OSWE exam-day guide
OSWE · Prepare for the day ahead.
Your checklist
Government-issued photo ID
The proctor will verify your identity against your registration before the exam starts. Use the same name exactly as it appears on your OffSec account; bring a second form of ID if you have one, since name-matching requirements are set by the provider - confirm with the provider which IDs are accepted.
Working webcam, microphone, and speakers/headset
Run a test call on the same machine and network you will use on exam day, at least 24 hours ahead. Know how to grant camera and screen-share permissions in your browser.
Stable wired or high-quality connection plus a backup
Have a fallback: a phone hotspot, a second ISP, or a tethering plan. Note that a mid-exam disconnection does not normally pause the clock - confirm with the provider how outages are handled.
VPN client installed and pre-tested
Install the VPN client and verify it launches and connects before exam day. You will not be able to troubleshoot package installs comfortably once the clock starts. Confirm with the provider which client version is required.
Virtualization software and your exam VM ready
If you use a local attack VM, confirm it boots, has snapshots, and can reach the VPN network. Keep a clean snapshot you can revert to if you break your tooling.
Local notes, methodology sheets, and payload snippets
Keep your own written methodology, exploit-development notes for each language, and reusable scripts in a local folder. Everything must be your own material and must comply with the provider's rules on notes and reference material - confirm with the provider what is permitted in the room.
Report template pre-built
Have a document with your standard sections (summary, findings, reproduction steps, evidence, remediation, appendices) ready before the clock starts so you only fill in content afterward.
Screenshot and evidence-capture workflow
Decide on a naming convention and a dedicated folder. Capture proof as you go rather than reconstructing it from memory at hour 40.
Quiet, private room and cleared desk
The proctor typically requires a closed room, a clear desk, and a room scan at the start. Remove notes, second screens, and phones from the desk unless the provider explicitly allows them.
Food, water, and a rest plan
A multi-day practical exam is an endurance event. Plan real sleep blocks and meals; fatigue-driven mistakes in exploit development cost far more time than the sleep does.
Confirm your report deadline and submission mechanism
Know the exact upload window, accepted file format, and file-size limit before you start. These specifics change - confirm with the provider and write them down where you can see them.
Backup your work continuously
Save notes, screenshots, and the report draft to a second location (encrypted archive or a second drive) at least every few hours. Never keep your only copy inside the exam VM.
Plan the day
Do a full dress rehearsal: connect through the VPN, boot your attack VM, exercise your tooling against a practice target you build yourself, and take a screenshot into your report template. Fix every friction point now, not during the exam.
Re-read the provider's exam guide and rules end to end, including what is and is not permitted in the room, how to reach support, and the report submission requirements. Note anything ambiguous and raise it with the provider - confirm with the provider rather than guessing.
Stop learning new topics. Spend the time re-reading your own methodology notes for the bug classes you are weakest at, and pre-write the boilerplate for your most common exploitation patterns.
Do a final connectivity and proctoring dry run on the exact hardware and network you will use. Check that your webcam and mic are recognized and that screen sharing works from your exam machine.
Prepare the room: clear the desk, remove extra screens and printed material unless permitted, and set up a single monitor where possible. Confirm your ID is within its validity period and the name matches your registration.
Build and save the empty report template, create your evidence folder structure, and make a checklist of the target list you will triage first.
Sleep a full night. Do not pull an all-nighter the night before a multi-day practical exam; you will lose more to sluggish analysis than you gain in prep.
Eat a real meal, hydrate, and log in early enough to complete the check-in, ID verification, and room scan without eating into exam time.
Before the clock starts, confirm with the proctor that your VPN connects and that you can reach the target network, and confirm how to summon support if the connection drops.
Triage before you exploit. Enumerate every in-scope target, fingerprint languages and frameworks, and write a short plan of attack with rough time boxes written down where you can see them.
Take the easy, well-understood findings first to lock in partial credit, and keep a running score estimate against the passing threshold so you know whether to push depth or breadth.
Write the report finding as soon as you confirm it: title, affected target, root cause, exact reproduction steps, evidence, and remediation. Never defer write-up to the end.
Stop starting new exploit chains with less than a few hours left. Consolidate, verify that every claimed finding has reproducible steps and evidence, and stop touching the environment well before the deadline.
Finalize and submit the report within the provider's post-exam window, verify the upload succeeded, and keep a local copy plus the submission confirmation.
Rules to check
Bring valid government-issued photo ID and be ready to show it on camera at check-in; the registered name must match. Ask the provider in advance about any name discrepancy, because it can block your exam start.
Stay connected to the proctoring session for the duration of the exam and keep your camera and screen share active as instructed. Disconnecting from proctoring is treated as a conduct issue, not a technical hiccup.
Work only in the environment and against the targets provided. Attacking infrastructure outside the exam network, the proctoring service, or the provider's own systems is out of scope and a violation regardless of technical feasibility.
Keep the room private and the desk clear. Anyone entering the room, or any second screen or unauthorized material visible, may invalidate the attempt. Confirm with the provider what reference material, if any, is allowed.
Do not communicate with other people about the exam content during the exam window, and do not share, publish, or sell exam targets or solutions afterward - you are typically bound by a confidentiality agreement.
Breaks are usually self-managed within the fixed clock rather than adding time; confirm with the provider how breaks, emergencies, and technical outages affect your remaining time before the exam starts.
Your score comes from the submitted report, not from the live environment. Findings without clear, reproducible proof may not earn credit, so treat documentation as part of the exploit work.
If you believe the environment is broken, contact exam support through the provider's official channel immediately and keep a record of the time and issue, rather than assuming you will be compensated afterward.