directory set begins with a supplied username and password. This area covers online and offline attacks, hash handling, and the discipline of tracking every credential you find in a way you can search hours later at three in the morning.
Key Topics to Master:
- Online password attacks with tools such as Hydra
- Offline hash cracking and wordlist selection
- Credential reuse across hosts and services
- Extracting stored credentials from configuration files and databases
- Password spraying against domain accounts
- Maintaining a searchable credential log during the exam
Half the points on each standalone machine come from privilege escalation, 10 of the 20 available. Full points require a SYSTEM, Administrator, or administrator-privileged shell on Windows targets and a root shell on Linux targets, so a low-privilege shell that you cannot escalate caps that machine at 10 points.
Key Topics to Master:
- Windows service misconfigurations, unquoted paths, and weak permissions
- Windows token and privilege abuse leading to SYSTEM
- Linux SUID binaries, sudo misconfiguration, and cron abuse
- Kernel exploit selection and the risk of crashing a target you then have to revert
- Reading proof.txt from /root/ or the Administrator Desktop
- Enumeration scripts and how to interpret their output rather than trust it
- Recognizing when escalation is not the intended path on a given box
The AD set is worth 40 of the 100 points, the largest single block, and since 1 November 2024 it starts from an assumed compromise: OffSec supplies a standard domain user account and the goal is full domain compromise. Points are awarded 10 for the first machine, 10 for the second, and 20 for the third.
Key Topics to Master:
- Domain enumeration from a standard user account
- Attacking Active Directory authentication
- Kerberos-based attacks and ticket abuse
- Lateral movement between domain-joined hosts
- Credential harvesting from memory and the domain database
- Reaching domain administrator from an assumed-breach starting point
- Working the AD set first, since 40 points is the largest block available
The AD set requires movement between machines that are not all directly reachable, so tunneling is a scored skill rather than an optional extra. One exam rule shapes this area sharply: Metasploit cannot be used for pivoting, because doing so would use it against more than the one permitted target machine.
Key Topics to Master:
- SSH local, remote, and dynamic port forwarding
- SOCKS proxies and proxychains
- Windows port forwarding without Metasploit
- Routing tooling through a compromised host
- Keeping stable shells alive across a long session
- Understanding why Metasploit is locked out of pivoting under exam rules
The report is graded and can zero out work you actually completed. OffSec requires documentation thorough enough for a technically competent reader to replicate every attack step by step, with all commands and console output, and states that insufficient documentation results in reduced or zero points.
Key Topics to Master:
- Screenshots showing proof file contents alongside the target IP from ipconfig, ifconfig, or ip addr
- Reading proof files with cat or type from an interactive shell, never a web shell
- Submitting local.txt and proof.txt contents in the control panel before the exam ends
- Documenting modified exploit code with the original URL, highlighted changes, and reasoning
- Linking to unmodified exploits by URL rather than pasting pages of code
- Ordering machines in the report, since that is the order they are graded in
- Producing a PDF inside a password-free .7z under 200MB with the exact required filename
Recommended Study Plan
- 1Read the OSCP+ Exam Guide on help.offsec.com end to end, including the Metasploit restriction and the point disqualification list
- 2Build and snapshot a Kali Linux virtual machine, and confirm OpenVPN works from it
- 3Set up a note-taking system with a template per host covering ports, services, credentials, and screenshots
- 4Practice the proof screenshot format now: file contents plus ipconfig, ifconfig, or ip addr in the same frame
- 5Write your enumeration checklist as a document you will follow rather than improvise from
- 1Work the PEN-200 information gathering and vulnerability scanning modules
- 2Practice Nmap and the Nmap Scripting Engine until you can justify every flag you use
- 3Enumerate SMB, SNMP, and NFS on practice targets without relying on an all-in-one script
- 4Run your checklist against five machines and time how long a full pass takes
- 5Revise the checklist based on anything you missed and had to go back for
- 1Work the PEN-200 web application modules covering SQL injection, XSS, command injection, directory traversal, and file uploads
- 2Exploit a SQL injection manually end to end without sqlmap, since sqlmap is banned in the exam
- 3Turn a file upload into an interactive reverse shell, not a web shell
- 4Practice with Burp Suite Free only, since Burp Pro is a prohibited commercial tool
