OSCP exam-day guide
OSCP · Prepare for the day ahead.
Your checklist
Government-issued photo ID
A valid, unexpired photo ID whose name matches your registration exactly. Confirm which ID types the provider accepts for your region before exam day - some proctors reject expired or non-photo documents.
Exam access details and scheduling confirmation
The email/portal link you use to start the exam, plus your OffSec (or provider) account credentials in case you need to re-authenticate or contact support.
Tested attack VM with a clean snapshot
Your Kali (or equivalent) VM fully updated, tools verified working, and a snapshot taken so you can roll back quickly if you break your environment mid-exam.
VPN client and connection details
The VPN package and credentials supplied for your exam, tested on your machine at least a day in advance. Confirm the current connection instructions with the provider, as file formats and portal locations change.
Primary internet connection plus a backup
Wired or strong Wi-Fi as primary, with phone tethering or a second connection ready. Test that the backup can carry the VPN before you need it.
Laptop power and a backup power source
Charger plugged in, battery healthy, and ideally a UPS or the ability to run on battery for a short outage. A 24-hour session will outlast most laptop batteries.
Note-taking and screenshot workflow
A folder structure per target, a scratchpad for commands and credentials, and a screenshot tool with a hotkey you can hit without thinking. Screenshots of proof are effectively your report's currency.
Report template and submission mechanics
The official report template downloaded and opened once so you know the sections. Confirm the submission format, size limits, and deadline window with the provider.
Food, water, and caffeine plan
Enough to get through the session without leaving the desk for long. Prefer low-mess, low-crash food; heavy meals mid-exam cost you focus.
Clock and time-boxing method
A visible timer or written schedule. Know your start time precisely and pre-plan checkpoints so you can tell when a target is worth abandoning.
Provider support contact channel
The support email/portal for technical or connectivity problems during the exam. Save it offline, not just in a browser bookmark.
Quiet, private, well-lit workspace
A room where you will not be interrupted or overheard, with a door you can close. Confirm any room/recording requirements with the provider in advance.
Plan the day
Stop learning new tools. Re-run your core workflow end to end on a practice target: enumeration, foothold, privilege escalation, and - critically - capturing clean proof screenshots. Rehearse the report write-up once so the template feels familiar. Fix anything broken in your VM now, not at hour three.
Re-read the official exam guide and scoring rules for your specific exam version. Write a one-page battle plan: enumeration checklist, privilege-escalation checklist, and the point threshold you need. Sleep on a normal schedule so your body clock is not fighting you on exam day.
Do a full dress rehearsal of the environment: boot the VM, connect to any practice VPN, confirm screenshots save where you expect, confirm your notes sync or are backed up. Charge everything. Clear your calendar and tell household members you are unavailable. Pack food and water. Get a full night's sleep - this matters more than one more box.
Eat properly, hydrate, and set up the desk before the start time. Have ID, credentials, and support contact within arm's reach. Start your notes file and a time log. Join/start the session early enough to resolve any authentication or proctoring hiccups without burning exam minutes.
Connect, verify you can reach the target network, and write down the time. Do a full enumeration pass on every target and record open ports, service versions, and obvious leads before you attack anything. This gives you a map and lets you triage which target to hit first.
Take the targets you consider most tractable first to bank points, and screenshot proof the moment you get a shell or read a flag. Do not save evidence collection for later; sessions die and boxes get reset.
Time-box every target (for example 60-90 minutes per box). At the end of a box's time budget, write down exactly where you stopped and what you would try next, then move on. Revisit stalled targets later with fresh eyes.
Reserve the last couple of hours for consolidation: verify every flag and proof capture is complete, note the exact commands and paths used, and stop starting new rabbit holes. Confirm how much time remains for the report and whether the report is written inside the exam window or after it with the provider.
Write the report immediately while details are fresh, following the official template and proof requirements. Submit before the deadline; confirm the deadline and submission channel with the provider rather than assuming.
Rules to check
Bring a valid government-issued photo ID matching your registered name; verify accepted document types with the provider before exam day.
Complete the exam alone: no third-party assistance, no unauthorized people in the room, no sharing of targets, flags, or exam materials with anyone during or after the session.
Stay in scope. Only interact with the hosts and networks explicitly assigned to you; scanning or attacking anything else can invalidate your attempt.
Some tooling is restricted - certain exploitation frameworks are typically limited to a small number of targets, and specific target types may prohibit them entirely. Read and follow the tooling restrictions in your exam guide; confirm the current list with the provider.
Breaks are generally permitted but the clock keeps running. Confirm the provider's current break, proctoring, and recording rules so you are not surprised mid-session.
The pass threshold is defined by the provider's current scoring scheme and point distribution across standalone and networked targets, sometimes plus bonus points earned beforehand. Confirm the exact threshold and point values for your exam version; do not rely on secondhand numbers.
All work in the report must be your own and reproducible, with the proofs the guide requires. Plagiarized or unverifiable write-ups can be rejected even if the flags were captured.
Keep exam materials, target details, and the contents of the exam guide confidential in line with your agreement with the provider.