OSEP study guide
OSEP · Work through your exam, one topic at a time.
The OffSec Experienced Penetration Tester (OSEP) credential - historically tied to the PEN-300 course track - is an advanced, hands-on certification aimed at practitioners who already operate comfortably in Windows and Linux environments and want to demonstrate tradecraft beyond basic exploitation: phishing and client-side delivery, evading antivirus and EDR controls, bypassing application whitelisting, escalating privileges in Active Directory, moving laterally, and sustaining post-exploitation access on Linux hosts. Candidates are typically red teamers, senior penetration testers, or security engineers whose day job involves operating against defended networks rather than isolated vulnerable boxes. The OSEP study guide has 4 sections and about 1,588 words.
01Client-Side Attacks and Initial Access
Initial access questions test whether you can name each link of a delivery chain: pretext and delivery channel (phishing email, Teams/Slack message, USB, watering hole, exposed VPN or RDP), the container (document, archive, container image, shortcut, HTML page), the execution primitive (macro, HTA, scriptlet, DLL, installer, LNK target), and the post-execution callback. Candidates lose points by memorising payloads instead of chains.
403 words, about 2 min02Antivirus and EDR Evasion / Application Whitelisting Bypass
AV/EDR evasion targets the sensor stack: static signatures, emulation and heuristics, then the dynamic layers, userland API hooking in ntdll , AMSI for script and .NET content, ETW for telemetry, and kernel callbacks. Whitelisting bypass targets policy: AppLocker, WDAC, or Software Restriction Policies that decide whether a binary or script is allowed to run regardless of intent.
390 words, about 2 min03Windows and Active Directory Privilege Escalation and Lateral Movement
Every Windows escalation primitive collapses into one of three: you control a process token (privileges, integrity level, group membership), you control a service or scheduled task that runs as someone stronger, or you can read a credential (memory, registry, disk, or the directory). Map findings to that triad: SeImpersonate / SeAssignPrimaryToken to the Potato family to SYSTEM; unquoted service paths, weak service ACLs, and writable PATH directories to service-account takeover; SeBackupPrivilege / SeRestorePrivilege to registry hives and NTDS.dit ; SeDebugPrivilege to LSASS.
376 words, about 2 min04Linux Post-Exploitation and Advanced Attack Tradecraft
Kernel exploits are the last resort and the wrong first answer in a scenario that hands you a misconfiguration. Manual enumeration order: identity and groups ( id , sudo -l ), SUID/SGID binaries and file capabilities, cron jobs and timers, writable service units and PATH directories, NFS exports with no root squash , readable credential material ( ~/.ssh , ~/.bash history , config files, /etc/shadow ), and group-based rights such as docker , lxd , disk , or adm .
419 words, about 2 min