Offensive Security Certified Professional

Study plan

OffSec logo

How to Pass the Offensive Security Certified Professional Exam

OSCP

A study plan for the Offensive Security Certified Professional certification exam, built from the official domain weights instead of a generic template. Prioritize the OffSec labs; do not rely on theory alone. Focus heavily on Active Directory exploitation and manual exploitation techniques rather than relying on automated tools.

6 domains
20 questions
1425 min
70% to pass

Study in weight order, not topic order

The plan below follows the official blueprint weights, so the order of study is the order that returns the most points.

  1. 1

    Exploitation

    30%
    • Buffer Overflows
    • Exploit Development
    • Payload Delivery
    • Web Application Attacks
    • +1 more topics in the blueprint

    2 practice questions tagged to this domain.

  2. 2

    Post-Exploitation

    20%
    • Data Exfiltration
    • Maintaining Access
    • Artifact Collection
    • System Profiling

    1 practice questions tagged to this domain.

  3. 3

    Active Directory

    15%
    • AD Enumeration
    • Lateral Movement
    • Kerberoasting
    • Pass-the-Hash
    • +1 more topics in the blueprint

    1 practice questions tagged to this domain.

  4. 4

    Privilege Escalation

    15%
    • Windows Privilege Escalation
    • Linux Privilege Escalation
    • Kernel Exploits
    • Configuration Weaknesses

    1 practice questions tagged to this domain.

  5. 5

    Information Gathering

    10%
    • Footprinting
    • Enumeration
    • Nmap Scanning
    • Service Identification
  6. 6

    Vulnerability Scanning

    10%
    • Automated Vulnerability Assessment
    • Manual Vulnerability Identification
    • Analyzing Scan Results

Three phases, in order

Most failures are process failures, not knowledge failures.

Step 1

Phase 1 — Learn the high-weight domains

Start where the points are. The first domains on this plan carry the most weight, so a gap there costs the most. Cover the objectives, then close each topic with practice questions you actually get wrong.

Step 2

Phase 2 — Close the mid-weight domains

The middle of the blueprint is where most candidates plateau. These domains are worth less per topic than the first phase, but they add up fast, and they are the usual difference between a near miss and a clear pass.

Step 3

Phase 3 — Timed full mocks

Stop reading new material at this point. Run full-length exams under the real time limit and the real format, and use the per-domain breakdown to find which domain is still costing you the pass.

Where we put the emphasis

Practical application of offensive techniques and the ability to chain multiple vulnerabilities to achieve domain-level compromise.

The order matters less than the loop. Every domain you finish should end with questions you got wrong, because the mistake is the only thing you actually needed to study. On the Offensive Security Certified Professional that loop is worth 30% of the exam in the first block alone.

More about the Offensive Security Certified Professional exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Related certifications

Explore other certifications in the same category and see how they stack up.

Frequently asked questions

Everything you need to know about the Offensive Security Certified Professional exam.