OSCP Certification: Exam, Study Guide & Cost

What Is the OSCP Certification?

The OSCP (Offensive Security Certified Professional) is a hands-on penetration testing certification issued by Offensive Security (OffSec). Unlike multiple-choice exams, the OSCP tests real offensive security skills: you must compromise machines on an isolated network within 24 hours, then write a professional penetration test report. It is widely regarded as the most respected entry-to-mid level certification in offensive security and is listed as a requirement or strong preference in the majority of penetration testing job postings.

The certification is tied to the PEN-200 course (formerly PWK — Penetration Testing with Kali Linux), which provides the curriculum, lab environment, and exam attempt. OffSec designed the OSCP to filter for candidates who can think creatively under pressure, enumerate thoroughly, and document findings professionally — skills that matter in real engagements.

OSCP Exam Format

The OSCP exam takes place on an isolated VPN network and runs for exactly 24 hours. Candidates must then use an additional 24 hours to write and submit a professional penetration test report. The total exam window is therefore 48 hours from start to finish.

Points are awarded based on machines compromised: typically a combination of standalone machines worth 10, 20, or 25 points each, plus an Active Directory set worth 40 points. Candidates must reach 70 out of 100 points to pass. Metasploit usage is restricted — only one machine may be exploited with Metasploit's automated modules, pushing candidates to demonstrate manual exploitation skills. The first-attempt pass rate is estimated at 15–25%, making thorough preparation essential.

OSCP Study Guide

Passing the OSCP requires a structured approach across several technical domains. The PEN-200 course curriculum covers: network enumeration, web application attacks, buffer overflows (Windows and Linux), privilege escalation techniques, tunneling and pivoting, client-side attacks, Active Directory exploitation, and controlled Metasploit use. Each topic requires both theoretical understanding and extensive hands-on practice.

Most successful candidates follow a multi-phase preparation strategy. During the first phase, work through all PEN-200 course materials and exercises methodically — do not skip sections even if they feel familiar. In the second phase, shift focus to external lab practice using platforms such as HackTheBox, TryHackMe (the OSCP-like learning paths), or VulnHub machines. Create a personal notes system documenting each attack vector, enumeration command, and privilege escalation technique you encounter. In the final phase before the exam, practice building a report from a mock engagement — many candidates underestimate the reporting component and lose points despite successfully compromising machines.

Key areas where candidates fail: insufficient enumeration (always enumerate fully before attempting exploits), over-reliance on Metasploit, and poor time management during the 24-hour window. Plan your exam strategy in advance: prioritize the Active Directory set (40 points) and two standalone machines (25 points each) — that alone gets you to 90 points if successful.

Penetration Tester Salary

The OSCP certification has a direct and measurable impact on earning potential in the cybersecurity job market. Entry-level penetration testers holding the OSCP typically earn between $90,000 and $130,000 annually in the United States, depending on location, employer type, and specialization. Senior penetration testers, red team operators, and offensive security consultants with 5+ years of experience and OSCP or higher credentials (OSED, OSWE, OSEP) commonly earn $130,000 to $180,000 or more.

The OSCP is explicitly listed as a preferred or required certification in a large percentage of offensive security job postings at top employers including government contractors, financial institutions, Big Four consulting firms, and boutique penetration testing companies. Beyond salary, OSCP holders frequently report faster career progression, access to higher-value client engagements, and eligibility for security clearance positions that require demonstrable hands-on skills rather than knowledge-based certifications.