OSCP

Overview

OSCP (Offensive Security Certified Professional) is widely considered the gold standard for penetration testing certifications. Unlike theory-based exams, OSCP requires you to actually hack into systems during a grueling 24-hour practical exam.

The OSCP motto is "Try Harder", reflecting the determination needed to pass.

Where OSCP stands in 2026

The November 2024 split is the change to internalise: passing PEN-200 now hands you both OSCP (lifetime, the brand recruiters still ask for) and OSCP+ (three-year validity, renewable via the OffSec CPE program, a recert exam, or another qualifying OffSec exam). The exam itself is unchanged in 2026 — 23 hours 45 minutes of hands-on hacking, 24 hours to write the report, 70/100 to pass — and the Active Directory set is still mandatory, still worth 40 points, and still has no bonus points to soften a missed AD chain. Pricing is in USD because OffSec bills in USD: the PEN-200 bundle is $1,749 (90 days of labs + one attempt), Learn One is $2,749/year (two attempts), Learn Unlimited is $6,099/year. ZipRecruiter's April 2026 data puts the average US OSCP-tagged salary at $119,895/year, which lines up with the $120K post-OSCP benchmark we use elsewhere in this guide. None of that is the reason to take it — the reason is that the report you write is the closest thing to a junior pentester deliverable you'll have on file.

Who Should Get This Certification?

OSCP is designed for:

• Aspiring penetration testers wanting to prove practical skills
• Security professionals transitioning to offensive roles
• Red team members seeking validation
• Bug bounty hunters wanting formal recognition
• Security engineers wanting deeper offensive knowledge

Prerequisites: While not required, you should have:

• Solid Linux and Windows administration skills
• Networking knowledge
• Basic scripting ability
• Familiarity with security concepts

Exam Format

The OSCP exam is a 24-hour practical test:

• 3 stand-alone machines (20 points each)
• 1 Active Directory set (40 points)
• Passing score: 70 points out of 100
• 24 additional hours to write a professional report
• No multiple choice, you must actually compromise systems

Study Timeline

What's Included

The PEN-200 (OSCP) course includes:

• 850+ page PDF coursebook
• 17+ hours of video content
• Access to lab environment (30, 60, or 90 days)
• One exam attempt (additional attempts cost ~€230 / $249 USD)

Why OSCP Is Highly Valued

1. Proves practical skills - No memorization, only hands-on ability
2. Industry recognition - Respected across all security roles
3. Job requirement - Often required for senior pentest positions
4. Community prestige - "OSCP" after your name carries weight

OSCP vs. Other Certs

Detailed Exam Walkthrough

What to Expect on Exam Day

The OSCP exam is unlike anything in the certification world. You receive a VPN connection pack via email at your scheduled start time. Once connected, you gain access to a network of target machines. You have exactly 23 hours and 45 minutes to compromise as many targets as possible and collect proof files (local.txt and proof.txt) from each. After the hacking phase ends, you get an additional 24 hours to write and submit a professional penetration testing report.

The exam environment is proctored via webcam and screen sharing. You must keep your camera on for the entire 24 hours. You can take breaks for food, coffee, and sleep, but your camera must remain active. The proctor will flag any suspicious activity.

Time Management Strategy

Do not spend more than 2 hours on any single machine during your first pass. Start with the Active Directory set (40 points) because it offers the highest point value and, once you find the initial foothold, the chain of compromise often follows logically. Then move to the stand-alone machines. Aim to have 70+ points within the first 12 to 14 hours so you can spend the remaining time on documentation and any final attempts.

Take a 15 minute break every 3 to 4 hours. Eat real meals. Fatigue is the number one reason candidates fail who had the technical skills to pass. Many successful OSCP holders report sleeping for 3 to 4 hours during the exam and returning with fresh eyes to crack a machine they were stuck on.

Common Mistakes

The biggest mistake is rabbit-holing: spending 5+ hours on a single machine while ignoring easier targets. Another common failure is poor note-taking. If you cannot reconstruct your exploitation steps from your notes, you cannot write the report, and an incomplete report means lost points even on machines you compromised. Always document commands, screenshots, and output as you go.

