OSCP study guide: the exam guidelines and how to prepare

The official OSCP exam guide

OffSec publishes its OSCP exam guide in its help centre. It is the document that decides what counts on exam day, so read it before you start studying and again before you book. The essentials:

• 23 hours 45 minutes to complete the exam, then another 24 hours to upload your documentation.
• Three stand-alone machines worth 60 points in total — 10 for initial access and 10 for privilege escalation on each.
• One Active Directory set of three machines worth 40 points in total — 10, 10 and 20 points.
• A maximum of 100 points; you need at least 70 to pass.
• All OSCP+ exams are proctored.
• Results by email within ten business days after you submit your documentation.

Source: OffSec — OSCP+ Exam Guide (updated 20 April 2026). Checked 9 October 2026.

OSCP exam guidelines on tools

The OSCP exam guidelines on tools are strict, and your preparation should follow them from the first lab machine:

• Metasploit Auxiliary, Exploit and Post modules and the Meterpreter payload may be used against one single target machine of your choice — and not for pivoting.
• Multi/handler and msfvenom may be used against all targets, but Meterpreter only against that one chosen machine.
• Spoofing (IP, ARP, DNS, NBNS and so on), commercial tools or services, automatic exploitation tools and mass vulnerability scanners are not allowed.
• Using LLMs and AI chatbots is strictly prohibited.

Source: OffSec — OSCP+ Exam Guide (updated 20 April 2026). Checked 9 October 2026.

The report: half of the exam window

The second 24 hours exist for the report, and OffSec grades it strictly. The guide requires a professional report describing the exploitation of each target in enough detail that it can be replicated step by step, and warns that insufficient documentation will result in reduced or zero points.

Every local.txt and proof.txt must appear in a screenshot showing the file’s contents and the target’s IP address. Proof files are submitted in the control panel before the exam ends. The report must be a PDF, archived as .7z with the filename format OffSec specifies, not password-protected, and uploaded to OffSec’s upload site, where you verify the MD5 hash before submitting. A report that is not uploaded there will not be graded.

Source: OffSec — OSCP+ Exam Guide (updated 20 April 2026). Checked 9 October 2026.

What to study: PEN-200

The study material is PEN-200, Penetration Testing with Kali Linux. OffSec does not publish weighted exam domains; the course topics listed on its page are the scope — information gathering, vulnerability scanning, web application attacks, SQL injection, client-side attacks, locating and fixing public exploits, and report writing.

OffSec sets no formal prerequisites but recommends a solid foundation in networking and basic familiarity with Linux and Windows. If those are shaky, start with its Network Penetration Testing Essentials learning path before the clock on a time-limited lab subscription starts.

Source: OffSec — PEN-200 course. Checked 9 October 2026.

An OSCP prep plan that follows the guide

OffSec sets no study time, so this OSCP study guide does not invent one. What it can do is turn the exam rules into a plan:

• Work manually. Since Metasploit is limited to one machine and automatic exploitation tools are banned, practise every technique by hand; save Metasploit for a single, deliberate choice.
• Practise both parts. The AD set is worth 40 points and the stand-alone machines 60, so a pass needs points from both — 70 cannot come from either part alone.
• Count partial points. Initial access and privilege escalation are scored separately, so practise getting a foothold quickly and moving on when stuck.
• Write as you go. Take the screenshots the report needs — proof.txt and local.txt with contents and IP address — on every lab machine, and write each one up in report form.
• Rehearse the long day. Plan breaks, food and sleep for a window of almost 24 hours under proctoring, followed by another day for the report.
• Rehearse the submission. Practise producing a PDF, packing it as .7z with OffSec’s naming format and checking an MD5 hash, so the last step is routine.

Source: OffSec — OSCP+ Exam Guide (updated 20 April 2026). Checked 9 October 2026.

What not to use for OSCP prep

Leaked exam write-ups and so-called exam dumps are not preparation: there are no questions to memorise, and the report must show your own work. OffSec states that a certification can be revoked for cheating or for sharing exam reports or exam solutions, with a permanent bar from its courses.

Source: OffSec — Can my certification and/or badge ever be revoked?. Checked 9 October 2026.

Where Certsqill fits

Questions can only support a practical exam: Certsqill’s OSCP question bank uses expert-developed questions that explain every answer option to check the concepts behind PEN-200, while the hands-on work stays in the labs.

OSCP study guide: questions people ask

Where is the official OSCP exam guide?

In OffSec’s help centre, titled OSCP+ Exam Guide; it was last updated on 20 April 2026. Checked 9 October 2026.

What do the OSCP exam guidelines say about Metasploit?

Metasploit modules and the Meterpreter payload may be used against one target machine of your choice, not for pivoting. Multi/handler and msfvenom may be used against all targets. Source: OffSec, checked 9 October 2026.

Can I use ChatGPT or other AI tools during the OSCP exam?

No. OffSec’s exam guide states that using LLMs and AI chatbots is strictly prohibited.

What happens if my OSCP report is incomplete?

OffSec warns that insufficient documentation results in reduced or zero points, and a report not uploaded to its upload site will not be graded.

How long should OSCP prep take?

OffSec sets no study time. Judge readiness by whether you can compromise lab machines manually, across stand-alone and Active Directory targets, and document them to report standard.