- 5Document one web exploitation chain as though it were an exam report section
- 1Work the PEN-200 Linux privilege escalation module
- 2Escalate to root on ten practice machines using ten different mechanisms
- 3Practice SUID, sudo misconfiguration, cron, and writable path escalations separately until each is automatic
- 4Read proof.txt from /root/ with cat in an interactive shell and capture the screenshot correctly each time
- 5Write down which enumeration script output you trust and which you always verify by hand
- 1Work the PEN-200 Windows privilege escalation module
- 2Escalate to SYSTEM or Administrator on ten practice machines using different mechanisms
- 3Practice service misconfiguration, unquoted service path, and privilege abuse routes
- 4Confirm on each box that your shell runs as SYSTEM, Administrator, or an administrator-privileged user, since anything less caps the machine at partial points
- 5Practice reading proof.txt from the Administrator Desktop with type from an interactive shell
- 1Work the PEN-200 password attacks module
- 2Practice online attacks with Hydra and offline cracking with your chosen wordlists
- 3Build a credential log format and use it on every practice box so reuse is obvious
- 4Practice extracting credentials from config files, databases, and backups
- 5Chain a credential found on one host into access on another
- 1Work the PEN-200 Active Directory modules on enumeration, attacking AD authentication, and lateral movement
- 2Practice a full three-machine domain compromise starting from a supplied standard user account
- 3Drill Kerberos-based attacks and lateral movement without using Metasploit, since Metasploit cannot be used for pivoting
- 4Time yourself: the AD set is 40 points and should be attempted early in the exam
- 5Document the whole chain as a report section with every command and its output
- 1Practice SSH local, remote, and dynamic port forwarding until you can build each from memory
- 2Route scanning and exploitation traffic through proxychains to a second subnet
- 3Set up a Windows port forward without touching Metasploit
- 4Practice recovering when a tunnel drops mid-attack rather than starting the chain over
- 5Run a two-hop scenario end to end and document it
- 1Work the PEN-200 challenge labs, prioritizing the three built to replicate the OSCP+ exam environment
- 2Treat one challenge lab as a scored run and record which machines you would have earned points on
- 3Log every point at which you got stuck and what unblocked you
- 4Practice using reverts sparingly, since the exam gives 24 reverts resettable once
- 5Write a full report for one challenge lab in the exact submission format
- 1Run a 23 hour 45 minute simulation against six unfamiliar machines, sleeping and eating on the schedule you plan to use
- 2Enforce the real restrictions: no sqlmap, no Nessus, no AI chatbots, Metasploit against one target only
- 3Capture every proof screenshot in the required format as you go rather than at the end
- 4Track your point total against the published 70-point combinations to see which path you were closest to
- 5Note the hour at which your judgment degraded and plan a rest break just before it
- 1Write the full report for your week 10 simulation inside a 24-hour window
- 2Use an OffSec suggested template or your own, as long as it is structured and professional
- 3Include modified exploit code with the original URL, highlighted changes, and an explanation of why
- 4Export to PDF, archive to .7z without a password, name it in the exact required format, and confirm it is under 200MB
- 5Generate the MD5 of the archive and practice the verification step you will do at upload.offsec.com
- 1Redo practice machines in the category where you lost the most simulation points
- 2Test your webcam against the exact physical ID you will present, confirming the text and photo are legible
- 3Verify your machine meets the proctoring requirements: 64-bit dual core, 8GB RAM, 20mbps down and 10mbps up
- 4Confirm the name on your OffSec learner profile matches your government ID
- 5Book the slot, remembering the rescheduling window closes 48 hours before the start time
Ready to pass OSCP (Offensive Security Certified Professional)?
Get 500+ practice questions, video walkthroughs, and a pass guarantee.
Best Study Resources
OSCP+ Exam Guide
Official exam guideThe authoritative document: exam structure, the exact point combinations that reach 70, documentation and screenshot requirements, the Metasploit restriction, the prohibited tools list, revert limits, and the submission checklist. Read it fully before you book, not the night before.
Free
PEN-200: Penetration Testing with Kali Linux
Official courseOffSec's own course, with 321 hours of content across more than 20 modules and 9 challenge labs. The bundle gives 90 days of access and one exam attempt; Learn One gives a year of access and two attempts. Three of the challenge labs are built to replicate the exam environment.
