The OSCP (Offensive Security Certified Professional) is the most respected hands-on penetration testing certification in the cybersecurity industry. Offered by OffSec (formerly Offensive Security), the OSCP requires candidates to actually hack into machines in a live exam environment — not just answer multiple-choice questions. This makes it the gold standard for proving real-world offensive security skills. The OSCP motto "Try Harder" has become an industry mantra, and the certification is widely considered the benchmark that separates theoretical knowledge from practical hacking ability.

Certification Structure

Course: PEN-200 (Penetration Testing with Kali Linux)
Exam format: 23 hours and 45 minutes of hands-on penetration testing in a proctored lab environment + 24 hours to write and submit a professional penetration test report
Exam objective: Compromise multiple machines in a simulated network to earn points (minimum 70 out of 100 points to pass)
Point structure: 3 standalone machines (20 points each = 60 points) + 1 Active Directory set (40 points)
Bonus points: Up to 10 bonus points for completing course exercises and lab machines
Proctoring: Live proctored via webcam throughout the entire exam

PEN-200 Course Content

Penetration testing methodology and reporting
Information gathering and enumeration
Web application attacks (SQL injection, file inclusion, command injection)
Client-side attacks and social engineering
Public exploit identification, modification, and usage
Password attacks and hash cracking
Port redirection and tunneling
Active Directory attacks and lateral movement
Privilege escalation (Linux and Windows)
Antivirus evasion techniques
Metasploit Framework usage

Cost

Learn One subscription (recommended): $1,749/year — includes PEN-200 course, lab access, 1 exam attempt, and access to all OffSec Learn courses
Individual PEN-200 course + 90-day lab + 1 exam attempt: $1,649
Exam retake: $249 per additional attempt
Learn Unlimited: $5,499/year — includes unlimited exam attempts and all OffSec courses

Top Preparation Resources

OffSec PEN-200 Official Labs: Included with the course — 70+ lab machines in a realistic network; the primary preparation tool
Hack The Box (HTB): $14/month for VIP — hundreds of retired machines with community walkthroughs; the most popular supplemental practice platform for OSCP
TJ Null's OSCP-like HTB/PG List: Free — curated list of Hack The Box and Proving Grounds machines that closely match OSCP difficulty; considered essential prep
Proving Grounds (OffSec): $19/month (Practice) or included with Learn One — OffSec's own practice machines; closest to actual exam difficulty
TryHackMe OSCP Learning Path: $14/month — structured path covering OSCP topics with guided walkthroughs
IppSec YouTube Channel: Free — detailed video walkthroughs of HTB machines; teaches the methodology, not just the answer

Study Timeline

With pentesting experience: 2–3 months of lab practice
With general IT/security experience: 3–6 months
Career changers: 6–12 months (complete prerequisites first — Linux, networking, basic scripting)
Pass rate: Estimated 40–50% on first attempt (notoriously challenging)
Average attempts: Many successful candidates pass on their 2nd or 3rd attempt

Prerequisites (Recommended)

Solid understanding of TCP/IP networking
Comfortable with Linux command line (Kali Linux)
Basic scripting ability (Python or Bash)
Understanding of web applications and common vulnerabilities
Familiarity with Windows and Active Directory environments
Recommended prior certs: CompTIA Security+, eJPT, or equivalent knowledge

Certification Maintenance

No expiration: The OSCP certification does not expire — it is valid for life
No renewal fees or CPE requirements

Career Impact

Average salary: $110,000–$150,000 for OSCP holders in the US
Target roles: Penetration tester ($95K–$140K), red team operator ($110K–$170K), security consultant ($100K–$160K), offensive security engineer ($120K–$180K), application security engineer ($115K–$165K)
Freelance/consulting: OSCP-certified pentesters charge $150–$300/hour; boutique pentesting firms charge $15,000–$50,000+ per engagement
Bug bounties: OSCP skills directly translate to bug bounty hunting — top hunters on HackerOne/Bugcrowd earn $100K–$1M+/year
Hiring signal: OSCP is the single most respected credential among technical security hiring managers — it proves you can actually hack, not just talk about it

OSCP vs. Other Pentesting Certs

OSCP: 100% hands-on exam; most respected by practitioners; proves real hacking ability; lifetime validity; harder
CEH: Multiple-choice exam; broader but shallower coverage; more recognized by HR; easier to obtain
PNPT (TCM Security): Practical exam + report; more affordable ($399); includes Active Directory and external pentest; growing recognition; good stepping stone to OSCP
eJPT (INE): Entry-level practical exam; $249; good foundation before attempting OSCP

Who It Is For

Security professionals who want to prove real-world hacking skills — not just theoretical knowledge; penetration testers seeking the industry's most respected offensive certification; red team operators and offensive security engineers; CTF players and bug bounty hunters wanting a formal credential; security consultants who need demonstrable technical credibility; anyone serious about a career in offensive cybersecurity — the OSCP is the certification that opens the most doors in pentesting.

Oscp — offensive security certified professional (pen-200) by offsec

What users say

Rate this Education

Related Tools

Related Moonlites

Related Creators

About