OSCP - Fact Sheet¶

Quick Reference¶

Exam Code: OSCP (course PEN-200) Format: Practical hands-on lab; full report submission Practical Duration: 23 hours 45 minutes Report Window: 24 hours after the practical ends Total Points: 100 (70 to pass) Cost: $1,599 USD (Learn One bundle: course, labs, exam, one retake) Validity: OSCP is lifetime. OSCP+ (introduced 2024) is renewable every 3 years. Delivery: Remote, OffSec proctoring (webcam, screen share, room scan) Prerequisites: None enforced; Linux comfort, Bash, basic Python, networking expected

OSCP exam page Exam guide Discord | Reddit r/oscp

Scoring Breakdown¶

Tooling Restrictions (high-yield)¶

• Metasploit / Meterpreter: allowed on exactly one machine. Once you use any exploit, auxiliary, or post module against a host, that host is your "Metasploit machine" for the exam.
• msfvenom: not restricted. Use it freely for payload generation.
• Forbidden everywhere: automated scanners (Nessus, OpenVAS, Nexpose, Burp Pro active scan, Acunetix), commercial exploit packs (Core Impact, Canvas, Cobalt Strike).
• Manual exploitation required for every other host. SOCKS proxies + manual scripts are fine.

Domains / Topics (current syllabus, post-2023)¶

Buffer overflow is REMOVED from the current syllabus and exam (post-2023).

Lab Environment¶

• OffSec PG Practice - the official practice ground; subscription-based, machines added regularly
• OffSec PWK Lab - included with Learn One; ~50 machines, AD network with multiple chains
• HackTheBox - the gold-standard supplementary platform. The community-maintained "TJ_NULL OSCP-like" list is the canonical training set
• TryHackMe - friendlier on-ramp; "Offensive Pentesting" path is OSCP-aligned
• VulnHub - free downloadable VMs; older but still teaches enumeration
• Proving Grounds Play - free OffSec-hosted practice (small subset)

Reporting¶

The 24-hour report window is mandatory and graded. A perfect lab run with a poor report can fail.

Report must include: - Executive summary - Methodology - Per-machine: enumeration steps, vulnerability identification, exploitation, post-exploitation, proof.txt and local.txt screenshots - All commands and tool output (copy/paste, not screenshots of terminals) - Cleanup steps

Use the OffSec exam report template unless you have a strong reason not to.

High-Leverage Practice¶

Track the TJ_NULL OSCP-like list. It's grouped by difficulty and updated by the community to mirror exam style.

Recommended weekly cadence in the final 4-8 weeks: - 1-2 standalone Linux boxes per week - 1-2 standalone Windows boxes per week - 1 AD chain per week (TJ_NULL "AD-style" or HTB Pro Labs / Dante) - Time each box; aim for 3 hours from connect to root once you're in flow

Common Exam Failure Modes¶

• Tunnel vision - 2 hours stuck on one foothold while the AD chain sits untouched. Set a 30-min cap; rotate.
• Skipping enumeration - "I'll come back to that port" → never came back → missed the box.
• No notes - getting lost in 6 machines × multiple footholds without a notebook is a known failure mode. Use Obsidian, CherryTree, KeepNote, or just per-host markdown.
• Bad reporting - 70 lab points but the report is missing screenshots of proof.txt → fail.
• Burning the Metasploit token early - using MSF on the first easy box and then needing it later for the AD entry. Save it.
• Sleep deprivation - 24 hours of red-bull is the wrong strategy. Plan a 4-6 hour sleep break in the middle.

Renewal (OSCP+)¶

• OSCP (legacy): lifetime, no renewal.
• OSCP+ (introduced 2024): valid 3 years; renewable via:
• Continuing Education credits (e.g., other OffSec courses), or
• Re-passing the OSCP exam.

Cost¶

Plan total budget: $1,800 - $2,500 including practice subscriptions and a likely retake.