Skip to content
CertGPS

OffSec Exploit Developer

Proves you can reverse engineer Windows binaries and write exploits that bypass DEP and ASLR, across three tasks in a 48-hour proctored exam

ExpertOffSec

The exam

Exam cost
$1,749
Study time
6-12 months
Passing score
60 of 100 points
Valid for
Does not expire

Before you book

  • No formal prerequisites
  • Recommended: familiarity with debuggers such as Immunity Debugger or OllyDbg
  • Recommended: basic 32-bit exploitation concepts
  • Recommended: writing Python 3 code
  • Optional: reading basic C and 32-bit assembly

What it covers

Security domains

Skills

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. OffSec Certified Professional

    Advanced

    Comes before. OffSec names PEN-200 and OSCP as the route to EXP-301's prerequisite skills

  2. OffSec Exploit Developer

    You are here

Study guide

Last updated

OSED Study Guide: EXP-301, Three Exploit Tasks and the 48-Hour Exam

The OffSec Exploit Developer (OSED) certifies that you can reverse engineer a Windows application, find a memory corruption bug in it and write a working exploit that gets past Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). The exam gives you three independent tasks and 47 hours and 45 minutes, and two finished tasks are enough to pass. Settle your tooling before anything else: reverse engineering in the exam is limited to IDA Free and WinDbg, and every line of your code must be Python 3.

Who OSED is for, and who should look elsewhere

EXP-301, Windows User Mode Exploit Development, is the course behind OSED. OffSec aims it at penetration testers, exploit developers, security researchers, malware analysts and developers of security products. There are no formal prerequisites. The recommended background is familiarity with a debugger such as Immunity Debugger or OllyDbg, basic exploitation concepts on 32-bit systems, and the ability to write Python 3. Reading basic C and 32-bit assembly is listed as optional, yet the course overview calls a strong grasp of C, assembly, Windows internals and debugging tools "highly recommended". In practice, plan to read C and 32-bit assembly comfortably before you start. OffSec says PEN-200 and OSCP provide the prerequisite skills, which makes that the route if you've never followed a simple buffer overflow from crash to shell.

If your interest is taking malicious software apart rather than writing exploits, GIAC's GREM tests malware reverse engineering in a 66-question, three-hour exam. If you test networks for a living and want the next OffSec step on that path, OSEP is the better fit. OffSec's recommended background is all 32-bit, and kernel work, including 64-bit kernel exploitation, belongs to the separate EXP-401 course.

OSED exam logistics

OSED exam
FormatProctored practical in a private VPN: three independent tasks covering reverse engineering to find bugs, exploits that bypass security mitigations, and custom shellcode
Time47 hours 45 minutes, then 24 hours to upload the report and code
Passing60 of 100 points; OffSec says two of the three tasks will pass; no credit for partial solutions
ToolsIDA Free and WinDbg only; all exploit code in Python 3
Price$1,749 Course + Cert Bundle (90 days, one attempt); $2,749 a year for Learn One (365 days, two attempts); no exam-only option
PrerequisitesNone formal; debugger, 32-bit exploitation and Python 3 skills recommended
ResultsPass or fail by email within 10 business days of the report
ValidityDoes not expire; no maintenance fee

What EXP-301 teaches, and how the exam samples it

OffSec's March 2026 syllabus lists ten topic areas, which the course page arranges as 13 modules, many with videos and labs:

  • WinDbg tutorial
  • Stack buffer overflows
  • Exploiting Structured Exception Handler (SEH) overflows
  • Introduction to IDA Pro
  • Overcoming space restrictions
  • Shellcode from scratch
  • Reverse engineering bugs
  • Stack overflows with DEP and ASLR bypass
  • Format string specifier attacks
  • Custom return-oriented programming (ROP) chains and ROP payload decoders

Three challenge labs come after the modules. OffSec calls EXP-301 an intermediate course even though it sits at its 300 level, and it publishes no topic weights. The exam guide names three things the tasks test: reverse engineering to discover vulnerabilities, crafting exploits that bypass mitigations, and creating custom shellcode. According to the exam FAQ, fuzzing isn't part of the exam and every vulnerability is meant to be found by reverse engineering, which gives the reverse engineering and format string material more weight than its share of the syllabus suggests.