Study Strategy and Resources

Recommended Study Path

The ideal OSCP preparation follows three phases: Foundation (1 to 2 months), where you build core skills in networking, Linux, and scripting; Course (2 to 3 months), where you work through the PEN-200 material and lab machines; and Practice (1 to 2 months), where you sharpen your skills on external platforms.

Best Resources

Included with OSCP:

• The PEN-200 coursebook (850+ pages) and video content are comprehensive but dense. Do not skip the exercises; they build muscle memory.
• The OffSec lab environment is your primary practice ground. Aim to compromise at least 40 to 50 lab machines before attempting the exam.

External platforms (essential supplements):

• Hack The Box (subscription ~$14/month): The "OSCP Prep" pathway and retired machines with community walkthroughs are invaluable. Aim for 20 to 30 boxes.
• TryHackMe (subscription ~$14/month): Better for beginners building foundations. The "Offensive Pentesting" path aligns well with OSCP topics.
• Proving Grounds Practice ($19/month from OffSec): The closest experience to actual OSCP exam machines. This is the single best supplement.
• IppSec's YouTube Channel (free): Watch walkthroughs of Hack The Box machines. His methodology demonstrations teach you how to think through problems.

Books:

• "The Web Application Hacker's Handbook" by Dafydd Stuttard for web attacks
• "Linux Privilege Escalation for OSCP" guides on GitHub (multiple free resources)

Study Schedule

Lab Recommendations

Beyond the OffSec labs, build your own practice environment. Use VulnHub (free) to download vulnerable VMs. Set up an Active Directory home lab with at least two Windows machines and a domain controller; AD exploitation is now worth 40% of the exam.

Real World Career Impact

Job Roles That Require OSCP

OSCP is the most requested certification in penetration testing job postings. Roles that frequently require or strongly prefer it include: Penetration Tester, Red Team Operator, Offensive Security Engineer, Application Security Tester, and Security Consultant (offensive). At the senior level, OSCP is often the minimum baseline, with OSEP or OSED expected as additional qualifications.

Salary Data by Region

How Recruiters View OSCP

In offensive security hiring, OSCP is the single strongest signal on a resume. Recruiters and hiring managers know that an OSCP holder has proven they can independently compromise systems under time pressure. Unlike theory-based certifications, there is no way to pass OSCP without genuine hands-on ability. Many job postings in penetration testing list "OSCP or equivalent practical experience" as a hard requirement.

Career Progression

OSCP opens doors to mid-level and senior penetration testing roles immediately. From there, the typical path is: OSCP (Penetration Tester), then OSEP/CRTO (Senior Pentester/Red Team Lead), then management or specialization (AppSec, Cloud Security, or Red Team Director). Many OSCP holders transition into independent consulting within 3 to 5 years, where day rates range from $1,500 to $3,000.

Cost Breakdown and ROI

Total Investment 2026

OffSec updated OSCP pricing in 2025. The bundles available in 2026 are listed below. EUR amounts are approximate (OffSec bills in USD).

Renewal

OSCP does not expire. Once earned, you hold it for life with no renewal fees, no continuing education requirements, and no annual maintenance. This is a significant advantage over certifications like CEH or Security+ that require periodic renewal.

ROI Calculation

With an average salary increase of $35,000 per year and a total investment of approximately $2,000, OSCP delivers a 1,650% return in the first year. For many professionals, OSCP represents the single highest-ROI career investment they will ever make. Even if you need two attempts, the ROI remains extraordinary.

Saving Money

OffSec occasionally runs promotions around Black Friday and during cybersecurity awareness month (October). Eligible US learners can split enrollment into 3 to 4 interest-free payments or finance through Klarna. The Learn One annual subscription (~€2,530 / $2,749 USD) provides access to PEN-200 plus another 200 or 300-level course, the associated labs, and two exam attempts; it is more cost effective if you plan to pursue OSEP, OSWE, or OSWP afterward. Some employers fund OSCP preparation as professional development; present it as an investment that directly improves your organization's security testing capabilities.

OSCP vs OSCP+ Designations

OffSec introduced the OSCP+ designation in November 2024. Anyone who passes the OSCP exam after that date is awarded both designations automatically. The two differ only in validity and renewal, not in difficulty or recognition.

Existing OSCP holders who passed before November 2024 keep their lifetime credential. They can opt into OSCP+ by completing one of the renewal paths if they want the more recent designation. If you do not renew OSCP+, the lifetime OSCP credential is retained.

