How to Study for OSCP in 30 Days: Full Preparation Plan (2026)
How to Study for OSCP in 30 Days: Full Preparation Plan (2026)
Thirty days to OSCP exam day and you need a bulletproof study plan. Here’s exactly how to prepare for one of the most challenging penetration testing certifications in the industry, designed for working professionals who can’t afford to waste a single day.
Direct answer
Week 1-2: Master OSCP fundamentals with 3 hours daily focused study. Week 3: Start practice exams and scenario-based challenges. Week 4: Refine weak areas and complete final readiness assessment. Follow three practice exam checkpoints at days 14, 21, and 28 with target scores of 65%, 75%, and 85% respectively.
This plan allocates 21 hours weekly across all three OSCP domains: Penetration Testing with Kali Linux (40%), Active Directory Attacks (30%), and Buffer Overflows and Exploit Development (30%). Each week targets specific learning outcomes with measurable progress markers.
Is 30 days enough to pass OSCP?
Thirty days is tight but absolutely doable if you have the right foundation and follow a structured approach. Here’s the reality check you need:
You can pass in 30 days if you have:
- 2+ years of hands-on cybersecurity experience
- Solid Linux command line skills
- Basic networking knowledge (TCP/IP, routing, common protocols)
- Some scripting experience (Python, Bash, or PowerShell)
- Can commit 3-4 hours of focused study daily
You’ll struggle with 30 days if you’re:
- Brand new to penetration testing
- Unfamiliar with Linux systems administration
- Haven’t touched a command line interface
- Can only study on weekends
The OSCP exam format demands practical skills, not memorization. You’ll spend 24 hours in a live environment compromising machines through real exploitation techniques. This means your 30-day plan must emphasize hands-on practice over theory.
Most successful candidates with similar timelines report spending 80-100 total hours studying. That’s roughly 3 hours per day over 30 days — completely achievable for motivated professionals.
What you need before starting this plan
Before diving into your 30-day sprint, ensure you have these prerequisites locked down:
Technical Foundation:
- Comfortable with Linux terminal navigation and basic commands
- Understanding of networking fundamentals (subnets, ports, protocols)
- Basic scripting knowledge in at least one language
- Familiarity with common security tools (Nmap, Metasploit, Burp Suite)
Equipment and Resources:
- Dedicated study machine capable of running virtual machines
- VMware Workstation or VirtualBox for lab environments
- Kali Linux installation (latest version)
- Windows 10/11 VM for Active Directory practice
- Note-taking system (OneNote, Obsidian, or similar)
Time Management:
- Block out 3-4 hours daily for focused study
- Weekend availability for extended practice sessions
- Minimal social commitments during the 30-day period
Study Materials:
- Official OSCP course materials and lab access
- Updated practice exam platform (Certsqill recommended)
- Buffer overflow development environment setup
If you’re missing any of these elements, address them before starting day 1. Attempting this aggressive timeline without proper preparation wastes precious study time.
Week 1: Foundation — understanding OSCP domains
Your first week establishes the groundwork across all three exam domains. Focus on understanding core concepts rather than advanced exploitation techniques.
Days 1-2: Penetration Testing with Kali Linux (8 hours total)
Start with reconnaissance and enumeration fundamentals. These skills underpin every successful penetration test.
Spend 4 hours learning active and passive information gathering:
- Master Nmap scanning techniques and output interpretation
- Practice DNS enumeration with dig, host, and dnsrecon
- Explore web application reconnaissance using dirb, gobuster, and nikto
- Understand OSINT gathering methods and tools
Dedicate another 4 hours to vulnerability assessment:
- Learn to identify common service vulnerabilities
- Practice manual service enumeration (HTTP, SSH, SMB, FTP)
- Understand how to correlate version information with known exploits
- Set up and configure essential Kali Linux tools
Days 3-4: Active Directory Attacks (8 hours total)
Active Directory represents 30% of your exam score and often determines pass/fail outcomes.
First 4 hours focus on AD fundamentals:
- Understand domain controller architecture and authentication flows
- Learn Active Directory enumeration techniques
- Practice with PowerView and BloodHound for domain mapping
- Master basic LDAP queries and directory service interaction
Next 4 hours cover initial access techniques:
- Password spraying and credential stuffing methods
- Kerberoasting attack methodology and detection
- ASREPRoasting exploitation techniques
- Basic privilege escalation paths in Windows environments
Days 5-7: Buffer Overflows and Exploit Development (12 hours total)
Buffer overflows intimidate many candidates, but they’re highly predictable with proper methodology.
