OSED cert: exam, cost, EXP-301 course and prep
The OSED cert — OffSec Exploit Developer — is OffSec’s Windows user-mode exploit development certification, earned through the EXP-301 course. The exam is hands-on and proctored: 47 hours and 45 minutes to solve three independent exploit development tasks, then 24 hours to submit a report; you need 60 of 100 points, which means fully solving at least two of the three. The cheapest route is the US$1,749 Course + Cert Bundle with one exam attempt. OSED does not expire.
- Certification
- OffSec Exploit Developer (OSED), issued by OffSecOffSec EXP-301 page, checked 10 October 2026
- Official course
- EXP-301: Windows User Mode Exploit DevelopmentOffSec EXP-301 page, checked 10 October 2026
- Cost
- US$1,749 Course + Cert Bundle (1 attempt); US$2,749/year Learn One (2 attempts)OffSec EXP-301 page, checked 10 October 2026
- Exam duration
- 47 hours 45 minutes, then 24 hours to submit the reportOffSec OSED Exam Guide, checked 10 October 2026
- Exam tasks
- 3 independent exploit development tasksOffSec OSED Exam Guide, checked 10 October 2026
- Passing score
- 60 of 100 points — at least two of three tasks fully solvedOffSec OSED Exam Guide and Exam FAQ, checked 10 October 2026
- Delivery
- Online, proctored by OffSec over a private VPNOffSec EXP-301 page and Exam Guide, checked 10 October 2026
- Course prerequisites
- Debugger familiarity, basic 32-bit exploitation concepts, Python 3OffSec OSED EXP-301 FAQ, checked 10 October 2026
- Validity
- Does not expire; no annual maintenance feeOffSec AMF FAQ, checked 10 October 2026
Know if you're ready for OSED — before you book.
Certsqill measures your OSED readiness across every official exam domain — one 0–100 score from coverage, accuracy and consistency that tells you whether to book, keep studying, or sit.
Why people switch to Certsqill
Everything you need to walk in ready
Know where you stand, understand every mistake, and study in your language — one payment, no subscription.
Your OSED Readiness Score, not a guess
One number from three signals — coverage, accuracy, and consistency — tells you whether to book the exam or keep studying.
Understand every OSED mistake
When you miss a question, it explains why — using your own answer history to catch the patterns you keep repeating. Included, no subscription.
Explanations in your language, questions stay exam-accurate
Get every explanation in your language while the questions stay in exam-accurate English. Technical terms stay in English — the way the exam writes them.
Everything you need to pass
Why you can trust these OSED questions
What is the OSED cert?
OSED stands for OffSec Exploit Developer. It is OffSec’s 300-level certification for exploit development on Windows in user mode, and you earn it by passing the exam attached to EXP-301: Windows User Mode Exploit Development.
OffSec describes EXP-301 as an intermediate-level, self-paced course focused on modern exploit development skills: reverse engineering, writing shellcode and bypassing modern mitigations. The exam is entirely practical — there are no multiple-choice questions — so the OSED cert shows that you can find a bug and turn it into a working exploit, not just describe one.
OSED is also one of three parts of OSCE³. OffSec awards OSCE³ automatically once you complete its three advanced courses and pass their exams: WEB-300, PEN-300 and EXP-301.
Source: OffSec Help Center — OSED EXP-301 FAQ. Checked 10 October 2026.
How much does the OSED cert cost?
OffSec sells the OSED exam together with course access. The Course + Cert Bundle costs US$1,749 one time and includes 90 days of access to one 200- or 300-level course, the associated labs and a single exam attempt. Learn One costs US$2,749 a year and includes one year of access and two exam attempts. Learn Unlimited costs US$6,099 a year with unlimited exam attempts.
Bundle buyers can extend lab access in 30-day increments; OffSec notes that lab extensions do not include additional exam attempts. All exams have a cooling-off period between attempts, and OffSec does not show a standalone retake price on the pages checked.
- Course + Cert Bundle: US$1,749 one time — 90 days, 1 exam attempt
- Learn One: US$2,749 per year — 1 year, 2 exam attempts
- Learn Unlimited: US$6,099 per year — unlimited exam attempts
Source: OffSec — EXP-301: Windows User Mode Exploit Development. Checked 10 October 2026.
OSED exam format: three tasks in 48 hours
OffSec markets the OSED exam as 48-hour proctored; the exam guide gives the exact limit as 47 hours and 45 minutes. The exam consists of three independent tasks related to exploit development, and the exam sets are assigned at random, so a retake is not guaranteed to give you the same set.
After the exam ends you have another 24 hours to submit your documentation. The report must be detailed enough that a technically competent reader can replicate your attacks step by step, and each proof.txt has to be shown in a screenshot together with the target’s IP address.
The exam is open book: you may use your notes and online resources. What you may not use are LLMs and AI chatbots, which OffSec strictly prohibits, or help from other people.