$1,749 for the Course and Cert Bundle, or $2,749 per year for Learn One
OSCP+ Standalone Exam
Exam onlyAn exam purchase without any training materials, including two exam attempts valid for 120 days from purchase. This is the route for candidates who already have the skills from work or from other platforms and only need the credential.
$1,699 once
Proctored Exam Requirements FAQ
Official policy documentationThe full proctoring rules: hardware and bandwidth minimums, the ID fields that must be legible, the room scan, the four-screen limit, the ban on headphones and phones, the one-hour login grace period, and the confirmation that printed books, notes, paper, and pen are permitted.
Free
Changes to the OSCP
Official announcementExplains the November 2024 changes: bonus points removed, the Active Directory portion converted to an assumed-compromise scenario, and the introduction of OSCP+ with its three-year expiry. Also lists every pricing path including the $249 retake and the $799 recertification exam for existing OSCP holders.
Free
Hack The Box
Practice platformRetired machines with published write-ups give you a large supply of unfamiliar targets to enumerate and escalate on. Use it to build speed on privilege escalation, and practice without the tools the exam bans so you do not build a dependency.
Free tier plus paid subscription tiers
TryHackMe
Practice platformMore guided than Hack The Box, which suits the earlier weeks when you are learning a technique rather than hunting for one. Useful for structured Windows and Linux privilege escalation practice before you move to unguided boxes.
Free tier plus paid subscription tiers
Kali Linux
Operating systemThe exam requires you to connect over OpenVPN from Kali, and OffSec states it cannot provide VPN connectivity support for any other setup. OffSec also recommends using a Kali virtual machine for the report upload, because some Windows 11 users hit a file format error at upload.offsec.com.
Free
OffSec report templates
Document templatesOffSec suggests specific penetration test report templates in the exam guide. Your own template is acceptable provided the information is structured, professional, and meets every documentation requirement. Pick one in week one and write every practice report in it.
Free
OffSec Discord community
CommunityPermitted as a search resource during the exam, but the exam guide is explicit that you may not seek or receive assistance from other people on the platform under any circumstances. Treat it as a reference archive during the exam and as a study community outside it.
Free
Common Mistakes to Avoid
Capturing proof file contents through a web shell or by reading the file from outside an interactive shell.
OffSec accepts proof only when read with cat or type from their original location inside an interactive shell on the target. Any other method, explicitly including any web-based shell, results in zero points for that machine. Upgrade every web foothold to a real shell before you touch the proof file.
Taking proof screenshots without the target's IP address in the frame.
Each local.txt and proof.txt screenshot must show the file contents and the target IP produced by ipconfig, ifconfig, or ip addr. Missing this zeroes the target. Build the habit now: run the IP command and the cat command in the same terminal, then capture once.
Burning the Metasploit allowance on the first machine that resists.
You may use Metasploit modules or the Meterpreter payload against exactly one machine, and the choice locks in the moment you use either, even if the attack fails. You cannot test with it across machines first, the check command included, and it cannot be used for pivoting at all. msfvenom and exploit/multi/handler remain available against everything. Decide your one target deliberately, late.
Reaching for sqlmap, Nessus, or an AI chatbot out of habit.
The exam bans automatic exploitation tools including sqlmap, mass vulnerability scanners including Nessus and OpenVAS, commercial tools including Burp Pro and Metasploit Pro, spoofing attacks, and all AI chatbots. Nmap with its scripting engine, Nikto, Burp Free, and DirBuster are permitted. Practice without the banned tools so the reflex never forms.
Leaving the Active Directory set until the second half of the exam.
The AD set is 40 of the 100 points, the largest block available, and three of the four published passing combinations depend on earning 20 or 40 points from it. Since November 2024 it starts from a supplied username and password, so no foothold hunt gates it. Nothing stops you opening with the largest block of points while you are freshest.
Planning to write the report after the exam ends and taking screenshots as an afterthought.
You get 24 hours after the exam to upload, but you cannot go back and collect a screenshot you never took. Once submitted, the submission is final and OffSec will neither accept nor request missing material. Write the report section for each machine immediately after you finish that machine.
Submitting the report in the wrong filename format or in a password-protected archive.
The PDF must be named OSCP-OS-XXXXX-Exam-Report.pdf and archived into OSCP-OS-XXXXX-Exam-Report.7z with your OSID, case sensitive, under 200MB, with no password. Anything else is rejected by the upload application. Upload to upload.offsec.com, compare the MD5 the site shows against your local file, then click Submit File.
