OffSec OSCP Certification
Last updated: March 31, 2026
Exam Syllabus & Domains
The OffSec OSCP certification exam covers the following domains. Focus your training time proportionally to each domain's weight.
Penetration Testing Fundamentals
- 1.1 Understand penetration testing methodology and rules of engagement
- 1.2 Set up and configure Kali Linux attack environment
- 1.3 Apply effective note-taking and documentation practices
- 1.4 Understand legal and ethical considerations in penetration testing
Information Gathering & Enumeration
- 2.1 Perform passive and active information gathering techniques
- 2.2 Enumerate services including DNS, SMB, SNMP, and HTTP
- 2.3 Conduct vulnerability scanning and analysis
- 2.4 Identify and prioritize attack vectors from enumeration data
Web Application Attacks
- 3.1 Identify and exploit common web vulnerabilities
- 3.2 Perform SQL injection attacks including blind and UNION-based
- 3.3 Exploit file inclusion vulnerabilities (LFI/RFI)
- 3.4 Attack web applications through XSS, command injection, and file upload
System Exploitation & Privilege Escalation
- 4.1 Exploit Windows and Linux systems using public and custom exploits
- 4.2 Perform Windows privilege escalation techniques
- 4.3 Perform Linux privilege escalation techniques
- 4.4 Transfer files and establish reverse/bind shells
Active Directory Attacks
- 5.1 Enumerate Active Directory environments and trust relationships
- 5.2 Perform AD attacks including Kerberoasting and AS-REP roasting
- 5.3 Execute lateral movement techniques across the domain
- 5.4 Achieve domain dominance through credential-based attacks
Post-Exploitation & Reporting
- 6.1 Perform post-exploitation data gathering and exfiltration
- 6.2 Establish persistence and maintain access
- 6.3 Pivot through compromised hosts to reach internal networks
- 6.4 Write professional penetration testing reports
Where to Focus Your Study Time
Domains with higher weight have more exam questions — allocate your study hours accordingly.
Study Tips
- Create a 16-week study schedule and assign specific domains to each week
- Focus more time on higher-weighted domains — they have more exam questions
- Use practice quizzes to identify weak areas early, then revisit those domains
- Study in focused 25-minute blocks (Pomodoro technique) with 5-minute breaks
- Create flashcards for key terms, acronyms, and port numbers
- Review domain objectives weekly to track your progress and adjust your plan
Free Study Resources
Practice Quiz
Test your knowledge before the exam with our free practice quiz.
Take the OffSec OSCP Practice QuizRelated Comparisons
Not sure if OffSec OSCP is the right choice? Compare it with similar certifications:
Get the OffSec OSCP Study Planner
Fillable PDF with 16-week schedule, domain trackers, flashcard templates, progress tracking, and quick reference sheets. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.
Get the Study Planner — $5.99Also available as a 4-Format Bundle for $15.99
CyberFolio
Earned your certs? Show employers.
Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.
Build Your Portfolio →Free Training Resources
Use these free tools to support your OffSec OSCP certification training:
- Cybersecurity Practice Tests — 3,150+ free questions across 66 certifications
- Study Roadmap — Structured learning path for OffSec OSCP
- Study Progress Tracker — Track hours and domain coverage
- CVSS Calculator — Practice scoring vulnerabilities
Frequently Asked Questions
What is the OffSec OSCP certification?
The OffSec OSCP (PEN-200) is a professional IT certification that validates your knowledge and skills in the exam domains covered. It is recognized globally by employers and is a valuable credential for career advancement in cybersecurity and IT.
What does the OffSec OSCP certification syllabus cover?
The OffSec OSCP exam syllabus covers Practical. Each domain is weighted differently, so focus your training on higher-weighted domains first. Review the complete domain breakdown above for objectives and key concepts.
How should I study for OffSec OSCP?
Create a structured study plan covering all exam domains, use practice tests to identify weak areas, and review key concepts regularly. A fillable study planner can help you organize your training with weekly schedules and progress tracking.
How long does it take to prepare for OffSec OSCP?
Preparation time varies by experience level. Most candidates spend 8-12 weeks of dedicated training. Using a structured study planner with domain-by-domain breakdown helps ensure you cover all certification objectives efficiently.