OSCP Certification Study Guide: From Zero to PWK in 90 Days

The OSCP is the cert that separates people who talk about hacking from people who can actually do it. No multiple-choice questions. No theory-only exams. You get 23 hours and 45 minutes to compromise machines on a live network, then another 24 hours to write a professional penetration testing report. Pass rate hovers around 17% on the first attempt — not because the material is impossible, but because most candidates show up underprepared.

This guide gives you the exact roadmap to pass the OSCP on your first try.

What Is the OSCP Certification?

The Offensive Security Certified Professional (OSCP) is a hands-on penetration testing certification offered by OffSec (formerly Offensive Security). It is the gold standard entry-level offensive security certification in the industry.

To earn it, you must:

1. Complete the PEN-200 course (formerly PWK — Penetration Testing with Kali Linux)
2. Gain access to the OSCP lab environment for your chosen period (90 days is the standard)
3. Pass the 24-hour proctored exam by compromising a set of target machines and submitting a professional report

The exam requires 70 points out of 100 to pass. Each machine carries a point value based on difficulty, and partial points are awarded for low-privilege shells.

> Important: Since November 2022, the OSCP exam includes an Active Directory component worth 40 points. Your study plan must include AD attack chains — this is where most candidates fail.

Why the OSCP Still Matters

Credentials like CompTIA Security+ teach you to recognize attack patterns. The OSCP teaches you to execute them. That distinction matters enormously to hiring managers.

Here is why the OSCP is worth the investment:

• Industry recognition — Consistently ranked among the most respected offensive security certs by major security firms and the U.S. government
• Proof of practical skill — You cannot study-dump your way to an OSCP. You either compromise the machines or you do not
• Career leverage — Penetration testers with OSCP command significantly higher salaries compared to non-certified peers
• DoD 8570 compliance — OSCP satisfies IAT Level II and IASAE Level III requirements for U.S. government contractors

For a complete guide on where OSCP fits in the broader certification landscape, see our Cybersecurity Certification Roadmap.

Prerequisites: What You Actually Need Before Starting

OffSec's official prerequisite is "familiarity with TCP/IP networking and Linux." That is technically accurate and practically insufficient.

Minimum viable knowledge before purchasing PEN-200:

• Comfortable navigating Linux from the command line — file permissions, process management, scripting basics
• Understanding of TCP/IP, subnetting, and common protocols (HTTP, SMB, FTP, SSH)
• Basic familiarity with at least one scripting language — Python or Bash
• Conceptual experience with tools like Nmap, Burp Suite, and Metasploit

Recommended pre-OSCP certifications or platforms:

• eJPT (eLearnSecurity Junior Penetration Tester) — excellent structured intro
• TryHackMe "Jr Penetration Tester" or "Offensive Pentesting" learning path
• HackTheBox Academy fundamentals
• PG Practice (OffSec's own supplemental platform)

If you can consistently root Easy and Medium machines on HackTheBox or TryHackMe without hints, you are ready to purchase lab time.

The Complete OSCP Study Plan

Phase 1: Build Your Foundation (Weeks 1–3)

Before touching the OSCP labs, spend time ensuring your fundamentals are automatic. This prevents the most common failure mode: hitting a wall in the labs because basic skills require conscious effort instead of muscle memory.

Focus areas:

• Master Bash scripting for automation and data parsing
• Practice network enumeration from a blank slate repeatedly
• Review SMB, FTP, HTTP, and SSH protocol behavior at a packet level

Drill enumeration until it is reflexive:

# Full TCP port scan — always start here
nmap -p- --min-rate 5000 -oN full_tcp.txt <target-ip>

# Service and version scan on discovered ports
nmap -sC -sV -p 22,80,443,445 -oN service_scan.txt <target-ip>

# UDP scan — do not skip this, it catches things TCP misses
nmap -sU --top-ports 100 -oN udp_scan.txt <target-ip>

Enumeration is where OSCP exams are won or lost. Running this sequence should be as automatic as typing your own name.

Phase 2: Core PEN-200 Modules (Weeks 4–8)

Work through the PEN-200 course material systematically. Do not skip the exercises — completing them with a write-up earns up to 10 bonus points on the exam, and those points have saved candidates who were one box short of passing.

Priority modules in order:

1. Information Gathering — Active and passive reconnaissance techniques
2. Web Application Attacks — SQL injection, file inclusion, upload bypasses, command injection
3. Buffer Overflows — Windows x86 BOF is still tested; understand it cold
4. Client-Side Attacks — Macro-based payloads and phishing vectors
5. Privilege Escalation — Linux and Windows PrivEsc are exam staples
6. Active Directory Attacks — Kerberoasting, AS-REP Roasting, pass-the-hash, lateral movement, domain compromise

> Note: Allocate at least two full weeks to the Active Directory section. The exam's AD set is typically 40 points — passing or failing frequently comes down to this section alone.

Phase 3: Labs and Practice Machines (Weeks 8–14)

The OSCP labs are your primary training environment. Treat every machine like a real engagement: enumerate thoroughly, document everything, and write up your findings before moving on.