Studying the PEN-200 AWS module expecting it on the exam.
OffSec has stated that the AWS module was added to the PEN-200 course but is not yet part of the exam. It is worth learning for the job; it is not worth exam hours you could spend on Active Directory or privilege escalation.
Treating the 23 hour 45 minute window as a continuous session to be powered through.
OffSec states plainly that the allotted time takes life into account and that you are expected to take rest breaks, eat, drink, and sleep. Candidates who work 20 straight hours make worse decisions in hour 15 than a rested candidate makes in hour 20. Schedule sleep before the exam starts and keep the webcam running through it.
Reverting machines carelessly and running out.
You get 24 reverts, and that limit can be reset once during the exam. All machines are freshly reverted at the start, so there is no need to revert anything at the beginning. Click the revert button once per attempt and wait, since a revert discards every change you made on that machine.
Exam Day Tips
- 1
Log in to the proctoring session 15 minutes before your scheduled start. The exam clock runs from the scheduled start time regardless of how long the pre-exam checks take, so arriving late eats your own exam time.
- 2
Have a physical, valid, government-issued photo ID in English showing your full legal name, photograph, year of birth, country of issuance, issue date, and expiration date. You will show both the front and back, or a fully opened passport. Test that your webcam renders the text and photo legibly before exam day.
- 3
The name on your ID must match your OffSec learner profile. Update the profile in advance rather than arguing it with a proctor at the start of a 24-hour exam.
- 4
You may use up to four screens or monitors, and OffSec recommends Chrome if you are running three or four. You cannot disable your laptop display, though you may mirror it to an external monitor as long as both are shared as separate screens.
- 5
Printed books, notes, paper, and a pen are permitted in the exam environment, which is unusual. Bring your printed enumeration checklist and privilege escalation notes.
- 6
Headphones, earphones, and earbuds are not permitted unless you have approved medical accommodations for a documented hearing disability. Phones must be out of reach of the workstation before the start time.
- 7
The webcam must stay on and unobstructed for the entire 23 hours 45 minutes, including breaks, and must show your face, at least half your body, and the surrounding environment. Do not close the proctoring tab, which disconnects the session and may pause your exam VPN.
- 8
To step away for any reason, request a break through the proctoring chat window before you leave the workstation. Communication with the proctor is text only; the proctor cannot hear you.
- 9
You have a one-hour grace period from your scheduled start to log in to the proctoring session. Missing that window cancels the exam automatically.
- 10
Submit every local.txt and proof.txt value in the exam control panel before the exam ends. The panel gives no indication of whether a submitted value is correct, so double-check each paste rather than waiting for feedback that never comes.
- 11
Do not record your screen at any point. Screen recording exposes OffSec exam content and violates the Academic Policy, and the consequence is cancellation.
Career Paths & Salary Ranges
Penetration tester
Runs authorized attacks against client networks and writes the findings up. OSCP maps to this role almost exactly, since the exam scores both the exploitation and a report that a technically competent reader must be able to replicate.
$100k-$160k
Red team operator
Simulates adversary campaigns over longer engagements with stealth constraints. The Active Directory portion of the exam, worth 40 points from an assumed-breach start, covers the domain compromise chain this role runs repeatedly.
$100k-$160k
Security consultant
Delivers assessments across many client environments and presents results to non-technical stakeholders. OSCP is frequently listed as a hard requirement in consultancy job specs and in client-facing statements of work.
$100k-$160k
Vulnerability analyst
Triages findings and determines whether a reported issue is genuinely exploitable in context. Having exploited by hand under exam conditions, without automated tooling, is exactly the judgment this role needs.
$100k-$160k
Application security engineer
Works alongside developers on injection, traversal, upload, and authentication flaws. The web application portion of PEN-200 covers these classes from the attacker's side, which changes how you review a fix.
$100k-$160k
Security operations and detection engineer
Builds detections for the techniques the exam requires you to execute. OffSec markets the credential toward defenders as well as attackers, and knowing what a privilege escalation looks like from the keyboard shapes what you alert on.
$100k-$160k
Prerequisites & Requirements
- There are no formal prerequisites. OffSec states the OSCP credential is awarded without prerequisites to individuals who pass the performance test.
