Skip to content
CertGPS

OffSec Certified Professional

Proctored 24-hour practical with an Active Directory set; passing now awards lifetime OSCP plus a three-year OSCP+

AdvancedOffSec

The exam

Exam cost
$1,699
Study time
3-6 months
Passing score
70 of 100 points
Valid for
OSCP lifetime; OSCP+ three years, renewable

Before you book

  • No formal prerequisites
  • Recommended: solid understanding of TCP/IP networking
  • Recommended: Windows and Linux administration experience
  • Recommended: basic Bash or Python scripting

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Certified Ethical Hacker

    Intermediate

    Comes before. Broad attack and tool vocabulary before OSCP makes you chain everything by hand

  2. CompTIA PenTest+

    Intermediate

    Comes before. Teaches pentest scoping and reporting before the 24-hour practical exam

  3. OffSec Certified Professional

    You are here

Study guide

Last updated

OSCP Study Guide: OSCP+, the 24-Hour Exam, Costs and Renewal

The OffSec Certified Professional shows that you can break into Windows and Linux machines and an Active Directory domain on your own, inside 23 hours and 45 minutes, and then write it up well enough for someone else to repeat. Pass the exam today and you receive two credentials. OSCP never expires. OSCP+, introduced on November 1, 2024, expires after three years unless you renew it, and OffSec now calls the test itself the OSCP+ exam.

Who should sit OSCP, and who should wait

OSCP suits a junior penetration tester, a system or network administrator moving into offensive work, or a security analyst who wants proof of hands-on skill rather than a multiple-choice score. OffSec sets no formal prerequisites, but it recommends a solid grasp of TCP/IP, real Windows and Linux administration experience and basic Bash or Python scripting. Arrive without them and you'll spend paid lab time learning networking.

If you're still learning what a reverse shell is, start with PenTest+ or a shorter practical such as eJPT. If your employer or a government contract names a GIAC credential, GPEN may serve you better. And if you already hold OSCP from before November 2024, you don't need to resit anything: your OSCP stays valid, and the OSCP+ designation is optional.

OSCP+ exam at a glance

OSCP+ exam
FormatProctored practical in a private VPN: three standalone machines and one Active Directory set of three machines
Time23 hours 45 minutes, then 24 hours to upload the report
Passing score70 of 100 points; no bonus points
Price$1,699 exam only; $1,749 with 90 days of PEN-200; $2,749 a year for Learn One with two attempts
PrerequisitesNone; TCP/IP, Windows and Linux administration and basic scripting recommended
ResultsPass or fail by email within 10 business days of the report
ValidityOSCP for life; OSCP+ for three years, renewable

How the 100 points are earned

Each standalone machine is worth 20 points, 10 for a low-privilege shell (the local.txt flag) and 10 for root or administrator (proof.txt). The Active Directory set is worth 40, split 10, 10 and 20 across its three machines, and you start it with a supplied domain username and password, which OffSec describes as a simulated breach. OffSec lists four ways to reach 70. At one end is the full 40 from Active Directory plus three local.txt flags; at the other, 10 points of Active Directory with all three standalone machines rooted.

The rules shape your strategy as much as the targets do. You may use Metasploit modules or Meterpreter against one machine only, and you can't pivot with Metasploit. SQLmap and other automatic exploitation tools are banned, as are mass scanners such as Nessus, spoofing, commercial tools and AI chatbots, including OffSec's own KAI. Nmap, Burp Suite Community, BloodHound, Impacket, Mimikatz and evil-winrm are allowed. Every flag needs a screenshot from an interactive shell showing the file and the target's IP address, and the report must let a competent reader repeat each step. Missing screenshots can't be sent afterwards.

PEN-200 is the course behind the exam: more than 20 modules plus nine challenge labs, three of which OffSec built to resemble the exam. The syllabus runs from information gathering, web attacks, SQL injection and client-side attacks through fixing public exploits, antivirus evasion and password attacks to Windows and Linux privilege escalation, tunneling, Metasploit and three Active Directory modules. The course page also lists enumeration of and attacks on Amazon Web Services. OffSec states that anything in the course material can appear on the exam, and that the Active Directory set may need pivoting.

One scoring change needs watching. OffSec's exam-structure blog carries a notice saying OSCP+ grading changes to a scaled system from December 1, 2026. Its linked announcement returns a not-found error, while the exam guide checked October 15 still sets the pass mark at 70 points. If you book for December or later, read the guide again first.

A PEN-200 plan that matches the exam

Read the module text and do the module exercises once, in order, but keep notes as you'll use them in the exam: one page per technique, with the exact commands that worked. The exam is open book apart from AI tools, so notes you can search quickly are worth more than notes that look tidy.

Spend most of your hours in the challenge labs rather than the modules. Treat the three exam-like labs as dress rehearsals: set a 24-hour timer, limit yourself to Metasploit on one machine, and write a full report afterwards using OffSec's Word or LibreOffice template. OffSec warns that thin documentation costs points or all of them, and a practice report shows you which screenshots you forgot to take.

Give Active Directory its own block of time. OffSec's FAQ points to the three Active Directory modules, the final "Assembling the Pieces" module and the Active Directory sets inside the challenge labs. Practise going from one domain user to domain admin with BloodHound, Kerberoasting, password spraying and pass-the-hash until the sequence is routine, because the set carries 40 of the 100 points.

For extra machines, Proving Grounds Practice comes with Learn One and holds more than 250 labs, according to OffSec. As a rough budget for someone who meets the recommended background, we'd put 20% of study time into modules, 50% into challenge labs and Proving Grounds, 20% into Active Directory drills and 10% into report writing. The 90-day bundle is tight for that unless you can study most days, which is why the 365-day Learn One subscription with two attempts costs $1,000 more.

Retakes, renewal and what comes next

After a first failed attempt you wait four weeks before booking another, after a second eight weeks, and after a third or later 12 weeks. Retakes bought later are valid for 120 days. Bundle exam attempts must be used within 120 days of lab access ending, and Learn One attempts expire with the subscription.

Keeping the "+" takes one of three routes before the three years run out. You can earn 120 continuing professional education (CPE) credits and keep annual coverage through the $145 Annual Maintenance Fee or the $299 Annual Membership Program, which adds labs and course access. You can pass the $799 recertification exam, available from six months before expiry. Extending an existing certification through an exam still requires annual coverage. OffSec also allows passing the recertification exam without the maintenance fee to earn a new three-year certification instead of extending the old one. Or you can pass a higher OffSec exam such as OSEP, OSWE, OSED or OSWA while paying the fee. A 90-day grace period follows expiry. Let OSCP+ lapse and you still hold OSCP.

Three next steps, each of which also renews OSCP+:

  • OSEP for evasion and Active Directory attacks against defended networks.
  • OSWE if web applications and source code review interest you more.
  • OSED for Windows exploit development.

Our view

OSCP's reputation comes from the format: a long, proctored practical with a report, where you can't pass by recognising answers. The Active Directory set and assumed-breach start make the current exam closer to internal testing work than older versions were. The criticisms are fair too. Twenty-four hours tests stamina as well as skill, the one-machine Metasploit rule has no parallel in real engagements, and OSCP+ adds a recurring fee to a credential that used to be paid for once. It's worth the money when job postings in your market ask for it by name. If you only need to show that you can test, a cheaper practical exam can make that case.

Sources