Skip to content
CertGPS

OffSec Experienced Penetration Tester

Proves you can breach a defended corporate network and reach a set objective in a proctored 48-hour practical that never expires

ExpertOffSec

The exam

Exam cost
$1,749
Study time
6-12 months
Passing score
secret.txt objective or 100 points
Valid for
Does not expire

Before you book

  • No formal prerequisites
  • Recommended: PEN-200 and OSCP+, or equivalent knowledge
  • Recommended: Kali Linux, target enumeration and Bash, Python and PowerShell scripting
  • Recommended: exploiting SQL injection, file inclusion and local privilege escalation
  • Recommended: foundational Active Directory and basic AD attacks
  • Helpful: C# programming

What it covers

Security domains

Skills

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. OffSec Certified Professional

    Advanced

    Comes before. Builds the enumeration and Active Directory basics PEN-300 assumes before its evasion work

  2. OffSec Experienced Penetration Tester

    You are here

Study guide

Last updated

OSEP Study Guide: PEN-300, the 48-Hour Exam and What It Costs

The OffSec Experienced Penetration Tester (OSEP) shows that you can get into a defended corporate network, work through it to a named target and write the attack up so someone else could repeat it. It's the 300-level step after OSCP, earned through the PEN-300 course and a proctored exam lasting 47 hours and 45 minutes. Budget for the course as well as the exam, because OffSec sells exam-only attempts for OSCP+ but not for OSEP.

Who OSEP is built for

OSEP is aimed at working penetration testers and red team operators who already hold OSCP+ or have the same skills, and whose clients now run antivirus, endpoint detection and response (EDR) tools and application allow-listing. OffSec recommends PEN-200 and a passed OSCP+ exam without requiring either. Its description of the equivalent is specific: comfort with Kali Linux and the Linux command line, solid target enumeration, basic Bash, Python and PowerShell scripting, the ability to exploit SQL injection, file inclusion and local privilege escalation, and a working knowledge of Active Directory and the basic attacks against it. C# isn't required, but OffSec calls it a plus, and the course pushes you to build your own tools instead of relying on off-the-shelf ones.

If you haven't passed OSCP, start there, because PEN-300 assumes that foundation and spends its time on hardened targets. If you want a red team role built around a commercial command-and-control framework, CRTO from Zero-Point Security teaches Cobalt Strike, which the OSEP exam bans. And if application code interests you more than networks, OSWE is OffSec's 300-level web course.

OSEP exam facts

OSEP exam
FormatProctored practical in a private VPN: one simulated corporate network, foothold first and internal attacks after; the machine count isn't disclosed
Time47 hours 45 minutes, then 24 hours to upload the report
PassingReach the objective given in the control panel (the secret.txt flag) or score 100 points; each local.txt or proof.txt flag is worth 10
Price$1,749 Course + Cert Bundle (90 days, one attempt); $2,749 a year for Learn One (365 days, two attempts); no exam-only option
PrerequisitesNone formal; PEN-200 and OSCP+, or equivalent skills, recommended
ResultsPass or fail by email within 10 business days of the report
ValidityDoes not expire; no maintenance fee

What PEN-300 covers, and what the exam rewards

OffSec's March 2026 syllabus for PEN-300, titled Evasion Techniques and Breaching Defenses, lists these topics, which the course page spreads across more than 20 modules:

  • Operating system and programming theory
  • Client-side code execution with Microsoft Office and with JScript
  • Process injection and migration
  • Introduction to antivirus evasion, then advanced antivirus evasion
  • Application whitelisting
  • Bypassing network filters
  • Linux and Windows post-exploitation
  • Kiosk breakouts
  • Windows credentials
  • Windows and Linux lateral movement
  • Microsoft SQL attacks
  • Active Directory exploitation
  • Combining the pieces, followed by a closing set of full scenarios called Trying Harder

Seven challenge labs follow the modules. OffSec publishes no topic weights, so read emphasis from the exam. Its network is mostly Windows with some Linux hosts, every operating system is modern and fully patched, and the machines run the security products the course covers. Some hosts can't be compromised at all, many depend on others, and several paths lead to the same access, so enumeration decides how much of the two days goes to dead ends. Foundational attacks of the kind OSCP tests still appear alongside the advanced material.

