Please read this entire document carefully before beginning your exam!
INTRODUCTION
This guide explains the objectives of the Offensive Security Wireless Professional (OSWP) certification exam. Section 1 describes the requirements for the exam, Section 2 provides important information and suggestions, and Section 3 specifies instructions for after the exam is complete.
The OSWP certification exam simulates a "live wireless network", which some of the scenarios may contain traffic to the Internet and similar AP’s client behavior in a real network.
You have 3 hours and 45 minutes to complete the exam.
Once the exam is finished, you will have another 24 hours to upload your documentation. Details on how to submit your files are provided below.
SECTION 1: EXAM REQUIREMENTS
Objectives
There are three network scenarios available to attack.
Please note that only one scenario can only work at a time. You can use your exam control panel to change the network scenario. Each scenario is different. You must obtain the wireless key in each scenario using the techniques and methodology shown in Offensive Security Wireless Attacks (PEN-210).
Once you have obtained the required wireless keys, you need to connect to the target Access Point (AP) and gain proof file from the http://192.168.1.1/proof.txt
For any scenario that requires a dictionary to crack the keys, please use any wordlist that is available by default in the provided Kali Linux.
Control Panel Submission
The exam control panel contains a section available to submit your proof files. The contents of the proof.txt files obtained from your exam machines must be submitted in the control panel before your exam has ended. Note that the control panel will not indicate whether the submitted proof is correct or not.
Documentation Requirements
You are required to write a professional report describing your exploitation process for each target. You must document all of your attacks including all steps, commands issued, and console output in the form of a penetration test report. Your documentation should be thorough enough that your attacks can be replicated step-by-step by a technically competent reader.
The documentation requirements are very strict; failure to provide sufficient documentation will result in reduced or zero points being awarded. Please note that once your exam and lab report is submitted, your submission is final. You will not be allowed to send additional screenshots or information, nor will we request such.
Screenshot Requirements
For each scenario, you must provide at least one screenshot of the successfully cracked wireless network key and one screenshot of the proof.txt.
Exam Restrictions
The use of automated tools like wifite, wifiphisher and similar are not allowed.
Downloading any applications, files or source code from the exam environment to your local machine is strictly forbidden unless they're necessary for you to compromise the exam machine, and make sure to delete it after completing the exam objectives. For more information, please refer to OffSec legal documentation.
SECTION 2: EXAM INFORMATION
Exam Connection
Your connection to the exam is to be done with Kali Linux using OpenVPN. We are unable to provide any VPN connectivity support if you choose to use another setup. Your exam connection pack and details will be sent by email at the exact start time of your exam and not in advance after completing the exam prerequisite check with the proctor.
1) Download the exam-connection.tar.bz2 file from the link provided in the exam email to your Kali machine.
2) Extract the file:
┌──(kali㉿kali)-[~]
└─$ tar xvfj exam-connection.tar.bz2
OS-XXXXXX-OSWP.ovpn
troubleshooting.sh
3) Initiate a connection to the exam lab with OpenVPN:
┌──(kali㉿kali)-[~]
└─$ sudo openvpn OS-XXXXXX-OSWP.ovpn
4) Enter the username and password provided in the exam email to authenticate to the VPN:
sudo openvpn OS-XXXXXX-OSWP.ovpn
[sudo] password for kali:
2022-03-08 09:20:05 Note: Treating option '--ncp-ciphers' as '--data-ciphers' (renamed in OpenVPN 2.5).
2022-03-08 09:20:05 OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
2022-03-08 09:20:05 library versions: OpenSSL 1.1.1l 24 Aug 2021, LZO 2.10
Enter Auth Username: OS-XXXXX
🔐 Enter Auth Password: *****************
2022-03-08 09:20:30 TCP/UDP: Preserving recently used remote address: [AF_INET]54.158.192.182:1194
2022-03-08 09:20:30 UDP link local (bound): [AF_INET][undef]:1194
2022-03-08 09:20:30 UDP link remote: [AF_INET]54.158.192.182:1194
2022-03-08 09:20:31 [offensive-security.com] Peer Connection Initiated with [AF_INET]54.158.192.182:1194
2022-03-08 09:20:32 TUN/TAP device tun0 opened
2022-03-08 09:20:32 net_iface_mtu_set: mtu 1500 for tun0
2022-03-08 09:20:32 net_iface_up: set tun0 up
2022-03-08 09:20:32 net_addr_v4_add: 192.168.49.51/24 dev tun0
2022-03-08 09:20:32 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-03-08 09:20:32 Initialization Sequence Completed
You will be provided with a Kali Linux machine with a wireless card that will be used for your attacks against the target machines. To have additional shells available, you have the option of SSH-ing to the provided Kali Linux machine multiple times or by making use of screen. RDP will also be available as an option to connect to the Kali Linux machine.
Passing
You will only pass the exam if you are able to complete and obtain proof.txt on two network scenarios. One of the scenarios will be mandatory to complete, more information will be provided in the exam control panel once your exam starts.
Suggested Documentation Templates
Ideally, one of the following templates should be used to document your exam:
You may use your own template as long as the information is presented in a structured, professional manner and follows all other requirements outlined below.
