OSCP Certification Guide 2026: Exam, Preparation, and What to Expect

OSCP Certification Guide: The Penetration Testing Credential That Actually Tests What You Know

The OSCP (Offensive Security Certified Professional) is different from virtually every other cybersecurity certification in one critical way: it doesn't test your ability to memorize definitions or answer multiple-choice questions. The entire exam is a 24-hour hands-on penetration test against a set of target machines you've never seen before. To pass, you have to actually compromise systems — find vulnerabilities, exploit them, and document your findings in a professional penetration testing report submitted within 24 hours after the exam ends. No partial credit for knowing the theory. No recovery from a bad day of passive study. This is why OSCP carries a different weight in the security community than most other certifications.

OffSec (the company formerly known as Offensive Security) issues the OSCP as the final credential for their PEN-200 course (also called Penetration Testing with Kali Linux, or PWK). You don't register for the exam separately — you purchase the PEN-200 course bundle, which includes lab access time, course materials, and one exam attempt. Additional exam attempts cost extra. The course itself covers a broad curriculum: from basic Linux command-line usage through network scanning, web application attacks, buffer overflow exploitation, privilege escalation on both Linux and Windows, Active Directory attacks, and pivoting through networks. The lab environment is a large simulated corporate network where you practice against dozens of machines across different operating systems and configurations.

The exam scoring structure divides 100 points across five target items: three standalone machines worth 20 points each (10 for initial foothold, 10 for root/SYSTEM access), plus an Active Directory set worth 40 points (for domain compromise). A passing score is 70 points. This means you can pass by getting full points on two standalone machines and partial credit on a third, or by dominating the AD set and getting one standalone machine. Many candidates focus heavily on the AD component in preparation because the 40 points it offers can make or break a passing score. Work through oscp kali linux questions and answers to solidify the tool knowledge and command-line competency the exam assumes from the first minutes of exam time.

The 24-hour exam format is deliberately brutal — not as a hazing ritual but because penetration testing in the real world involves sustained focus, problem-solving under pressure, and the ability to pivot your approach when initial vectors don't work. Candidates who fail the OSCP usually fail because they haven't built that sustained operational rhythm in practice. Passing the PEN-200 labs by following walkthroughs isn't sufficient preparation. The candidates who pass have typically rooted the majority of lab machines independently, completed the external practice platforms (Hack The Box, TryHackMe, Proving Grounds), and built a reliable methodology for approaching unknown machines systematically. The buffer overflow module is particularly important — many exam attempts have included buffer overflow machines, and the methodical approach to BOF is highly learnable with structured practice. Review oscp buffer overflow questions and answers to understand the technical concepts behind stack-based buffer overflows before attempting them in the live lab environment.

Network reconnaissance is the first phase of every OSCP exam and lab machine engagement. The methodology is repeatable: full port scan (all 65,535 ports), followed by service version detection and default script scanning on discovered ports, followed by targeted enumeration based on what services you find. nmap is the primary tool; additional enumeration tools vary by service type. For web services, directory enumeration with gobuster or feroxbuster, technology fingerprinting, and manual testing of discovered endpoints. For SMB, enum4linux or enum4linux-ng, anonymous share access testing, and user enumeration. For Windows RPC, NetBIOS, and LDAP, a different set of tools applies. Building a fast, thorough, and consistent enumeration methodology through practice with oscp network scanning practice test questions is the foundation on which every other OSCP skill depends.

OSCP Exam Strategy: How to Approach the 24-Hour Challenge

The OSCP exam is as much a test of operational discipline as it is of technical skill. Candidates who fail often have the technical knowledge to pass — they fail because they rabbit-hole on one machine for 6 hours, neglect proper note-taking, run out of time before attempting all targets, or submit an incomplete report. The exam format rewards systematic methodology over brilliant one-off discoveries. Start with the Active Directory set because it's worth 40 points and requires full chain compromise rather than individual machine roots. If you complete the AD set, you have 40 of the 70 points needed to pass and can approach the standalone machines with confidence rather than desperation.

Enumeration is always more valuable than exploitation attempts. When you first connect to an exam machine, run a full-port nmap scan and let it run in the background while you do a faster targeted scan. Don't start throwing exploits at the first service you identify — finish your enumeration first. Candidates who start running exploits on the first open port they find often miss the actual attack vector, which might be on a high-numbered port they haven't scanned yet. Build a checklist: for each machine, document every open port, every service version, every potentially interesting file you find, every credential you discover anywhere. A credential found in a config file on one machine may be the exact thing that gets you into the next machine. This credential re-use and lateral thinking is central to the OSCP methodology. Review oscp linux questions and answers to build comfort with the Linux-based enumeration and privilege escalation techniques that appear consistently across OSCP exam scenarios.

Privilege escalation is where many candidates stall. Getting initial foothold on a machine is often straightforward — a public exploit for a known CVE, a SQL injection to web shell, a file upload vulnerability. Getting from low-privilege access to root or SYSTEM is harder because it requires understanding the specific misconfiguration present on that specific machine. Use automated privilege escalation tools (LinPEAS, WinPEAS) to enumerate the machine thoroughly, but don't just run the tool and wait for a highlighted finding — read through the full output. Misconfigurations that PrivEsc tools score as low severity sometimes turn out to be the exact attack vector on a specific machine configuration. Practice privilege escalation extensively through dedicated labs — the password cracking and credential-based privilege escalation vectors deserve particular attention with oscp password attacks practice test before exam day. Password attacks include brute forcing, credential stuffing, and hash cracking with tools like hashcat and john — all skills that compound with your enumeration and privilege escalation methodology.

Time management across the 24-hour exam needs explicit planning. Many candidates recommend setting hard time limits on each machine: try each machine for no more than 2 hours before moving on. If you're stuck, rotate to the next target. Coming back to a machine with fresh eyes after working on something else often reveals the approach you missed. Keep detailed notes throughout — not just findings but failed attempts too. If a specific exploit syntax didn't work, note exactly what error you got. This prevents you from spending 45 minutes re-running the same failed command you already tried 4 hours ago. Rest during the exam if needed — a 90-minute nap at hour 16 is more valuable than pushing through on 18 hours of exhaustion and missing obvious findings on the final machines.

Sample OSCP - Offensive Security Certified Professional Practice Questions

Try these questions from our free OSCP - Offensive Security Certified Professional practice tests. The correct answer and an explanation follow each question.

1. What does the Nmap -A flag enable?

   • A. Anonymous login detection only
   • B. OS detection, version detection, script scanning, and traceroute
   • C. All UDP ports scan
   • D. Aggressive brute-force mode

Answer: B. OS detection, version detection, script scanning, and traceroute

The -A flag enables aggressive mode, which combines OS detection (-O), version scanning (-sV), script scanning (-sC), and traceroute in a single flag.

Answer: B. Portmapper/RPC

Port 111 is used by the Portmapper (rpcbind) service, which maps RPC program numbers to network port numbers and is commonly found on Linux/Unix systems.

Answer: A. rmdir

The `rmdir` command is specifically designed to remove empty directories (folders) in Unix-like operating systems. If a directory contains any files or subdirectories, `rmdir` will fail and report an error. To delete non-empty directories, a different command like `rm -r` is typically used.

Answer: B. Whether the injection point exists via time delay

SLEEP() is used in time-based blind SQLi to confirm a vulnerable injection point by causing a measurable delay in the server's response.

Take the full OSCP - Offensive Security Certified Professional practice test