Source: OffSec Help Center — EXP-301 OSED Exam Guide. Checked 10 October 2026.
OSED passing score
You need at least 60 of the 100 available points. OffSec’s exam FAQ translates that into tasks: the exam can be passed by solving at least two out of three assignments.
There is no partial credit. Only solutions that fully solve an assignment earn points, so two complete exploits beat three nearly working ones.
Source: OffSec Help Center — OSED Exam FAQ. Checked 10 October 2026.
OSED syllabus: what EXP-301 covers
OffSec summarises the EXP-301 syllabus in its course FAQ. The course prerequisites refer to exploitation on 32-bit systems and to 32-bit assembly, so that is the level of detail to prepare for.
- Buffer overflow techniques and crafting custom exploits
- Bypassing security mitigations such as DEP and ASLR
- Writing shellcode
- Format string exploits
- Reverse engineering with WinDbg and IDA
Source: OffSec Help Center — OSED EXP-301 FAQ. Checked 10 October 2026.
OSED exam rules and allowed tools
The exam guide is specific about tooling. Reverse engineering must be done with IDA Freeware and WinDbg, as taught in the course; Ghidra is not allowed. All solution code must be written in Python 3. Metasploit Community is allowed, but commercial software such as Metasploit Pro, Cobalt Strike, Core Impact or Burp Suite Pro is not, and neither is the commercial version of IDA Pro.
Practise with exactly this toolset during your prep, so the exam is not the first time you work without your usual tools.
Source: OffSec Help Center — EXP-301 OSED Exam Guide. Checked 10 October 2026.
OSED prerequisites: what you need before EXP-301
OffSec lists three prerequisites for the course: familiarity with debuggers such as ImmunityDBG and OllyDBG, an understanding of basic exploitation concepts on 32-bit systems, and the ability to write Python 3 code.
It also recommends, as optional skills, a basic ability to read C code and basic skills in reading 32-bit assembly. These are listed as course prerequisites; OffSec does not name a prior certification as a requirement on the pages checked.
Source: OffSec Help Center — OSED EXP-301 FAQ. Checked 10 October 2026.
Does the OSED cert expire?
No. OffSec’s Annual Maintenance Fee FAQ lists OSED among the certifications that do not expire and do not require annual maintenance. The annual fee of US$145 covers a short list of expiring certifications, such as OSCP+, and OSED is not on it.
Source: OffSec Help Center — Annual Maintenance Fee (AMF) FAQ. Checked 10 October 2026.
OSED cheating rules
OffSec treats sharing, leaking or using exam materials, reports or solutions as a violation. The listed consequences include not receiving the certification, revocation of certifications already issued and a lifetime ban from future OffSec courses and offerings.
Discussing the exam or asking for hints on forums or chat apps such as Discord is also prohibited, according to the exam FAQ.
Source: OffSec Help Center — Cheating on a certification exam. Checked 10 October 2026.
OSED practice questions and exam prep
OSED practice questions on Certsqill come with an explanation for each answer option and a readiness score per domain, so you can check the theory behind mitigations, shellcode and reverse engineering before you book.
Because the OSED exam itself is hands-on, questions are a complement to lab work in EXP-301, not a replacement for it.
Source: OffSec — OSCE³. Checked 10 October 2026.
OSED questions people ask
What is the OSED cert?
OffSec Exploit Developer, OffSec’s Windows user-mode exploit development certification, earned through EXP-301. Source: OffSec, checked 10 October 2026.
How much does the OSED cost?
From US$1,749 for the Course + Cert Bundle with one exam attempt; Learn One is US$2,749 a year with two attempts. Checked 10 October 2026.
How long is the OSED exam?
47 hours and 45 minutes, followed by 24 hours to submit the report. Source: OffSec OSED Exam Guide, checked 10 October 2026.
What is the OSED passing score?
60 of 100 points, which means fully solving at least two of the three tasks. Source: OffSec, checked 10 October 2026.
Is the OSED exam open book?
Yes, notes and online resources are allowed, but LLMs and AI chatbots are strictly prohibited. Source: OffSec, checked 10 October 2026.
Which tools can I use in the OSED exam?
IDA Freeware and WinDbg for reverse engineering, Python 3 for solutions, and Metasploit Community; Ghidra and commercial tools are not allowed. Checked 10 October 2026.
What are the OSED prerequisites?
OffSec lists debugger familiarity, basic 32-bit exploitation concepts and Python 3 skills. Checked 10 October 2026.
Does the OSED expire?
No. OSED does not expire and needs no annual maintenance fee. Source: OffSec AMF FAQ, checked 10 October 2026.
Is OSED part of OSCE3?
Yes. OSCE³ is awarded automatically after passing the WEB-300, PEN-300 and EXP-301 exams. Source: OffSec, checked 10 October 2026.