- OffSec strongly recommends a solid understanding of TCP/IP networking before starting PEN-200.
- OffSec strongly recommends reasonable Windows and Linux administration experience.
- OffSec strongly recommends familiarity with basic Bash or Python scripting.
- You must connect to the exam with Kali Linux over OpenVPN; OffSec provides no VPN connectivity support for other setups.
- Your machine needs at least a 64-bit dual core CPU at 2.2 GHz per core, 8GB of RAM recommended, 1024x768 display resolution, and 20GB of free disk space.
- You need a stable connection with a minimum of 20mbps download and 10mbps upload, and an external or integrated webcam. Phones and tablets cannot be used as the webcam.
- You need a private space. Taking the exam in the same room as another exam candidate is prohibited and can void your result.
Frequently Asked Questions
What happens if I fail the OSCP exam?
You retake it. The standalone $1,699 exam purchase includes two attempts valid for 120 days, and the Learn One subscription includes two attempts valid across the subscription period. If you exhaust the attempts included with a Course and Cert Bundle or Learn One and still do not hold an OSCP, you can buy a regular exam retake for $249, valid for 120 days from purchase. A failed attempt still tells you something: OffSec includes your score in the results email, and sends written feedback, when you submitted a report and did not reach 70 points.
How much does the OSCP cost?
It depends on the route. The OSCP+ standalone exam without training is $1,699 and includes two attempts valid for 120 days. The PEN-200 Course and Cert Bundle is $1,749 and includes 90 days of course access plus one attempt. The Learn One subscription is $2,749 per year and includes two attempts. A further retake after those are used costs $249. Existing OSCP holders who want the OSCP+ designation pay $799 for the recertification exam.
What score do I need to pass, and how are points awarded?
70 out of 100 points. Three standalone machines are worth 20 points each, split as 10 for initial access and 10 for privilege escalation. One Active Directory set of three machines is worth 40 points, awarded as 10, 10, and 20. OffSec publishes four combinations that reach 70: the full AD set plus three local.txt flags; the full AD set plus two local.txt and one proof.txt; 20 AD points plus three local.txt and two proof.txt; or 10 AD points plus three fully completed standalone machines.
Are there still bonus points?
No. OffSec removed bonus points effective 1 November 2024, at the same time it converted the Active Directory portion to an assumed-compromise scenario. OSCP had been the only OffSec certification allowing bonus points, up to 10, and removing them aligned it with the rest of the catalogue. The exercises that used to earn those points still exist in PEN-200 as preparation, they just no longer add to your exam score.
How long do results take?
You receive your result by email within 10 business days of submitting your documentation. OffSec never provides solutions to the exam targets, and it does not publish the pass rate or the number of OSCP holders. It does provide your score, plus written feedback, to candidates who submitted a report and finished short of 70 points. If OffSec needs clarification on anything in your report, it will contact you by email and you must respond within 24 hours of that request.
How long is the exam and how much time do I get for the report?
23 hours 45 minutes for the exam itself, running from your scheduled start time. If your exam begins at 09:00 GMT it ends at 08:45 GMT the next day. You then get a further 24 hours to write and upload the report. OffSec states the 23:45 allotment takes life into account and that you are expected to take rest breaks, eat, drink, and sleep during it.
What ID do I need and what are the proctoring rules?
A physical, valid, government-issued photo ID written in English showing your full legal name, photograph, year of birth, country of issuance, issue date, and expiration date. Accepted types are a national ID, driver's license, passport, or residence permit ID. You show both sides or a fully opened passport to the webcam, and the name must match your learner profile. The proctor also checks your hardware, has you run an operating system script, has you scan the room, and confirms you share all screens before the exam begins.
Which tools am I allowed to use?
Nmap including the Nmap Scripting Engine, Nikto, Burp Suite Free, and DirBuster are permitted against any target, as are msfvenom and exploit/multi/handler. Prohibited are spoofing attacks against IP, ARP, DNS, or NBNS; commercial tools such as Metasploit Pro and Burp Pro; automatic exploitation tools such as sqlmap and sqlninja; mass vulnerability scanners such as Nessus, OpenVAS, Core Impact, and SAINT; and all AI chatbots including ChatGPT, Gemini, Deepseek, and OffSec's own KAI. Using a restricted tool zeroes that target.
How exactly does the Metasploit restriction work?