Allocate 6 hours to overflow fundamentals:
- Understand stack-based buffer overflow mechanics
- Learn to identify vulnerable functions in C code
- Practice with basic overflow exploitation in controlled environments
- Master debugger usage (GDB, Immunity Debugger, or x64dbg)
Spend another 6 hours on exploitation techniques:
- Learn to calculate offset values and control EIP
- Practice bad character identification and removal
- Understand return address overwriting techniques
- Generate and implement basic shellcode payloads
Week 1 Milestone Check: By day 7, you should comfortably navigate Kali Linux, enumerate basic services, understand AD structure, and overflow simple buffer vulnerabilities. If you’re struggling with any domain, adjust week 2 allocation accordingly.
Week 2: Deep dive — hardest OSCP topics
Week 2 tackles the most challenging aspects of each domain. This is where many candidates stumble, so maintain consistent daily effort.
Days 8-10: Advanced Penetration Testing (12 hours total)
Focus on exploitation and post-exploitation techniques that separate passing scores from failures.
Dedicate 6 hours to web application security:
- SQL injection exploitation beyond basic union attacks
- Advanced XSS payloads and filter bypasses
- Command injection techniques and payload construction
- File upload vulnerabilities and restriction bypasses
- Local file inclusion (LFI) and remote file inclusion (RFI) exploitation
Spend 6 hours on network service exploitation:
- SSH key-based authentication attacks
- SMB enumeration and exploitation techniques
- Database service attacks (MySQL, MSSQL, PostgreSQL)
- Custom exploit modification and payload generation
- Post-exploitation enumeration and persistence methods
Days 11-12: Advanced Active Directory Attacks (8 hours total)
Master the complex AD attack chains that appear frequently on OSCP exams.
First 4 hours cover lateral movement:
- Pass-the-Hash and Pass-the-Ticket attack execution
- Golden Ticket and Silver Ticket attack methodologies
- DCSync attack implementation and requirements
- Constrained and unconstrained delegation exploitation
Next 4 hours focus on privilege escalation:
- Windows privilege escalation methodology and tools
- Service misconfiguration exploitation
- Registry and file system permission abuse
- Token impersonation and process injection techniques
Days 12-14: Advanced Buffer Overflow Exploitation (8 hours total)
Build upon week 1 foundations with real-world exploitation scenarios.
Allocate 4 hours to bypass techniques:
- DEP (Data Execution Prevention) bypass methods
- ASLR (Address Space Layout Randomization) circumvention
- Stack cookie and canary bypass techniques
- Return-oriented programming (ROP) chain basics
Spend 4 hours on payload development:
- Custom shellcode generation and encoding
- Multi-stage payload deployment
- Payload size constraints and optimization
- Anti-virus evasion techniques for exploit payloads
Week 2 Milestone Check: You should successfully exploit moderately complex vulnerabilities in all three domains. Practice combining techniques — web app exploitation leading to AD compromise, or buffer overflow providing initial access for further enumeration.
Week 3: Practice — scenario questions and exams
Week 3 shifts from learning to application through intensive practice exam scenarios.
Days 15-17: Integrated Scenario Practice (12 hours total)
Work through complete penetration testing scenarios that mirror exam conditions.
Spend 6 hours on multi-stage attack chains:
- Initial reconnaissance leading to web application compromise
- Privilege escalation from web shell to administrative access
- Lateral movement through compromised networks
- Active Directory compromise through chained exploitation
- Documentation and reporting of complete attack paths
Dedicate 6 hours to time management practice:
- Complete exploitation scenarios within 2-4 hour time limits
- Practice efficient note-taking during active exploitation
- Develop consistent methodology for approaching unknown targets
- Build muscle memory for common tool usage and syntax
Days 18-19: First Practice Exam Checkpoint (8 hours total)
Take your first full-length practice exam under timed conditions.
