Exam tour
Watch this video for a quick overview on the exam process, from scheduling to submitting your exam report.
This video was current as of October 2022. As we continue to improve the Training Library, slight modifications in the interface or functionality may appear.
Have more questions? Check the frequently asked questions below.
When will the new exam structure become available?
All OSCP exams that are scheduled for or after January 11th, 2022 will be subject to the new exam structure.
Are we getting a new book with the changes?
There is no updated content at this time, as the new exam structure correlates with changes to the course material that were made in February of 2020. As with the rest of the OffSec Library, PEN-200 material is subject to constant updates and improvements over time.
Will Offensive Security release an exam and lab report template for the new exam?
Here is the lab report templates we have created to demonstrate how to report lab machines and a few exercises.
Below are the example exam templates we have created to demonstrate how to report on the exam machines.
How many bonus points can we obtain for the OSCP Exam?
Ten (10) Bonus points may be earned towards your OSCP exam.
Currently, two options are available to earn ten (10) bonus points. Students must satisfy the requirements of one of the options available as we will not be accepting a combination of both methods.
Option 1: 80% of the correct solutions for topic exercises in every topic and thirty (30) correct proof.txt hashes in the Offsec Platform.
Option 2: Legacy Exercises and ten (10) Lab machines
More information about the bonus points requirements can be found here: OSCP Exam Guide
How detailed should my lab report be?
Please note a lab report is not necessary if a student chooses to complete 80% of Topic Exercises and 30 correct proof.txt hashes.
If a student chooses to obtain bonus points using the legacy method then lab reports do not need to be overly long. For the PEN-200 lab machines, we only expect our students to show us the exploitation steps. Enumeration steps and any detailed command outputs are not necessary.
Lab exercises may just contain a screenshot to demonstrate how the exercise was completed.
Exam reports should contain both full enumeration and exploitation steps. You should assume that a technically competent reader will execute every step mentioned in the report in order to validate its accuracy.
Lab reports with exercises must be submitted with the exam report into one .7z archive as explained in the OSCP Exam Guide.
How can I practice Active Directory?
- Read the corresponding Module on Active Directory
- Read the final Module of the PEN-200 Course Material (Assembling the Pieces: Penetration Test Breakdown)
- Follow along and perform all the steps against the Sandbox.local Active Directory environment
- Begin enumerating the PWK labs. Locate and attack all Active Directory sets within the labs.
Is there any pivoting required for the Active Directory machines on the exam?
There may be pivoting required. Anything in the course material is subject to being on the exam.
Are exam restrictions the same?
Yes, the exam restrictions have not changed at this time. More information can be found in the OSCP Exam Guide and the exam restrictions video below.
When 3 boxes are part of an Active Directory network on the exam, how does that affect Metasploit usage? Can we use it through the Active Directory network or only on 1 machine? Would pivoting in a meterpreter session count as 2 uses?
You may only use Metasploit on one target machine, this rule has not been modified. Metasploit cannot be used for pivoting, because it would thereby be used on more than one target.
The exam in the past has required that we read the proof from the desktop location, not somewhere else. What does this mean for PowerShell Remoting? Is PSSession going to count as a shell?
Yes, PowerShell Core counts as an interactive shell and is allowed on the exam.
Is the duration of the exam going to change?
The duration of the exam is not changing at this time. It will remain 23 hours and 45 minutes.
Are the technical requirements the same?
The technical requirements have not changed.
What are the possible scenarios to pass the exam?
- 40 pt AD + 3 local.txt flags
- 40 pt AD + 2 local.txt flags + 1 proof.txt flag
- 40 pt AD + 2 local.txt flags + bonus points
- 40 pt AD + 1 proof.txt + 1 local.txt + bonus points
- 3 fully completed non-AD machines + bonus points
Please make sure to read the SECTION 1: EXAM REQUIREMENTS in the OSCP Exam Guide.
Which tools are allowed for the new exam?
All tools that do not perform any restricted actions are allowed on the exam.
- BloodHound
- SharpHound
- PowerShell Empire
- Covenant
- Powerview
- Rubeus
- evil-winrm
- Responder (Poisoning and Spoofing is not allowed in the labs or on the exam)
- Crackmapexec
- Mimikatz
More information regarding the allowed and restricted tools for the OSCP exam can be found in the Exam Restrictions section in the OSCP Exam Guide
How Do I Know If I'm Ready To Take The Exam?
This is, of course, a very difficult question to answer. In general, we suggest at minimum hacking all the machines in the student network apart from pain, sufferance, and humble. This will give you the bare skills needed to pass the exam. Of course, we cannot guarantee this estimate.
How Do I Schedule My Certification Exam?
If you are studying inside the Training Library, you can schedule your exam directly from the Training library control panel. For more information on how to schedule an exam please view the Important information about exam scheduling in the Training Library article.
If you are studying outside the Training Library, you can schedule your exam using the link that was provided to you in your course welcome pack. If you’re unable to locate it, please submit a request here, and we will be happy to re-send it to you.
How Can I Find Out My Exam Score?
Your exam score will be provided in the exam certification results email. Additionally, you can use the point assignment outlined in the exam guide to approximate your score. Partial points can also be awarded for systems where full root access is not achieved.
What Is The Exam Retake Policy?
All exams have a cooling off period in between attempts. You can view additional details on the cooling off period here.
How Many OSCPs Are There? What Is The Pass/Fail Rate?
We do not release the number of people that hold our certifications or the success rate of completion for them. The exam-taking experience and perceived difficulty is different for everyone and we don't want to needlessly discourage or encourage students with numbers based on success or failure.
STILL HAVE QUESTIONS?
Chat with the Offensive Security Support Team