OSEE study guide
OSEE · Work through your exam, one topic at a time.
The OSEE (Offensive Security Exploitation Expert) is a certification name associated with OffSec, the company behind the Kali Linux distribution and a family of hands-on penetration testing certifications. Candidates typically encounter it as an advanced, exploitation-focused credential aimed at security professionals who already write exploits and want to demonstrate depth in memory corruption, bypassing modern mitigations, and reliable payload development against hardened targets. Because the only permitted source for this page returned a 404 error page rather than certification content, this overview cannot confirm the exam's current format, duration, passing score, fee, retake policy, validity period, or the exact weighting of its domains. Those fields are marked for review and should be re-sourced from OffSec's live certification page before publication. What can be said with confidence is the general preparation approach such an exam rewards: build a working lab with debugging tools, study heap and stack exploitation primitives, practice writing full exploits rather than partial proofs of concept, and read vendor advisories and patch diffs to understand real vulnerability classes. Treat any specific numeric claim you see elsewhere as unverified until the official page is reachable. Topics on this exam: Exploit Development. The OSEE study guide has 1 section and about 531 words.
01Exploit Development (OSEE / EXP-401)
Exploit Development is the heart of the OSEE exam. You are not asked to find the bug - triage and root-cause may already be done for you - you are asked to weaponize a memory-corruption flaw against a Windows target and make it work repeatedly. Grading rewards reliability and understanding of why the chain works, not a one-shot crash-to-shell. End-to-end exploitation: from controlled crash, to EIP/instruction-pointer control, to payload execution.
531 words, about 3 minMore study resources for OSEE
- Practice questionsIn a classic stack-based buffer overflow on 32-bit x86 Linux, which register is overwritten by the saved return address that an attacker typically aims to control?
- FlashcardsEIP offset calculation. Send a cyclic pattern of unique 4-byte values; the value found in EIP at crash reveals the byte offset.
- Cheat sheetEIP offset = bytes sent at crash minus the byte index where EIP first contains the cyclic pattern value; confirm with a unique 4-byte marker at that offset.
- Key termsStack buffer overflow. A memory-safety flaw where a program writes more bytes into a fixed-size stack buffer than it can hold, overwriting adjacent locals, saved frame pointers, and the return address so control flow can be redirected.
- Study planMap the full exploit-development workflow (recon of a binary, triage, primitive identification, weaponization, reliability) and write it out as a one-page checklist you will reuse every week.
- Common mistakesDebuggers stop at the faulting instruction, so the overwritten instruction pointer looks like a clean win.
- Exam-day guideBring the exact ID required by the test provider (often a passport or driver's license).