Last year (2025), I successfully passed the OSEP exam and obtained the certification. In this post, I discuss my experience with the exam and also the related course (PEN-300). I will also discuss how I passed on my first try, and additional preparation you could do before taking the course.
Note: This post’s structure is similar to my OSCP and OSWE post. Why change a working template? 🙂
What Is PEN-300 and OSEP?
The best place to answer those questions is OffSec’s website; that being said, here is the gist of it.
What is PEN-300?
- The course and labs that will prepare you for the OSEP exam.
- It contains the necessary theory (knowledge).
- About every chapter in the course has a set of exercises to complete.
- Most chapters have extra mile exercises.
- At the end of the course, you have different challenges that you can complete to prepare for the exam.
- Unlike OSCP, you do not get bonus points for the exam by completing exercises and machines.
What is the OSEP Exam?
- A 48-hour exam (The timer does not stop. You are expected to eat, sleep, take breaks, etc.).
- You are given access to a (relatively) large network environment with multiple machines and an Active Directory.
- The environment has defenses in place (e.g., antivirus, application whitelisting, etc.) that you need to bypass.
- To pass the exam, you need to either compromise enough machines to gather a passing score (100 points) or access a special file called secret.txt.
- You then have another 24 hours to write and submit a professional report. If you fail to do so, you will fail the exam (even if you have a passing score or were able to extract the secret.txt file). It is very important to read the exam guide.
I go deeper into both the course and the exam in the following sections.
Why OSEP?
As I mentioned in my OSCP post, you should always ask yourself the following questions before working on any certification:
- Why do you want to do it?
- What will it bring you?
This is highly personal, but here is a short (incomplete) list of why one should do the PEN-300 course and the OSEP exam:
- Take the knowledge you obtained from OSCP to the next level
- Learn how to navigate a secured environment and bypass defenses
- Certify yourself as an expert in internal penetration tests
- Pass the HR gating when looking for a job
- Obtain the OSEE certification, since you need to achieve OSWE, OSED, and OSEP to get it
- And more …
As you may already know, this course and certification are meant for pentesters or red teamers. If this is not what you want to do, there is probably a better certification for your career goal (see https://pauljerimy.com/security-certification-roadmap/ for some guidance).
Prerequisites
Since it is an expert-level certification, some prerequisites are expected. Here is what I consider must-have before jumping into the course:
- Have some coding/scripting experience. Even better if it is in C, C#, or PowerShell.
- You do not need the same level of coding proficiency as for OSWE. However, you will have to develop your own custom malware and exploits to bypass common defenses (e.g., an antivirus). In PEN-300, they do not teach you how to code. Having a basic understanding of C, C#, and PowerShell will give you a smoother course experience.
- Be comfortable with at least one Command and Control (C2) framework.
- Personally, I used Metasploit. It is easy to use, and the exam is designed so that it can be passed using that C2. That being said, you can use any command and control of your choice. Just make sure to read the exam FAQ to confirm that you can use it.
- Have experience in hacking Active Directory.
- The course will cover some advanced Active Directory attacks. However, you are expected to know basic attacks (e.g., Kerberoasting) and how to scan and analyse Active Directory (e.g., SharpHound).
- Have experience in getting initial access using a reverse shell payload.
- Linux, Windows and network fundamentals, including how to escalate your privileges.
In other words, if you have passed the OSCP, you already have the must-have prerequisites for this course. Technically, having the OSCP is not mandatory to take the course. That being said, there are advantages to getting into PEN-300 with OSCP under your belt:
- You are sure to have the necessary knowledge to take on PEN-300. Meaning you should not have to fill knowledge gaps during the course.
- The PEN-300 course builds up on PEN-200, the OSCP course. This means you are expected to have at least an OSCP-level proficiency. For example, the PEN-300 course does not show privilege escalation techniques (or almost none), but you are required to do privilege escalations in the labs and the exam.
- Having completed a 24-hour exam from OffSec, you would have a better understanding of what to expect for a 48-hour exam.
Here are things that I consider nice-to-have before jumping into the course. Having these would give you a head start:
- Have some experience in bypassing security controls (e.g., antivirus, AMSI, application whitelisting, etc.)
- You will have to do just that to pass the exam.
- Have completed real-world penetration test engagements, specifically internal exercises on a large network
- This will help you manage your time and how you approach the exam to reach your goal.
- Have completed some Pro Labs on Hack The Box
- Pro Labs are environments with multiple machines to compromise. This is probably one of the closest things to the exam that you can find in terms of environment complexity.