Target Score: 65% minimum
This checkpoint identifies knowledge gaps before your final preparation week. Spend 6 hours on exam simulation:
- Complete practice exam in allocated time
- Document all exploitation attempts, successful and failed
- Note time spent on each target machine
- Identify technical areas requiring additional study
Use 2 hours for post-exam analysis:
- Review all missed questions and failed exploitation attempts
- Identify patterns in mistakes (methodology vs. technical knowledge)
- Plan targeted remediation for identified weak areas
- Update study plan for remaining days
Days 20-21: Targeted Weakness Remediation (8 hours total)
Address specific gaps identified during practice exam analysis.
Focus remediation efforts based on practice exam performance:
- If penetration testing scored below 65%: Return to enumeration fundamentals and common exploit techniques
- If Active Directory scored below 65%: Review authentication protocols and lateral movement methods
- If buffer overflow scored below 65%: Practice overflow methodology with different vulnerable applications
Allocate time proportionally to domain weaknesses while maintaining proficiency in stronger areas.
Week 3 Milestone Check: Practice exam score should reach 65% minimum with clear understanding of mistakes. Time management should allow completion of multiple exploitation scenarios within exam-style constraints.
Week 4: Refinement — weak areas and final readiness
Your final week emphasizes refinement and confidence building through targeted practice.
Days 22-24: Domain-Specific Intensive Review (12 hours total)
Dedicate focused time to each domain based on practice exam performance.
High-priority penetration testing topics (4 hours):
-
Web application exploitation methodology review
-
Network service enumeration and exploitation
-
Post-exploitation techniques and privilege escalation paths
-
Common tool usage patterns and command syntax review
High-priority Active Directory topics (4 hours):
- Authentication protocol weaknesses and exploitation
- Kerberos attack methodology and implementation
- Lateral movement technique execution and detection
- Domain controller compromise and persistence methods
High-priority buffer overflow topics (4 hours):
- Systematic overflow exploitation methodology
- Debugger usage and exploit development workflow
- Shellcode generation and payload customization
- Memory protection bypass techniques
Days 25-26: Second Practice Exam Checkpoint (8 hours total)
Execute your second full practice exam with improved performance expectations.
Target Score: 75% minimum
Spend 6 hours completing the practice exam:
- Maintain strict time discipline throughout all scenarios
- Apply lessons learned from first practice exam experience
- Focus on methodology over speed during complex exploitation
- Document decision-making process for post-exam review
Dedicate 2 hours to comprehensive performance analysis:
- Compare scores across all three domains with first practice exam
- Identify improvement areas and persistent knowledge gaps
- Analyze time allocation efficiency across different question types
- Adjust final week study priorities based on remaining weaknesses
Days 27-28: Advanced Scenario Integration (8 hours total)
Practice realistic OSCP scenario questions on Certsqill — with AI Tutor explanations that show exactly why each answer is right or wrong.
Work through complex, multi-domain scenarios that combine techniques:
Cross-domain attack chains (4 hours):
- Web application compromise leading to Active Directory access
- Buffer overflow exploitation enabling network lateral movement
- Active Directory reconnaissance informing targeted penetration testing
- Privilege escalation techniques across Windows and Linux environments
Exam simulation scenarios (4 hours):
- Complete end-to-end penetration testing engagements
- Practice comprehensive documentation and reporting requirements
- Simulate exam stress conditions with time pressure
- Validate consistent application of learned methodologies
Week 4 Milestone Check: Second practice exam should score 75% or higher with confident execution across all domains. You should demonstrate consistent methodology application and efficient time management under pressure.
Final exam day preparation strategy
Your final two days before the OSCP exam require strategic preparation rather than intensive studying.
Day 29: Final Practice Exam and Mental Preparation
Execute your third and final practice exam checkpoint with peak performance expectations.
Target Score: 85% minimum
Spend 6 hours on final exam simulation:
- Complete practice exam under exact OSCP conditions
- Maintain calm, methodical approach throughout all scenarios
- Demonstrate mastery of time allocation and prioritization
- Execute comprehensive documentation practices
Use 2 hours for final preparation activities:
- Review personal methodology checklists and reference materials
- Organize digital notes and tool reference guides
- Prepare physical exam environment (lighting, seating, supplies)
- Complete mental preparation and stress management techniques
Day 30: Rest and Final Review
Avoid intensive studying on exam eve. Focus on readiness confirmation and mental preparation.
