OSCE3 study guide
OSCE3 · Work through your exam, one topic at a time.
OSCE3 is an advanced, hands-on offensive security certification offered by OffSec. It is aimed at experienced penetration testers, red team operators, and exploit developers who already hold foundational certifications and want to prove depth across multiple offensive disciplines rather than a single specialty. The exam is practical and lab-based: candidates are expected to demonstrate working exploitation skills against live targets instead of answering multiple-choice items, so preparation should center on repeated hands-on practice, note-taking discipline, and reliable tooling. Because the official certification page returned a 404 - Page Not Found error when retrieved on 2026-11-07, no verified specifications are available. The OSCE3 study guide has 4 sections and about 1,513 words.
01Web Application Testing
This domain tests white-box web exploitation: reviewing application source, tracing attacker-controlled data to dangerous sinks, and writing a reliable exploit chain rather than firing off scanner payloads. You are expected to understand framework routing, authentication and session logic, and how small logic flaws combine into high-impact access.
397 words, about 2 min02Active Directory Exploitation
This domain tests multi-step Active Directory attack paths from a low-privileged foothold to high-value access, including cross-domain and cross-forest movement. The emphasis is on enumeration, abuse of misconfigured permissions and delegation, Kerberos ticket attacks, AD CS, and credential extraction, all while maintaining operational plausibility.
365 words, about 2 min03Evasion Techniques and Breaching Defenses
This domain tests payload delivery and execution against defensive controls: antivirus, EDR, AMSI, PowerShell logging, application allowlisting, network filtering, and credential protection. Success means getting code to run, keeping it running, and moving across network boundaries without relying on disabled defenses.
376 words, about 2 min04Binary Exploitation and Reverse Engineering
This domain tests Windows userland exploit development and reverse engineering: finding a memory-corruption bug, understanding mitigations, and producing a reliable exploit. You need to read disassembly, identify control over memory, and handle ASLR, DEP, stack cookies, SafeSEH, and character restrictions.
375 words, about 2 min