OSC study guide
OSC · Work through your exam, one topic at a time.
The OSCP (OffSec Certified Professional) is a hands-on penetration testing certification earned by passing the PEN-200 exam. Unlike multiple-choice credentials, it asks you to actually break into live machines over VPN and then write a professional report. The OSC study guide has 7 sections and about 2,407 words.
01Information Gathering and Enumeration
The Information Gathering and Enumeration domain checks whether you can turn a bare IP address into a complete, defensible map of the target before touching an exploit. Graders reward methodical coverage: every TCP port, the common UDP services, every virtual host, and every piece of metadata a service volunteers.
415 words, about 2 min02Vulnerability Discovery and Analysis
This domain tests whether you can move from raw enumeration output to a specific, validated weakness, and explain why it is exploitable here. The exam cares less about naming a CVE and more about proving the precondition exists on this host, at this version, with these permissions.
342 words, about 2 min03Exploitation and Initial Access
Exploitation and Initial Access is where a confirmed weakness becomes a shell, a session, or a set of valid credentials. The exam assesses payload choice, listener hygiene, and whether you can stabilize and verify access without breaking scope.
344 words, about 2 min04Privilege Escalation (Linux and Windows)
This domain tests whether you can go from a low-privilege foothold to root or SYSTEM using misconfiguration rather than luck. Enumeration is the whole game: run automated collectors, then confirm every lead manually.
337 words, about 2 min05Active Directory Attack Paths
Active Directory Attack Paths tests whether you can take one valid domain account and chain it into Domain Admin. The exam rewards graph thinking: who can do what to whom, and which edge moves you closer to a Domain Controller.
332 words, about 2 min06Post-Exploitation, Pivoting, and Lateral Movement
This domain covers what happens after the first shell: harvesting credentials, reaching hosts that were unreachable, and proving impact without losing access or breaking the environment. Dump credentials where they live: /etc/shadow and .ssh keys on Linux; SAM, LSA and LSASS via secretsdump.py , mimikatz , or registry hives on Windows.
329 words, about 2 min07Reporting and Documentation
Reporting and Documentation is a scored domain, not an afterthought. Examiners read the report to decide whether you demonstrated the compromise and whether a client could reproduce it.
308 words, about 2 min