OSED study guide
OSED · Work through your exam, one topic at a time.
The OffSec Exploit Developer (OSED) certification validates advanced Windows user-mode exploit development skills. It is aimed at penetration testers, security researchers, reverse engineers, and red team operators who already have a solid foundation in programming and basic exploitation concepts and want to master crafting custom exploits. The OSED study guide has 5 sections and about 1,933 words.
01Reverse engineering binaries to locate vulnerabilities
This domain tests whether you can take an unfamiliar 32-bit Windows binary, map its attack surface, and pin down the exact code path where attacker-controlled data reaches a memory-unsafe operation - then prove it with a controlled crash. Triage imports before reading disassembly: strcpy , strcat , sprintf , gets , lstrcpyA/W , wsprintfA , and memcpy / RtlCopyMemory with a length taken from input are all candidates.
376 words, about 2 min02Stack buffer overflow exploitation
This domain tests converting a confirmed stack overflow into reliable EIP control on Win32 x86: finding the exact offset, surviving a restricted character set, and landing execution inside your payload. Offset to EIP is the distance from buffer start to the saved return address.
374 words, about 2 min03Custom shellcode development
This domain tests writing your own position-independent, null-free payload rather than relying on a prebuilt blob - resolving APIs at runtime and surviving the character restrictions of the vulnerable input path. Never hardcode a module base.
351 words, about 2 min04Bypassing DEP and ASLR
With DEP the stack and heap are non-executable, so a jmp esp landing faults; with ASLR module bases move, so gadget and API addresses are unknown until leaked. This domain tests building a ROP chain that restores executability and pairing it with a way to learn a base address.
421 words, about 2 min05Format string exploitation and read primitive development
When user input is passed directly as the format string to printf , sprintf , snprintf , or vsprintf , the attacker owns both a read primitive and a write primitive. This domain tests building a reliable read first - leaking stack contents and module pointers - and only then converting that into control.
411 words, about 2 min