Validates practical penetration testing skills, including enumeration, exploitation, privilege escalation, Active Directory attacks and professional reporting.
OSCP+ has no question bank: you practise on machines, then sit a 24-hour exam with three standalone machines and an Active Directory set. We compared the main options on lab realism, machine variety and price.
Start with OffSec's free Proving Grounds Play and your PEN-200 challenge labs, then add Proving Grounds Practice and a community OSCP-like list for volume, with Hack The Box for variety.
OffSec's free tier of community-built Linux machines from VulnHub, capped at three hours of lab time. It has no Windows or Active Directory machines, so it is a warm-up rather than exam practice.
Great fit if you want to try OffSec's lab style for free before paying for anything.
Poor fit if you need Windows or Active Directory practice or unlimited time; use Proving Grounds Practice.
Two free spreadsheets that pick the Proving Grounds and Hack The Box machines most like the exam. Candidates favour LainKusanagi's list, which is kept current, over TJ Null's older list.
Great fit if you want a ready-made order of machines instead of choosing your own from hundreds.
Poor fit if you want guided teaching; the lists only name machines, so pair them with the PEN-200 course.
The course's nine challenge labs, three of them built to mirror the exam environment. They come with the course, so they cost nothing extra once you are enrolled.
Great fit if you have bought PEN-200 and want an exam-style rehearsal before you book your attempt.
Poor fit if you want volume; candidates add Proving Grounds Practice because nine labs are used up quickly.
More than 200 OffSec-built and community machines with unlimited lab time and new ones added monthly, including retired OSCP+ exam labs. Candidates say it mirrors the exam's style: deep enumeration and a known exploit.
Great fit if you want the most exam-like practice at the lowest price, especially for standalone machines.
Poor fit if you want to learn from scratch with guided lessons, or you need more modern, custom-built attack paths; add Hack The Box.
All retired machines with write-ups, plus strong Active Directory and assumed-breach boxes. Candidates find them more technical and creative than exam machines, and many are outside the OSCP's scope.
Great fit if you want to build general skill and Active Directory depth beyond the exam's style.
Poor fit if you are short on time and want exam-style machines; use Proving Grounds Practice.
Guided rooms and learning paths with an in-browser attack machine. Good for learning the basics, but candidates say the rooms hold your hand more than the exam and are not enough on their own.
Great fit if you are new to pentesting and want guided practice before PEN-200.
Poor fit if you already work through machines unaided; use Proving Grounds Practice or Hack The Box instead.
OffSec: PEN-200 course ↗OffSec: Proving Grounds ↗Reddit: PG vs HTB ↗Reddit: standalone difficulty vs PG ↗Reddit: Lain vs TJ Null lists ↗
OSCP+ has no question-based practice test. Free options are Proving Grounds Play (three hours of lab time), the Hack The Box free tier and the LainKusanagi and TJ Null machine lists.
Candidates say it is the closest, because it uses OffSec's style of enumeration and exploitation. One passer rated the exam's standalone machines between PG medium and hard.
No. Many candidates pass with PEN-200 and Proving Grounds alone, but others add Hack The Box for Active Directory practice and its detailed write-ups.
There is no official number. Candidates work through the Proving Grounds machines on a curated list, repeat the PEN-200 challenge labs and finish with a timed run.