The Course
The course contains multiple modules covering topics to help compromise a hardened environment. From initial access through phishing, bypassing defenses such as antivirus or application whitelisting and post exploitation techniques.
For each module, you have exercises and most often extra miles exercises. To maximize your chances of success in the exam, you have to complete both. The extra miles exercises push things further where no help is provided by the course. These exercises are the most important, and you should take the time to complete them by yourself. You will obtain better value out of them by doing so. On my side, I completed all the course material and related exercises first, then went through it again to complete the extra-mile exercises. It worked great for me; maybe ask yourself if this would be a good strategy for you.
Most of the content shown in the PEN-300 course is needed to pass the exam. However, for the course version that I did, some material was not useful for the exam. Not that it was irrelevant in general, just that it would be technically impossible to apply it in an exam format. For example, doing a kiosk-mode escape on an Android tablet.
Like any course, taking good notes is important. One thing I did that was really useful for the exam is that I not only took detailed notes, but also created cheat sheets as I progressed. Specifically, I created mind maps in Obsidian (any other mind map tools like Xmind can work) for different steps in an engagement. If more details were needed, I referenced my detailed notes to not clutter the mind map.
The last important thing is that you should create code templates. As you go through the course, you will create different scripts and programs for different purposes. Transforming these scripts or programs into templates that can be reused during the exam will save you lots of time. Here is an overview of my templates’ structure:
As you can see, I have separated my templates by “themes”. They are then separated by programming languages or sub-categories, if applicable. Each template has a self-describing name and an explanation at the top on how to use it (or a README). I made sure that I created clean code that is easy to read and understand. During the exam, you want to quickly figure out how a particular template can be used and in what context. Note that my templates are not necessarily valid code since they could contain placeholders.
At the end of the course, you are presented with the lab. Unlike OSCP, you only have a few challenges to practice on. Some challenges have a “theme” (e.g., MSSQL); others are very similar to what you would get at the exam. You should consider those few challenges more as exam preparation rather than “only” a lab. Because of that, you should try to avoid using Discord to help you with those machines. Note that you should tackle those challenges only after completing the course, the exercises, and the extra miles. This is the best way to prepare for the exam, in my opinion.
If you get stuck on an exercise, an extra mile, a challenge, or any other problem, do not hesitate to ask questions (with no spoilers) on OffSec’s Discord. Students and mentors will be happy to assist you.
The Exam
The exam experience is similar to the OSCP exam; in the exam panel, you will have a list of machines to compromise and the objectives to complete. Generally speaking, you will need to (make sure to confirm this by reading the objectives):
- Gain remote shell access to the machines
- Potentially escalate your privileges
- Provide the necessary proof of exploitation in the report and the exam panel
- Compromise enough machines to get 100 points or acquire the final flag (usually called secret.txt)
Since you may need to develop custom payloads, you will also have access to a machine to develop and test your payloads.
Take good notes and screenshots as you progress through the exam. If you don’t, you will likely lose a lot of time when it comes time to gather all your documentation for the report. The exam environment is relatively large, and it can be easy to get lost, forget your thought process, etc.
This is a 48-hour exam. As such, it is more of a marathon compared to OSCP. You can’t survive if you do not sleep. I would argue that if you could not achieve the necessary objectives to pass the exam in less than 20 hours of active exam time, you were not ready. As always, you are expected to eat, sleep, take breaks, etc. Like for my OSCP certification, I gave myself a schedule. This forced me to take breaks when I should. I highly recommend you make one before the exam. This is highly personal, and one’s schedule may not work for someone else, but here is the schedule I used for reference.
- Day 1 – (10 to 12 hours of active exam time):
- 1 pm to 6 pm approx. Could be 5 pm
- Diner
- 7 pm (or 6 pm) to midnight approx. (extend to 2 am max)
- Sleep
- Day 2 – (14 to 16 hours of active exam time):
- 8 am to 12 pm approx. (can start earlier if possible, depending on when you stopped)
- Lunch
- 1 pm to 6 pm approx. Could be 5 pm
- Diner
- 7 pm (or 6 pm) to midnight approx. (extend to 2 am max)
- Sleep
- Day 3 – Wrap up (5 hours – 8 hours of active exam time):
- 8 am to 1 pm
- Take breaks every 2-3 hours (except maybe the first pm)
- Do not spend more than 2 hours on a given access level without making progress. Take a break, switch targets, etc. Change your mindset
- Take regular snapshots of the Kali VM in case of any issues
I got the objective file (secret.txt) on the evening of the first day. I used the rest of the time to compromise more machines to gather extra points and to go over my notes and material to ensure:
- I fulfill the objectives
- I have all the commands to replicate my actions
- I have all the necessary screenshots
- Etc.