Exploit tasks come with a target machine running the vulnerable software. You write code on your own Kali Linux machine, debug on a virtual machine OffSec provides inside the VPN, and prove success by reading proof.txt from the administrator's desktop through a remote interactive shell, with a screenshot that also shows the target's IP address. Some tasks don't involve a proof file at all. Ghidra, the commercial IDA Pro and remote mounting of binaries are banned, as are commercial tools and AI chatbots. Metasploit Community is allowed. WinDbg plugins are permitted if your report explains what they do, and frameworks such as pwntools and mona are allowed, though OffSec says the tasks are built so they're unlikely to help. Exam sets come from a pool at random.

Preparing with EXP-301 and its challenge labs

At 932 hours of content by OffSec's count, EXP-301 would need more than 10 hours a day to finish inside the bundle's 90 days. If you work full time, we'd choose Learn One, which costs $1,000 more and runs for 365 days with two exam attempts. Bundle buyers can add lab extensions in 30-day blocks, and the bundle's exam attempt must be used within 120 days of lab access ending.

Match your tools to the exam from the first day. The course has a module titled Intro to IDA Pro, but the exam allows only IDA Free, so do the course work in IDA Free and WinDbg and avoid building a Ghidra habit you'd have to drop. Work through the modules in order, since the DEP and ASLR, format string and ROP modules build on the debugger and stack overflow work that comes first. Spend extra hours on the reverse engineering module, because the exam won't hand you a crash.

OffSec says the challenge labs train most of the concepts the exam tests, and its minimum advice for readiness is to understand most of the course and complete them. Use the three labs as timed rehearsals. An even split of the exam gives each task about 16 hours, and since two tasks pass, a sensible plan aims to finish two in the first day and a half, leaving the rest for the third task and the report.

Graders need to replicate your work. For each solved task the report must explain your code and every reverse engineering and exploitation step clearly enough for a competent reader to repeat them. Code goes in as separate Python 3 files named assignment1.py to assignment3.py, archived with the PDF in an unencrypted .7z of no more than 200MB. Drafting a short report after each challenge lab gets you used to the format. For someone with the recommended background, we'd give about 60% of study time to modules and exercises, 25% to the challenge labs and the rest to timed rehearsal and report writing.

After OSED: credit elsewhere and what comes next

OSED doesn't expire, and OffSec's maintenance handbook says a certification without an expiry date needs no Annual Maintenance Fee. Passing it while your OSCP+ is valid renews the OSCP+ for three years, provided you pay the maintenance fee. With OSEP and OSWE it completes OSCE³, which OffSec awards automatically without another exam. A course completion letter can count for up to 40 (ISC)² continuing professional education (CPE) credits.

A failed attempt starts a cooling-off period of four weeks, then eight after a second failure and 12 after any later one. Retakes are valid for 120 days from purchase. If you submit a report and fall short, you can ask OffSec for feedback, which it sends within 10 business days.

  • OSEP takes you back to networks: defended corporate environments, client-side attacks and Active Directory.
  • OSWE applies close code analysis to web applications and completes OSCE³.
  • OSEE, through EXP-401, is the next step in exploit development. OffSec teaches it in person only, its case studies include 64-bit kernel exploitation, and it expects x86_64 assembly.

Our view

OSED is respected because you can't pass it by running someone else's exploit. The bug has to be found by reading the binary, the exploit has to beat DEP and ASLR, and the Python you submit is graded alongside the report. The complaints are reasonable. Restricting you to IDA Free and WinDbg tests the course's toolchain rather than the one a research team might use, the 32-bit user-mode scope leaves 64-bit and kernel work to the in-person EXP-401, and 932 hours of material sits awkwardly with a 90-day bundle. We think it's worth the money for a penetration tester moving toward vulnerability research, or for anyone collecting OSCE³. If your job is analysing malware or testing networks, the money goes further on a certification built for that work.

Sources