The tool rules are looser than OSCP's. Open-source tools that automate enumeration or exploitation, including Metasploit Community, BloodHound and SQLmap, are allowed, and the exam guide sets no one-machine limit on Metasploit. Commercial tools such as Cobalt Strike, Metasploit Pro, Core Impact and Burp Suite Pro are still banned, as are spoofing attacks and AI chatbots, OffSec's own KAI included. A flag only counts when you read it from an interactive remote shell, so a web shell or a Remote Desktop session won't do, and each one needs a screenshot showing the file and the host's IP address. Inside the exam network you get a development virtual machine with Visual Studio and Microsoft Office installed, and 50 machine reverts that can be reset once.

Planning PEN-300 for 90 days or a year

OffSec puts PEN-300 at 671 hours of content. Over the bundle's 90 days that comes to about 7.5 hours a day before you open a challenge lab, so the bundle suits someone studying close to full time or already strong in most of the syllabus. Learn One costs $1,000 more, lasts 365 days, includes two exam attempts and adds Proving Grounds Play and Practice. Bundle buyers who run short can add 30-day lab extensions, and the bundle's exam attempt must be used within 120 days of lab access ending.

Work through the modules in syllabus order, since the closing modules assume everything before them. Do every exercise, then rewrite the course's example tooling yourself until you can change and recompile it without the text open. The exam network includes a development machine with Visual Studio, so expect to adjust code against the clock. Give the Active Directory, lateral movement and Microsoft SQL modules extra hours, because they're how you move between machines on a single network where nothing stands alone.

Treat the challenge labs as the second half of the course. OffSec says they train most of what the exam tests and that the last one is about as complex as the exam, so save that one for a full rehearsal: two days on the clock, the exam's tool rules, and a finished report at the end.

OffSec calls its documentation rules very strict, and a thin report can cost some or all of the points. It has to cover every step, command, piece of code and console output. Where you modify an exploit, it needs the original URL, the changes highlighted and the reason for each. It goes in as a PDF inside an unencrypted .7z archive of no more than 200MB, and anything left out can't be sent later. If your lab notes follow that structure from the first module, the exam report becomes assembly work. For someone who meets OffSec's recommended background, we'd put about half the study time into modules, a third into challenge labs and the rest into Active Directory review and report drafting.

After OSEP: no renewal, and three directions

OSEP doesn't expire, and OffSec's maintenance handbook confirms that a certification without an expiry date needs no Annual Maintenance Fee. Passing OSEP while your OSCP+ is valid renews the OSCP+ for three years, as long as you pay the maintenance fee. OSEP is also one of the three exams, with OSWE and OSED, that together award OSCE³ automatically with no further test. A PEN-300 completion letter can count for up to 40 (ISC)² continuing professional education (CPE) credits.

If you fail, the cooling-off period is four weeks after the first failed attempt, eight after the second and 12 after any later one, counted per exam whatever product you bought. Retakes are valid for 120 days from purchase. Exam sets come from a pool at random, so a retake may be a different network. If you submit a report and fall short, OffSec emails your score and some feedback.

  • OSWE adds white-box web application testing and is the second piece of OSCE³.
  • OSED suits you if the low-level Windows modules were the part of PEN-300 you liked most.
  • CRTO covers red team operations with Cobalt Strike, the kind of commercial tooling the OSEP exam excludes.

Our view

OSEP's standing comes from an exam that resembles an internal test against a client who has bought security products: one network, no machine list, an objective and two days. Letting you pass on the objective alone rewards finishing an attack path over collecting flags, which is closer to how a client judges the work. Three complaints hold up. The 90-day bundle is small for 671 hours of material, the syllabus carries no weights, and a ban on commercial frameworks means OSEP says nothing about the tools a red team may actually license. We think it's worth the money if you already hold OSCP and test internal networks for clients with mature defenses, or if you're working toward OSCE³. If your employer's contracts name a GIAC credential, or Active Directory attacks still feel shaky, spend the money elsewhere first.

Sources