Lab strategy:

• Target at least 40–50 compromised machines before exam day
• Document every machine as you go — this builds report-writing speed before it matters
• Avoid relying on Metasploit in labs; practice manual exploitation to build the skills the exam expects
• Prioritize machines that community forums rate as similar to exam targets

Supplemental platforms for AD practice:

• HackTheBox Pro Labs — "RastaLabs" and "Offshore" are the closest to real enterprise AD
• PG Practice — Machines rated "community" are crowd-flagged for OSCP similarity
• TryHackMe OSCP preparation path — Useful for structured gap-filling

At CyberVK, our OSCP preparation labs include guided and unguided machines specifically chosen to mirror the difficulty curve and attack patterns you will encounter in the real exam — with instructor notes that explain the why behind each technique, not just the commands.

Phase 4: Active Directory Deep Dive (Weeks 12–15)

This phase deserves its own block of dedicated time. If you rush the AD section, the exam will expose it.

Core AD attack chain you must execute from memory:

# Step 1: Collect domain data with BloodHound
bloodhound-python -u <user> -p <pass> -d <domain> -ns <dc-ip> -c All

# Step 2: Kerberoast — find service accounts with SPNs, request their tickets
impacket-GetUserSPNs -request -dc-ip <dc-ip> <domain>/<user>:<pass>

# Step 3: Crack the TGS hash offline
hashcat -m 13100 spn_hashes.txt /usr/share/wordlists/rockyou.txt

# Step 4: Lateral movement using pass-the-hash
impacket-psexec -hashes :<ntlm-hash> administrator@<target-ip>

# Step 5: DCSync to dump all domain credentials
impacket-secretsdump -just-dc-ntds <domain>/administrator@<dc-ip>

Understanding the why behind each step matters as much as the syntax. Know what BloodHound is actually showing you. Understand why Kerberoasting works cryptographically. Know the difference between pass-the-hash and pass-the-ticket and when each applies.

Phase 5: Exam Simulation (Weeks 15–16)

Run at least two full mock exams before your real attempt. This is the phase most candidates skip. Do not skip it.

Mock exam protocol:

1. Set a 23-hour 45-minute countdown timer
2. Work through five machines (simulate the current exam: one AD set worth 40 points plus three standalone machines worth 20 points each)
3. Take no hints, no guides, no community assistance
4. Write the full penetration test report in the 24 hours after

The physical and mental endurance of a 24-hour exam window is a real factor. Simulating it in advance removes the surprise.

Tools You Must Know Before Exam Day

Do not bring tools you have never practiced with into the exam. Build genuine fluency with these:

Enumeration:

• nmap — port scanning and service detection
• gobuster / feroxbuster — directory and file brute-forcing
• enum4linux-ng — SMB and domain enumeration
• nikto — automated web vulnerability scanning

Exploitation:

• searchsploit — local ExploitDB search and retrieval
• impacket suite — AD attacks, SMB interaction, relay attacks
• evil-winrm — Windows remote management shell access

Post-Exploitation and Privilege Escalation:

• linpeas.sh / winpeas.exe — automated PrivEsc enumeration
• pspy — Linux process monitoring without root
• PowerView / SharpHound — AD enumeration from inside the domain

Password Attacks:

• hashcat — GPU-accelerated offline hash cracking
• hydra — online brute-force across protocols
• john — John the Ripper for offline cracking and format conversion

Common Mistakes That Cause Candidates to Fail

Skipping Report Practice

The exam does not end when you compromise the last machine. You have 24 hours to submit a professional penetration testing report. Candidates who have never written a pentest report before spend those hours in a panic, making errors, and missing detail they cannot reconstruct from memory.

Practice writing reports as you work through labs. Use OffSec's provided template and fill it in completely for every machine you compromise — screenshots, proof.txt contents, and the full attack chain documented step by step.

Over-Relying on Automation

LinPEAS and WinPEAS are excellent starting points, but they are not a substitute for understanding. If you cannot interpret their output or manually verify a finding, you will miss context that matters. On the exam, tools surface candidates — understanding closes them.

Ignoring Windows Privilege Escalation

Most OSCP preparation leans toward Linux. Windows PrivEsc — token impersonation, service binary hijacking, unquoted service paths, AlwaysInstallElevated — is just as likely to appear on your exam machines.

# Check for AlwaysInstallElevated — classic Windows PrivEsc
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Find unquoted service paths — another common escalation vector
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\\Windows"

Getting Trapped in Rabbit Holes

Every OSCP candidate chases at least one dead-end attack vector that looks like the path forward. Set a rule before exam day: if you have not made meaningful progress on a specific vector in 45 minutes, document your current state and pivot to a different machine or surface. Time-boxing is a learned skill — practice it in labs.

Skipping Breaks During the Exam

After 12 hours in a terminal, your pattern recognition degrades significantly. Plan two 30-minute breaks. Eat a real meal. Step away from the screen. The target machines do not reset while you rest. You will come back sharper.

Your 90-Day OSCP Schedule at a Glance

Go Deeper

This article is part of our comprehensive Cybersecurity Certification Roadmap series. Once you've mastered this topic, explore the full guide to level up your skills.

Ready to practice? CyberVK has hands-on labs and courses for every skill level. Start learning at cybervk.com