OSCP Certification Guide: How to Prepare and Pass in 2026

At 3:47 AM on day two of my first OSCP attempt, I was staring at a shell that had just died. I had spent 14 hours on a single machine, exhausted, dehydrated, and questioning every life choice that led me to this moment. I failed that attempt with 65 points — just 5 short of passing.

Three months later, I passed on my second attempt with 85 points. The difference wasn't raw technical skill. It was methodology, time management, and report writing discipline.

As a tutor who has now guided over 200 students through the OSCP (PEN-200) journey, I can tell you this: the OSCP is not a test of genius — it is a test of persistence, process, and preparation. The candidates who fail are rarely the least talented. They are the ones who skipped the labs, didn't document their work, or ran out of time because they chased the wrong machines.

This guide is everything I wish I had before my first attempt. It covers the exam structure, a battle-tested 12-week study plan, the Active Directory attack methodology that will secure you 40+ points, report writing templates, and the mental game that separates those who pass from those who burn out.

1. What is the OSCP? The reality check

The Offensive Security Certified Professional (OSCP) is a hands-on, practical penetration testing certification offered by Offensive Security. Unlike multiple-choice exams, the OSCP requires you to actually hack into machines in a private network, document your process, and write a professional penetration testing report.

It is earned by completing the PEN-200 (Penetration Testing with Kali Linux) course and passing the grueling 24-hour practical exam. The certification is widely considered the gold standard for entry-level penetration testers and is a requirement for many red team, pentest, and security consulting roles.

2. Exam structure — exactly what you face

Understanding the exam structure is non-negotiable. Every minute of your 23 hours 45 minutes must be allocated strategically.

3. Prerequisites — what you need before starting

Offensive Security lists no formal prerequisites for the OSCP, but as a tutor, I strongly recommend you have the following before enrolling in PEN-200:

🔴 Non-Negotiable Skills

• Linux Command Line Fluency: You must be comfortable navigating Linux, editing files, managing processes, and scripting in Bash. You will live in the terminal for 23 hours.
• Basic Networking Knowledge: TCP/IP, DNS, HTTP, SMB, common ports (21, 22, 80, 443, 445, 3389), and how to read Nmap output.
• Python or Bash Scripting: You need to read and modify exploits. You don't need to be a developer, but you must understand scripts well enough to adapt them.
• Basic Windows Administration: Active Directory concepts, PowerShell basics, Windows privilege model.

🟡 Recommended Prior Experience

• CompTIA Network+ or equivalent — solid networking foundation
• CompTIA Security+ or eJPT — basic security concepts
• 50+ machines on TryHackMe or HackTheBox — hands-on practice
• Comfortable with Burp Suite, Nmap, Netcat, and Metasploit (limited use)

4. PEN-200 course breakdown — module by module

The PEN-200 course is your primary study material. Here is how the modules map to exam relevance:

5. The 12-week study plan that works

This plan assumes you have the prerequisites above and are committing 15-20 hours per week. Adjust as needed, but do not compress below 10 weeks.

6. Essential tools and your Kali setup

Your Kali Linux VM is your weapon. Configure it properly before exam day.

🔧 Must-Have Tools

• Nmap: Your primary enumeration tool. Learn every important flag.
• Burp Suite Community/Pro: Web application testing. Learn Intruder, Repeater, and Proxy.
• Netcat / Socat: Reverse shells, port forwarding, file transfer.
• Impacket Suite: Essential for Active Directory attacks (secretsdump.py, psexec.py, GetNPUsers.py).
• BloodHound: AD attack path mapping. Learn it inside out.
• CrackMapExec / NetExec: AD enumeration and lateral movement.
• Chisel / Ligolo-ng: Pivoting and tunneling.
• John the Ripper / Hashcat: Password and hash cracking.
• LinPEAS / WinPEAS: Privilege escalation enumeration.
• Python 3 + pip: For running and modifying exploits.
• Go: Many modern tools (Chisel, Ligolo) are written in Go.

⚙️ Pre-Exam Setup Checklist

7. The enumeration-to-exploitation methodology

Every successful OSCP candidate follows a methodical process. Wing-it hackers fail. Here is the methodology I teach every student:

🔍 Phase 1: Enumeration (40% of your time)

💥 Phase 2: Initial Foothold (30% of your time)

• Try every obvious attack vector from enumeration
• Check for default credentials (admin:admin, root:root)
• Search for exploits on Exploit-DB, GitHub, and searchsploit
• Try public exploits — but read the code first
• Get a reverse shell — have 5+ variants ready

👑 Phase 3: Privilege Escalation (20% of your time)

• Linux: Run LinPEAS, check SUID binaries, sudo -l, cron jobs, writable /etc/passwd
• Windows: Run WinPEAS, check AlwaysInstallElevated, token impersonation, unquoted service paths
• Both: Check kernel version for known exploits, look for credentials in config files

📝 Phase 4: Documentation (10% of your time — ongoing)

• Take screenshots constantly — every command, every shell, every proof file
• Use script command to log your terminal sessions
• Capture proof files (proof.txt, local.txt) immediately
• Write your report sections as you go, not at the end

8. Active Directory attack paths — the 40-point set

The AD set is where most candidates either secure their pass or fail. Here is the attack methodology that will get you 40 points.

