OSC

You connect to a dedicated VPN lab and compromise a set of target machines, including an Active Directory component, within the allotted window. For each target you must capture proof of exploitation and local privilege escalation. After the practical portion you submit a written penetration test report documenting your findings and remediation advice.

No. The exam is entirely practical. There are no theory questions, so memorizing trivia will not help. What counts is whether you can enumerate a target, find the weakness, exploit it, escalate, and prove it with clear evidence and screenshots in your report.

OffSec periodically adjusts exam duration, pricing, and included lab time. Rather than rely on second-hand figures, check the official OffSec website for the current numbers before you schedule. Budget extra time afterward for writing the report, since submission deadlines are separate from the hacking window.

The difficulty is mostly breadth and endurance, not exotic exploits. Most failures come from weak enumeration, poor time allocation, or missing an obvious misconfiguration. If you can consistently root varied practice boxes without hints and keep organized notes, you are close to ready.

Yes, retakes are possible, and OffSec publishes the current retake terms and any waiting period on its site. Treat a failed attempt as diagnostic: identify which phase broke down, whether enumeration, privilege escalation, Active Directory, or reporting, and drill that specifically before rebooking.

Start with enumeration and Linux privilege escalation, since those skills transfer everywhere. Add Windows escalation next, then Active Directory, then pivoting and tunneling. Leave reporting practice for the final weeks, but write up every practice box as you go rather than saving documentation for the end.

Skipping thorough enumeration and guessing at exploits, tunnel-visioning on one hard box while easy points sit untouched, forgetting to capture screenshots as you work, and writing a thin report that lacks reproducible steps. Also common: running out of time because privileges were never escalated on hosts already compromised.

Yes, at least one component requires it. Understand domain enumeration, Kerberos abuse, credential dumping, delegation misconfigurations, and lateral movement between hosts. Build a small home lab with a domain controller and a member server so these techniques become familiar rather than theoretical.

For each target: the vulnerability, affected service, reproduction steps, evidence such as command output and screenshots, the level of access obtained, and remediation guidance. Write clearly for a technical client. A compromise that is not documented convincingly may not be credited, so rehearse report writing beforehand.