In fact, my report was pretty much done by the end of the first 48 hours.
There are multiple little things that you don’t want to forget during the exam. This is why I created my own checklists. This is not necessary, but I highly recommend it.
- Before the Exam Checklist
- Day of the Exam Checklist
- During the Exam Checklist
- Analysis Checklist
- Before Finishing the Exam Checklist
- Report Checklist
With that done, it is time to move on to the report.
The Report
Just like OSCP, if you do not provide a report within 24 hours following the end of the exam, you will not get the certification. As with most, if not all, certifications from OffSec, they provide a report template. I advise that you use it or at least use a similar approach. The report has specific requirements that you must provide (again, the exam guide is your best friend here).
That being said, here is how I structured my report:
- High-Level Summary
- Overview of Compromised Systems Per Domains
- Simple tables with the following columns: IP, Hostname, Compromised (Yes, No), Low-Privilege User (Yes, No, n/a), High-Privilege User (Yes, No)
- Overview of Attack Paths
- High-level description of the attack paths. Bullet-point list of steps.
- Overview of Compromised Systems Per Domains
- Detailed Flow of Attack
- General Scans Applicable for All Paths
- PATH 1 – Through <MACHINE-NAME> / <IP>
- <MACHINE-NAME> / <IP>
- Local.txt / Proof.txt / Secret.txt
- Pre-Compromise Enumeration Steps
- Compromise
- Local Privilege Escalation
- Post-Exploitation Enumeration Steps
- Screenshots
- …
- <MACHINE-NAME> / <IP>
- …
- Appendix A – Public Tools Used
The screenshots section is where I put the screen captures of the relevant flags (local, proof, etc.). You may want to add other appendices with any relevant information, like configuration files to set up your Kali machine for the target environment.
Just like OSCP, the person who reviews your report must be able to replicate what you have done to compromise the environment by just reading the report. Since I pretty much completed the exam on the first day and I took detailed notes and screenshots as I progressed, writing the report was quick and straightforward for me.
Additional Preparation
In terms of additional preparation for OSEP, I think your best bet is to complete OSEP-like machines or environments. For the former, you could look into 0xdf’s list of OSEP-like machines. For the latter, your best option is probably Hack The Box’s Pro Labs.
Last Thoughts
The course PEN-300 and the OSEP exam mix well together because they provide different values both for you and your employer or clients. Completing the PEN-300 course (and its challenges) will give you practical knowledge. Passing the OSEP exam will prove that you can work in a stressful environment, that you are efficient, etc.
While the PEN-300 course teaches you how to bypass lots of different security controls, a big one is missing: EDRs. Endpoint Detection and Response solutions (e.g., Microsoft Defender for Endpoint) are now present more than ever. This is especially true for businesses of a certain size, which are usually the ones with enough money to afford an internal penetration test in the first place. While bypassing this security control is not covered in the course, this will probably be the most important and difficult one to bypass in a real-world engagement. Some of the knowledge that you acquire in the course lays the foundations for EDR bypass, but it won’t be enough.
As mentioned previously, taking on this certification without prior experience is going to be rough. Everything that is shown in PEN-200 (OSCP) is expected to be known and mastered. Speaking of which, a common question that gets asked is, “How difficult is it compared to OSCP”? It is an expert-level certification; OSCP is an intermediate one. That alone should give you a hint. For me, it was pretty much smooth sailing from start to finish. In the end, it took me less than 11 months to complete the course and pass the exam (with a full-time job and a family). Note that I probably could have done it faster, but I prefered to not rush it.
Personally, there is one thing that really affected my experience. OffSec was updating modules while I was doing the course. In other words, instead of locking my course from the moment I bought it, they were adding and deprecating material as I was studying. One time, I was almost done with the course, and they added a bunch of modules and deprecated some that I had already completed. This is not how you handle this type of change. New enrollees should get the new material and new set of exams, while the others stay at the previous version. I had to rush the new material just to be ready for the exam. This is really bad when you have to balance this with a full-time job and a family. Hopefully they will think of a better way to push changes to their courses…
Since this is a very long course with a 48-hour exam (72 if you count the report) to obtain the certification, it can be difficult for someone with a family. If you want my take on how to keep a balance between work, life, family, and studying for a certification, please take a look at my OSCP post here.
Thank you for reading this far, and I hope this was useful!