Internet Connection Issues
This subsection of the exam guide documents what you should do in case you are unable to complete your exam due to severe external factors. Please make sure to read and understand it carefully.
The exam lab is a dedicated environment with no students connected other than yourself. You are expected to have a contingency plan in the event that there is an issue outside your control. (e.g. make sure you have access to a backup Internet connection)
If you have a legitimate issue, please send an email with your OSID to "challenges AT offensive-security DOT com" immediately. Make sure to include all the necessary details and supporting information such as a letter from your power company, ISP or any other relevant documentation.
Please note we are only able to extend the lab time if the issues were present on our side and only when the exam lab is not immediately in use by another student following your exam. In the event of an issue on our side and the exam lab is scheduled immediately following your exam we will provide a free exam retake attempt. We work very hard to ensure our environments are highly available and issues are very rare.
Contact Protocol
If you encounter any connectivity problems with the attacking machine or target access points, inform us immediately. The preferred method of contact is through the live chat available at https://chat.offensive-security.com or via email to "help AT offensive-security DOT com".
Please note that we will not be able to assist with, or give hints on, any exam objectives and will only be available for technical problems during the exam.
All questions related to the exam documentation and submission, or other non-technical exam related issues should be sent to "challenges AT offensive-security DOT com". The live chat administrators will NOT BE ABLE TO HELP you with exam-related queries unless you are having technical issues with the SSH connection or exam environment.
SECTION 3: SUBMISSION INSTRUCTIONS
Submission Checklist:
- Your exam report is in PDF format
- You have used the following format for the PDF file name "OSWP-OS-XXXXX-Exam-Report.pdf", where "OS-XXXXX" is your OSID
- Your PDF has been archived into a .7z file (Please do NOT archive it with a password)
- You have used the following format for the .7z file name "OSWP-OS-XXXXX-Exam-Report.7z", where "OS-XXXXX" is your OSID
- You have made sure that your archive is not more than 300MB and the extracted files are not more than 400MB
- You have uploaded your .7z file to https://upload.offsec.com
Note that the filename is case sensitive. Students must submit their exam file following the exact filename format structure above. If your file does not follow the exact filename format and structure, the application will not accept it.
The following subsections provide details on each of these requirements.
Submission Format and Name
Your exam report must be submitted in PDF format archived into a .7z file. Please make sure to include all your scripts or any PoCs as text inside the exam/lab report PDF file itself. No other file formats will be accepted within the .7z file other than PDF file format.
If you submit your report in any other file format, we will not request or remind you to send a PDF report archived into a .7z file and your exam report will not be scored.
Before submitting your exam report, please review the PDF document to ensure the format and content appear as it did in your original edition document and that there are no formatting errors.
After uploading your exam file to https://upload.offsec.com, the site will provide you with the MD5 hash of your uploaded file.
Please make sure to verify that you have uploaded your report correctly by checking and comparing the MD5 hashes of your uploaded exam file and the file you have locally.
If the values do not match, that means your file did not upload successfully. Click on "Select a new file" and upload your archive again.
┌──(kali㉿kali)-[~]
└─$ sudo md5sum OSWP-OS-XXXXX-Exam-Report.7z
f7feecea01ac1eca9ee522906b087d5e OSWP-OS-XXXXX-Exam-Report.7z
Archive File
Please do not archive your .7z and PDF(s) files with a password. Our system will not accept should you upload password-protected files.
You must submit your documentation in a .7z file.
┌──(kali㉿kali)-[~]
└─$ sudo 7z a OSWP-OS-XXXXX-Exam-Report.7z
OSWP-OS-XXXXX-Exam-Report.pdf
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-8850H CPU @ 2.60GHz
Scanning
Updating archive OSWP-OS-XXXXX-Exam-Report.7z
Everything is Ok
Submission Upload
Please submit your .7z file via https://upload.offsec.com within 24 hours of completion of the exam and follow the provided instructions in order to upload your archived exam report.
The size limit for extracted files is 400MB and the archive is 300MB. If the size constraints are not met, you would not be able to upload your archive. If you are unable to meet the size constraints, we suggest looking at ways to reduce your file size using techniques such as image compression.
After the file has been uploaded, you will be presented with a "Submit File" button where an MD5 hash of your exam report will be displayed. Make sure to click the "Submit File" button after verifying your MD5 hash to submit your files successfully.
If you do not upload your exam-report via https://upload.offsec.com , it will not be graded.
Acknowledgment of Receipt
Once the report is uploaded successfully, a confirmation email will be sent immediately acknowledging the receipt. If you have not received the email, please ensure that you uploaded your report and clicked the Submit File button on the final page of https://upload.offsec.com after verifying your MD5 hash. We also recommend you to check your email spam and junk folders in case the confirmation email has been flagged as spam.
Additional Required Information
In the unlikely event that we require additional clarification on your exam report, we will get in contact with you via email. You must submit the requested information within 24 hours from the time we have requested it.
Results
You will receive an email with your certification exam results (pass/fail) within ten (10) business days after submitting your documentation. Please note that we do not provide the exam score, solutions to the exam targets.