Offensive Security Experienced Penetration Tester (OSEP)
Demonstrate advanced penetration testing competence in evading modern antivirus and EDR defenses, process injection, custom shellcode development, AppLocker and CLM bypasses, advanced Active Directory attacks, and cross-forest trust exploitation.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The OSEP is an advanced, high-stakes penetration testing certification from OffSec (PEN-300) validating advanced evasion techniques, custom exploit creation, EDR bypassing, and Active Directory compromise.
The OSEP is a grueling 48-hour hands-on practical exam in a hardened corporate enterprise network simulation, followed by an additional 24 hours to submit a professional technical report.
Candidates must score at least 100 points out of a possible 100+ points across multiple target systems, or retrieve the secret 'flag.txt' from the final Domain Controller target system.
Domains include: (1) Client-Side Attacks with Office Documents, (2) Antivirus & EDR Evasion, (3) Windows API Shellcode Execution & Process Injection, (4) Process Hollowing & Hooking, (5) Bypassing AppLocker & CLM, (6) Advanced Lateral Movement, and (7) Active Directory Multi-Forest Exploitation.
While OSCP focuses on basic exploitation and finding known vulnerabilities, OSEP focuses on bypassing hardened modern defenses (Antivirus, EDR, AppLocker, CLM, AMSI, Firewalls) using custom shellcode, process injection, and living-off-the-land techniques.
AMSI is a Windows interface allowing AV/EDR to inspect in-memory scripts (PowerShell, VBScript). OSEP teaches memory patching techniques (overwriting amsiScanBuffer in memory) to disable inspection at runtime.
Classic DLL Injection, Process Hollowing, Process Doppelgänging, Thread Hijacking, Early Bird APC Queue injection, and reflective DLL loading.
Using Microsoft-signed binaries (LOLBins like InstallUtil, MSBuild, regasm, mshta), unmanaged C# PowerShell runspaces, and custom COM object hijacking.
Exploiting Unconstrained Delegation (stealing TGTs), Constrained Delegation with Protocol Transition (S4U2self / S4U2proxy), and Resource-Based Constrained Delegation (RBCD).
C# is the primary language used to build custom loaders, shellcode runners, memory injectors, and bypasses due to its deep integration with the Win32 API via P/Invoke.
Bypassing Linux AppArmor/SELinux profiles, shared library hijacking (LD_PRELOAD), exploiting Linux capabilities, and evading host-based intrusion detection systems.
Senior penetration testers, red team operators, offensive security researchers, and security consultants seeking advanced evasion and exploitation mastery.