For most working pentesters, the choice is clear: pass once, hold the lifetime OSCP, and decide whether to maintain the plus designation based on whether your employers, clients, or job postings explicitly require it.

Where the Bootcamp Fits

OSCP demands prerequisites that are not always in place when career-changers attempt it directly. The Unihackers Cybersecurity Bootcamp builds the foundation that turns OSCP from a wall into a realistic next step:

• Unit 1 covers Linux and Windows lab workstations, virtualization, and Bash and PowerShell command-line essentials
• Unit 2 covers networking fundamentals, packet capture, and core security concepts
• Unit 9 covers web application attacks (OWASP Top 10), which represent a significant share of OSCP exam machines
• Unit 10 introduces penetration testing methodology, reconnaissance, exploitation basics, privilege escalation, and offensive tooling (Nmap, Metasploit, Burp Suite)

Graduates who target OSCP typically attempt the exam six to twelve months after the bootcamp, after dedicated lab time on Hack The Box and Proving Grounds. See the security-plus to OSCP pathway for the full progression.

Preparation Checklist

Am I Ready? Self-Assessment

Before purchasing PEN-200, you should be able to:

• Navigate Linux and Windows command lines fluently (directory traversal, file manipulation, user enumeration)
• Write basic Python or Bash scripts to automate repetitive tasks
• Explain what a reverse shell is and set one up using Netcat
• Use Nmap to perform service enumeration and interpret the results
• Understand basic web vulnerabilities: SQL injection, XSS, directory traversal

Prerequisite Skills Checklist

• Comfortable with Linux terminal (cd, ls, grep, find, chmod, ssh)
• Can write a Python script with sockets and string manipulation
• Understand TCP/IP: ports, protocols, three-way handshake
• Familiar with Burp Suite for web application testing
• Can set up and use a Kali Linux VM
• Basic understanding of Active Directory: domains, users, groups, GPOs

When to Attempt the Exam

Schedule your exam only after you have: completed all PEN-200 exercises, compromised at least 40 OffSec lab machines, completed 20+ Hack The Box or Proving Grounds machines, and documented your methodology for each major attack type. If you can root a medium-difficulty Hack The Box machine in under 2 hours, you are likely ready.

Mental Preparation

OSCP is a test of persistence as much as skill. You will get stuck. You will feel frustrated. That is the point. The "Try Harder" mentality is not about brute force; it is about systematically enumerating every possibility before concluding you have hit a dead end. During the exam, if you feel stuck, walk away, take a break, and come back. Clarity often arrives after rest.

Insider Tips from OSCP Holders

What the Official Guide Doesn't Tell You

The exam machines are designed to be solvable with the tools and techniques taught in PEN-200. If you find yourself using obscure 0-day exploits or extremely complex attack chains, you are likely overthinking. The intended path is usually simpler than you expect.

Enumeration is everything. At least 80% of your time should be spent on information gathering and enumeration, not running exploits. The candidates who fail are typically the ones who jump to exploitation too quickly without thoroughly understanding what services are running and how they interact.

Your report matters more than you think. OffSec has failed candidates who compromised enough machines for a passing score but submitted inadequate reports. Use screenshots for every significant step. Document the exact commands you ran. Explain your reasoning.

Community Resources

• r/oscp on Reddit is the primary community. Sort by "Top: All Time" and read every post.
• The NetSecFocus Trophy Room spreadsheet tracks which Hack The Box machines are most similar to OSCP targets.
• Discord servers: "InfoSec Prep" and "Hack The Box" Discord servers both have active OSCP channels.
• OffSec's official Discord provides direct access to student support.

Scheduling Strategy

Schedule your exam to start on a Friday or Saturday morning. This gives you the full 24 hours over a weekend when you are less likely to have work obligations. Start at 8:00 or 9:00 AM so your most productive hours align with the beginning of the exam when your energy is highest. Avoid starting in the evening; fatigue will compound as the night progresses.

The 48 Hours Before

Stop practicing 48 hours before the exam. Cramming new techniques at the last minute creates confusion. Instead, review your personal notes and methodology cheat sheets. Prepare your snacks, meals, and caffeine supply. Test your VPN client and webcam. Get two full nights of sleep. You have trained for months; trust your preparation.