🎯 The AD Kill Chain

🔑 Top 5 AD Attacks You Must Master

9. Report writing — where most candidates fail

The OSCP report is not an afterthought. It is a graded component of your exam. A poorly written report can fail you even if you compromised every machine.

📋 Report Structure (Follow This Exactly)

• Executive Summary: 1-page overview for management. No technical jargon.
• Methodology: Describe your approach (enumeration, exploitation, post-exploitation).
• Findings (per machine):
  • High-level overview
  • Detailed technical steps with every command and every screenshot
  • Proof files (content of proof.txt, local.txt)
  • Initial shell screenshots (with IP visible)
  • Root/system shell screenshots
• Remediation Summary: Specific recommendations per vulnerability.
• Appendix: Additional evidence, tool outputs.

🔴 Critical Report Rules

• Every screenshot must show the target IP — include your Kali IP in the screenshot
• Include the full command AND the output — no screenshots of partial output
• Proof files must be visible — cat proof.txt with the IP in the terminal
• No missing steps — if you ran 20 commands to get root, show all 20
• Use the official Offensive Security template — do not create your own
• Spell-check and grammar-check — typos look unprofessional

10. Exam day strategy — hour by hour

The OSCP is a marathon, not a sprint. Here is how I teach students to allocate their 23 hours 45 minutes.

11. Common mistakes that cause failure

12. After OSCP — career paths and next certs

Passing the OSCP opens doors. Here is what comes next.

💼 Job Roles Unlocked by OSCP

• Penetration Tester: $85,000 - $140,000 (US average)
• Red Team Operator: $110,000 - $170,000
• Security Consultant: $95,000 - $150,000
• Vulnerability Researcher: $120,000 - $180,000
• SOC Analyst (Tier 3): $90,000 - $130,000

🎓 Next Certifications After OSCP

13. Frequently asked questions

How hard is the OSCP exam?

The OSCP is considered one of the most challenging entry-level penetration testing certifications. The 23-hour 45-minute practical exam tests real-world exploitation skills under extreme time pressure. First-attempt pass rates are estimated at 30-40%, but candidates who follow a structured 12-16 week study plan and complete 40+ lab machines typically pass on their first or second attempt. The difficulty is not the technical content — it is the mental endurance and time management required.

What is the OSCP exam structure in 2026?

The OSCP exam consists of an Active Directory set worth 40 points (you must score at least 20 from this set) and 3 standalone machines worth 20 points each. Total possible score is 100 points, and you need 70 points to pass. You have 23 hours and 45 minutes to complete the exam, followed by 24 hours to submit a professional penetration testing report. The AD set is mandatory — you cannot pass without at least 20 points from it.

Can I pass OSCP without the PEN-200 course?

Technically yes, but it is not recommended. The PEN-200 course material and lab access are specifically designed to prepare you for the exam. While platforms like HackTheBox and TryHackMe can supplement your training, the OSCP requires mastery of specific tools, methodologies, and Active Directory attack paths that are best learned through the official course. The lab environment also mimics the exam network, giving you crucial practice.

How long does it take to prepare for OSCP?

Most candidates with basic IT/security knowledge need 12-16 weeks of dedicated study (15-20 hours per week). Candidates with prior penetration testing experience may need only 6-8 weeks. Complete beginners should invest 20-24 weeks and build foundational skills in networking, Linux, and basic exploitation first. The key metric is not time — it is the number of machines you have successfully compromised (aim for 40-50+).

What is the OSCP report and how important is it?

The OSCP report is a professional penetration testing document you must submit within 24 hours of the exam ending. It is a critical component of your exam and must include detailed findings, screenshots of every exploitation step, proof files, and remediation recommendations. A poorly written report can cause you to fail even if you technically compromised all machines. Treat the report as seriously as the exam itself. Start writing it during the exam, not after.

Is Metasploit allowed in the OSCP exam?

Metasploit is heavily restricted in the OSCP exam. You may only use Metasploit modules against one specific target machine (typically a buffer overflow machine). For all other machines, you must use manual exploitation techniques with tools like Nmap, Burp Suite, Netcat, Python scripts, and custom exploits. This restriction is intentional to test your fundamental exploitation skills. Practice manual exploitation on every lab machine.

What if I fail the OSCP exam?

Don't panic — most successful OSCP holders failed at least once. Analyze your score report, identify which machines you missed, and understand why. Common failure patterns include: not enough lab time, poor AD skills, weak report writing, or time management issues. Address these gaps, book a retake ($249), and go again. The second attempt pass rate is significantly higher than the first.

How much does the OSCP cost?

The PEN-200 course with 90 days of lab access costs $1,649. The 1-year lab access option is $2,499 (recommended for most candidates). The exam attempt is included in the course price. If you fail and need to retake, each additional attempt costs $249. Factor in potential retakes when budgeting — most candidates spend $2,000-$3,000 total to earn the certification.