Validates practical penetration testing skills, including enumeration, exploitation, privilege escalation, Active Directory attacks and professional reporting.
The OSCP+ exam is a proctored, hands-on penetration test in a private lab network. You are scored on the machines you compromise and on how well your report documents the work. Study the PEN-200 material and challenge labs, build a repeatable method on practice machines, then rehearse a full 24-hour run with a complete report.
The score comes from the machines, not from topic weights, and the exam can draw on any PEN-200 module.
Example scenario: A target shows a web login page and an older service banner on a second port. What would you record and check on both services before attempting any exploit?
Example scenario: You have a low-privilege shell on a Linux host. Which system details would you collect to decide where privilege escalation is most likely?
Example scenario: You start the Active Directory set with a low-privilege domain account. What would you map first to plan a path toward the domain controller?
Example scenario: You captured a proof file but did not screenshot the command that produced it. What does your report need so a reviewer can reproduce the step?
OSCP+ Body of Knowledge · PEN-200 course syllabus
Compromise a target on your own: gain initial access, escalate privileges, and retrieve the proof files from an interactive shell for 20 points per machine.
A standalone Linux target runs a web application and SSH. Put these tasks in the order you would complete them to earn its 20 points.
Enumerate, foothold, escalate, then proof. Initial access (10 points) comes with local.txt; root access (10 points) comes with proof.txt, shown in a screenshot of an interactive shell with the target's IP address.
Start with a given domain username and password and compromise three linked machines, worth 10, 10 and 20 points, for 40 points in total.
You are given a low-privilege domain account for an Active Directory set. Put these tasks in a sensible order.
Enumerate the domain, compromise the first machine, move on to the second, then compromise the third. Each step uses what the previous one revealed.
Write a professional report that documents every attack with commands, output and screenshots so a technical reader can reproduce it, and submit it as a PDF inside a .7z archive within 24 hours of the exam ending.
Which of these must each proof file screenshot show?
A. Each screenshot must show the contents of local.txt or proof.txt together with the target's IP address.
Buy the PEN-200 Course + Cert Bundle, a Learn One subscription or the standalone exam, then schedule the exam from your OffSec account. There is no application or eligibility review.
Build the recommended networking, Linux, Windows and scripting background first, then plan your course and lab time around the exam.
Most candidates spend 200–400 hours. Plan for the low end if you already do penetration testing; add time if Active Directory, Linux or scripting is new to you.
PEN-200 is the required course and the only one that includes the exam. Practice platforms fill the gap between the course and the exam.
See all 2 OSCP courses →Build a notes system early. Keep searchable notes and a per-step command log as you practise, so the exam and its report are a routine you already know.
Practise on machines you have not seen before and run full timed rehearsals under the real rules. Treat the report as part of every rehearsal.
See all 6 OSCP practice tests →The exam is fully remote and proctored. Confirm your setup before the day and plan rest into the 24 hours.
Reschedule up to 48 hours before the start. After a failed attempt you wait 4 weeks, then 8, then 12 for later attempts. Results arrive by email within ten business days.
A candidate who passed with 90 points said a rigid, practised method and thorough enumeration mattered far more than how many notes they kept. They built their method on HTB and Proving Grounds machines before paying for the course.
A candidate who failed first on the AD machines spent the gap before their retake working through dedicated AD practice, then passed with 80 points. The AD set is 40 of the 100 points.
A candidate who scored 100 points in seven hours went in with a written hour-by-hour plan for pushes, meals, breaks and sleep. They treated rest and pacing as part of the exam, not an afterthought.
One candidate needed four attempts over four years, with a CISSP and a master’s degree along the way, and described the pressure as real. Their advice was to take a break rather than push through burnout.
Best official course