Morning activities (2 hours maximum):
- Light review of methodology checklists and common command syntax
- Quick verification of tool installations and environment setup
- Brief practice with favorite exploitation techniques for confidence
- Organization of exam-day materials and reference documents
Afternoon and evening priorities:
- Physical preparation: adequate sleep, proper nutrition, light exercise
- Mental preparation: visualization techniques, stress management, confidence building
- Environment preparation: exam space organization, technical setup verification
- Social preparation: inform family/roommates of exam requirements and timing
Avoid cramming new material or attempting complex practice scenarios. Your knowledge foundation is established — focus on optimal performance conditions.
Common OSCP mistakes and how to avoid them
Understanding frequent candidate mistakes helps you avoid similar pitfalls during your 30-day preparation.
Mistake 1: Inadequate time management during preparation
Many candidates underestimate the time required for hands-on practice. They spend excessive time reading about techniques without sufficient practical application.
Solution: Allocate 70% of study time to hands-on practice and only 30% to theory review. Use active learning techniques like explaining concepts aloud or teaching others to verify understanding.
Mistake 2: Neglecting systematic enumeration methodology
Candidates often jump to advanced exploitation techniques without thorough reconnaissance. This approach fails during exam scenarios requiring comprehensive service analysis.
Solution: Develop and consistently apply enumeration checklists. Practice systematic service discovery and vulnerability assessment before attempting exploitation. Document findings methodically to avoid overlooking critical information.
Mistake 3: Over-relying on automated exploitation tools
Heavy dependence on Metasploit and automated scanners creates vulnerability when manual exploitation is required. The OSCP exam emphasizes manual techniques and tool customization.
Solution: Practice manual exploitation techniques extensively. Learn to modify existing exploits and understand underlying vulnerability mechanics. Use automated tools for efficiency but maintain manual exploitation capabilities.
Mistake 4: Insufficient Active Directory attack chain practice
Many candidates understand individual AD attack techniques but struggle with chaining them together effectively. This limitation severely impacts exam performance.
Solution: Practice complete AD compromise scenarios from initial access through domain controller control. Understand attack prerequisites and sequencing requirements for complex exploitation chains.
Mistake 5: Poor stress management during extended exam periods
The 24-hour OSCP exam format creates mental and physical fatigue that impacts decision-making and technical execution. Inadequate preparation for this endurance challenge leads to performance degradation.
Solution: Practice extended study sessions (6-8 hours) during preparation. Develop break scheduling, nutrition planning, and mental reset techniques. Simulate exam stress conditions during practice sessions.
FAQ
Q: Can I realistically pass OSCP with only 30 days of preparation if I’m working full-time?
A: Yes, but success requires exceptional time management and focus. You’ll need to commit 3-4 hours daily of high-quality study time, plus extended weekend sessions. Success depends heavily on your existing technical foundation — professionals with 2+ years of cybersecurity experience have significantly better outcomes than complete beginners.
Q: Which OSCP domain should I prioritize if I can’t master all three areas in 30 days?
A: Prioritize Penetration Testing with Kali Linux first (40% of exam weight), followed by Active Directory Attacks (30%). Buffer overflow questions are highly predictable but represent only 30% of the total score. However, completely neglecting any domain risks automatic failure, so allocate time proportionally to exam weightings while addressing your weakest areas first.
Q: How many practice exams should I take during my 30-day preparation period?
A: Complete exactly three full practice exams on days 14, 21, and 28 with target scores of 65%, 75%, and 85% respectively. This schedule provides adequate feedback for improvement while avoiding over-testing fatigue. Supplement with shorter scenario-based practice sessions throughout your preparation period.
Q: What’s the minimum score needed to pass the OSCP exam in 2026?
A: OSCP requires a passing score of 70% across all exam domains. However, you cannot completely fail any single domain — you must achieve minimum competency in penetration testing, Active Directory attacks, and buffer overflow exploitation. Focus on balanced preparation rather than excelling in one area while neglecting others.
Q: Should I postpone my OSCP exam if I’m not scoring 85% on practice exams after 30 days?
A: Consider your practice exam performance trends rather than absolute scores. If you’re consistently improving and scoring above 75% with strong performance in two of three domains, proceed with your scheduled exam. However, if you’re scoring below 70% or showing declining performance, consider rescheduling to avoid a failed attempt that requires waiting periods before retaking.