Offensive Security Certified Professional (OSCP)
Demonstrate practical, hands-on mastery of manual penetration testing methodologies, exploiting vulnerable network services, web applications, privilege escalation on Linux and Windows, and Active Directory exploitation.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The OSCP is the industry's gold standard hands-on practical penetration testing certification issued by OffSec, validating real-world technical exploitation skills and the 'Try Harder' mindset.
The OSCP is a 24-hour proctored hands-on practical penetration testing exam, followed by an additional 24 hours to write and submit a professional, executive-grade penetration testing report.
Candidates must score at least 70 out of 100 points, earned by compromising target machines, escalating privileges, and obtaining proof flags, with an Active Directory set worth 40 points.
Domains include: (1) Reconnaissance & Enumeration, (2) Web Application Exploitation, (3) Finding & Fixing Public Exploits, (4) Antivirus Evasion & Shellcode, (5) Windows & Linux Privilege Escalation, (6) Pivoting & Port Forwarding, and (7) Active Directory Exploitation.
The exam features an Active Directory network set consisting of 2 domain clients and 1 Domain Controller. Candidates must compromise an initial foothold, perform lateral movement and privilege escalation, and fully compromise the Domain Controller for 40 points.
Commercial tools like Burp Suite Pro, SQLmap, and automated vulnerability scanners are strictly forbidden. Metasploit Framework (and Meterpreter) may be used on only one single target machine during the entire exam.
Identifying misconfigured sudo privileges (sudo -l), SUID binaries (find / -perm -u=s), cron jobs with writable scripts, unquoted paths, capabilities (getcap), and readable sensitive files (/etc/shadow, SSH keys).
Exploiting unquoted service paths, weak service binary permissions, writable service registries, DLL hijacking, AlwaysInstallElevated registry keys, SeImpersonatePrivilege token abuse (Potato exploits), and stored credentials.
SSH local and dynamic port forwarding (ssh -L / ssh -D), Chisel reverse tunnels, Ligolo-ng, Plink, Socat, and Proxychains.
SQL Injection, Local File Inclusion (LFI) to Remote Code Execution (RCE) via log poisoning, Remote File Inclusion (RFI), Command Injection, File Upload filter bypasses, and Server-Side Template Injection (SSTI).
Detailed step-by-step reproduction steps for every compromised machine, full unedited screenshots showing the ipconfig/ifconfig and proof flag, commands executed, and actionable remediation recommendations.
Penetration testers, security analysts, red teamers, ethical hackers, and security engineers seeking rigorous proof of practical manual exploitation capabilities.