The OffSec Wireless Professional (OSWP) is OffSec's shortest exam: 3 hours and 45 minutes against live wireless networks, with a pass awarded for recovering the key and reaching the access point in two of three scenarios. It comes with the $799-a-year Learn Fundamentals subscription, which also includes the PEN-210 course. Before you buy, know that the course labs happen at home, on an access point and a wireless card you supply yourself.
Who OSWP suits
OSWP fits penetration testers whose engagements include on-site wireless assessments, network engineers who look after enterprise Wi-Fi and want to see it from the attacker's side, and people who've done some offensive security and want a short, practical first credential from OffSec. OffSec recommends comfort on the Linux command line, a solid grasp of TCP/IP, basic knowledge of 802.11 and its encryption, and some familiarity with penetration testing.
It isn't a general penetration testing credential, and an employer looking for one will read it as a specialty. If you need breadth, OSCP is the OffSec exam that carries that weight. If you're still learning how frames, addressing and routing fit together, Network+ covers the networking that PEN-210 assumes.
The OSWP exam at a glance
| OSWP exam | |
|---|---|
| Format | Proctored practical over OpenVPN, using a Kali Linux machine and wireless card that OffSec provides |
| Time | 3 hours 45 minutes, then 24 hours to upload a PDF report |
| Pass requirement | Proof from two of three network scenarios, one of which is mandatory |
| Price | $799 a year for Learn Fundamentals, with PEN-210 and one OSWP attempt; PEN-210 is also part of Learn One at $2,749 a year |
| Prerequisites | None; Linux, TCP/IP, 802.11 basics and some penetration testing experience recommended |
| Course hardware | Your own access point and an injection-capable wireless card |
| Validity | Doesn't expire |
How the three scenarios work
Only one scenario runs at a time, and you switch between them from the exam control panel. Each is a different network, and in each one the job is the same: recover the wireless key using the methods taught in PEN-210, connect to the target access point, and fetch a proof file from it. Some scenarios carry traffic to the internet and simulate client behavior, so they look more like a real network than a lab bench. Where a scenario needs a dictionary, OffSec tells you to use a wordlist that ships with the provided Kali machine.
The control panel accepts your proof values but won't say whether they're right, so the report matters. It needs the keys, the commands you used to recover them and to connect, and at least one screenshot of each cracked key and each proof file. Once you submit, you can't add anything.
The restrictions are specific to wireless. Tools that find and attack networks automatically, such as wifite, wifiphisher and besside-ng, are banned, along with any wrapper or script that turns the process into a wizard. AI chatbots are banned as well. The aircrack-ng suite is allowed, so the exam checks that you understand each step well enough to run it yourself.
PEN-210's syllabus covers the 802.11 standards and the weaknesses in their encryption schemes, capturing and reading wireless traffic (including in Wireshark), spotting rogue access points and the rules of conduct for wireless testing. OffSec publishes no domain weights.
Preparing with PEN-210
The course is small. OffSec says the videos run about 3.5 hours and that learners report about 20 hours in the labs, so we'd expect someone working full time to finish it in a few weeks. The hardware deserves the most attention at the start. OffSec's PEN-210 FAQ recommends the Alfa AWUS036NHA and points to the aircrack-ng wiki for checking whether another card supports injection. Most access points will work for the course, but you need one you own and can reconfigure freely. Never practise against networks you don't have permission to test.
Set up each encryption mode the course covers on your own access point, and work through it until you can do it from your notes without the video. Then practise the parts the exam is strict about: connecting to a network from the command line once you have the key, and taking the screenshots the report requires as you go. A timed run-through of three setups in under four hours shows you how much slack the real exam leaves.
Keep notes in the order you'd use them on exam day, with exact command lines. The exam is open book apart from AI tools, and with under four hours, searching your own notes is faster than searching the web.
After you pass, and what comes next
OSWP doesn't expire and has no renewal requirement of its own. If you fail, OffSec's retake policy sets a cooling-off period before the next booking, and a learner who submits a report without enough to pass can ask for feedback. OffSec doesn't publish how many people hold OSWP or what share pass.
Two directions make sense afterwards:
- OSCP for general network and Active Directory testing, where wireless is one part of the job.
- Network+, if the course showed gaps in networking fundamentals that a structured outline would fill.
Our view
OSWP is cheap by OffSec standards, short, and honest about what it tests: if you pass, you've broken into wireless networks by hand under time pressure. It's also narrow. With roughly 24 hours of course material behind it, a hiring manager will rightly read it as a specialty badge. Take it if wireless assessments are part of your work, or if you want an inexpensive look at how OffSec runs a proctored exam before committing $1,749 to OSCP. As a first certification for a career change, it does less for you than a broad entry-level credential.
Sources
- PEN-210 course page: certification name, recommended background, syllabus topics, job roles, prices, checked October 2026
- OffSec pricing: Learn Fundamentals and Learn One, checked October 2026
- OSWP Exam Guide: time, scenarios, proof and screenshot rules, restrictions, checked October 2026
- OSWP Exam FAQ: pass rule, provided Kali machine, PDF report, open-book rules, feedback, no published pass rate, checked October 2026
- PEN-210 FAQ: hardware, video and lab hours, report requirement, checked October 2026
- Learn Fundamentals FAQ: PEN-210 and one OSWP attempt included, checked October 2026
- Exam Retake Policy: cooling-off periods, checked October 2026