You may use Metasploit Auxiliary, Exploit, or Post modules or the Meterpreter payload against one single machine of your choice. The choice locks in the moment you use either, including running check, and if the attack fails you cannot switch to a different target. Metasploit cannot be used for pivoting at all, because that would apply it to more than one machine. The same limits apply to interfaces built on Metasploit such as Armitage, Cobalt Strike, and Metasploit Community Edition.
Can I take breaks, and does the webcam stay on?
Yes to breaks, and yes the webcam stays on. You must request a break through the proctoring chat window before stepping away from the workstation. The webcam must remain unobstructed and correctly positioned to show your face, at least half your body, and your surroundings for the entire session, breaks included. Closing the proctoring tab disconnects the session and may pause your exam VPN.
Are notes or reference materials allowed?
Yes, and this is unusual among security certifications. OffSec permits printed books, notes, paper, and a pen in the exam environment, alongside the host machine and any external screens shared with the proctoring tool. What is not permitted is any other electronic device, headphones or earbuds without an approved accommodation, phones anywhere within reach, or screen recording of any kind.
How many machine reverts do I get?
24 reverts, and that limit can be reset once during the exam. Every machine is freshly reverted when your exam starts, so there is no reason to spend reverts at the beginning. Click the revert button once per attempt and wait for it to complete. Reverting returns the machine to its original state and discards everything you did on it, so save any file you might need before you revert.
What are the report submission requirements?
A PDF named OSCP-OS-XXXXX-Exam-Report.pdf using your OSID, archived into OSCP-OS-XXXXX-Exam-Report.7z with no password, no larger than 200MB, uploaded to upload.offsec.com within 24 hours of the exam ending. Filenames are case sensitive and the upload application rejects anything that does not match. After uploading, compare the MD5 the site displays against your local file, then click Submit File. A confirmation email arrives immediately; if it does not, the submission did not complete.
Does the OSCP expire?
The OSCP itself never expires and remains valid indefinitely. Passing the current exam awards both OSCP and OSCP+, and the OSCP+ designation expires three years from issuance. You keep the OSCP either way. To maintain the plus, you keep maintenance coverage active and complete one of three continuing education paths within the three years.
How do I maintain the OSCP+ designation?
Three paths. Take and pass a recertification exam within six months of the plus expiry date; take and pass another qualifying OffSec certification exam before it expires, with OSEP, OSWA, OSED, and OSEE named as qualifying; or complete OffSec's CPE program. If you let the plus lapse you still keep the OSCP for life, you simply lose the currency marker.
I already hold the OSCP. How do I get the OSCP+?
By passing the updated exam. OffSec ran a promotional rate of $199 for existing OSCP holders between 1 November 2024 and 31 March 2025, applicable to the first purchase only. After that date the recertification exam for existing OSCP holders costs $799, and any subsequent attempt costs the same $799. Earning a different OffSec certification does not grant the plus; you have to pass the updated OSCP exam first.
What happens if my power or internet fails mid-exam?
OffSec expects you to have a contingency plan, naming a backup internet connection, Kali virtual machine, and power as examples. If you have a legitimate issue, email challenges at offsec dot com immediately with your OSID and supporting documentation such as a letter from your power company or ISP. OffSec extends exam time only when the issue was on its side and the exam subnet is not already booked for another learner; if it is booked, OffSec provides a free retake attempt instead.
How does OSCP compare to the OSEP?
OSEP, from the PEN-300 course, is the next step up. Its exam runs 47 hours 45 minutes against a full simulated corporate network and requires either reaching a named objective or scoring 100 points. It also relaxes several OSCP restrictions: Metasploit Community, PowerShell Empire, Covenant, BloodHound, and sqlmap are all allowed on OSEP, which OSCP bans. OSEP is also one of the qualifying exams that maintains an OSCP+ designation.
Do I need to take PEN-200 to sit the exam?
No. OffSec sells a standalone OSCP+ exam for $1,699 with two attempts valid for 120 days, aimed at people who already have the skills. What OffSec recommends before attempting either the course or the exam is a solid grasp of TCP/IP networking, reasonable Windows and Linux administration experience, and familiarity with basic Bash or Python scripting.
Pass OSCP (Offensive Security Certified Professional), Guaranteed
94% pass rate on first attempt
One-time • Lifetime access