The OSCP+ exam gives you 23 hours 45 minutes on a private VPN with three standalone machines (60 points) and one Active Directory set of three machines (40 points). You need 70 points, then have another 24 hours to submit a replicable report. Prepare by finishing the PEN-200 labs and challenge labs, practicing the proof and documentation format until it is automatic, and learning the tool restrictions cold, because restricted tools zero out a target regardless of your technical work.
Exam structure, timing and scoring
The exam runs 23 hours 45 minutes on a private VPN with six machines worth 100 points, followed by a separate 24-hour documentation window. You need 70 points to pass.
The OSCP+ exam simulates a live network in a private VPN containing a small number of vulnerable machines. You have 23 hours and 45 minutes for the practical portion, and then another 24 hours to upload your documentation. All exams are proctored by OffSec.
The machine structure is fixed. Three standalone machines are worth 20 points each, split evenly between initial access and privilege escalation. One Active Directory set spans three connected machines worth 40 points total, and OffSec gives you a username and password to simulate a breach scenario.
You must reach at least 70 of 100 points. The exam guide lists several combinations that reach 70, such as the full 40-point AD set plus three local flags, or just 10 AD points plus all three standalone machines fully completed. Partial control earns partial points on standalone targets, and machines are graded in the order you document them, so report order matters.
One change from older summaries: bonus points no longer exist. Your final score is determined solely by performance on the exam itself.
| Component | Machines | Points |
|---|---|---|
| Standalone machines | 3 targets, 20 points each | 60 total; 10 for initial access and 10 for privilege escalation per machine |
| Active Directory set | 3 connected machines in a breach scenario | 40 total; 10, 10 and 20 points |
| Passing threshold | Any combination in the exam guide | Minimum 70 of 100 points |
Official sources used: OSCP+ Exam Guide – OffSec Support Portal — Updated April 20, 2026; OSCP+ Exam FAQ – OffSec Support Portal — Updated July 31, 2026
Proof files and documentation rules
Every point depends on retrieving proof files the prescribed way and documenting attacks so a competent reader can replicate them; failures here zero out targets regardless of your technical work.
Each scored target contains proof files: local.txt, readable by an unprivileged user, and proof.txt, accessible only to root on Linux or Administrator on Windows, typically under /root/ or the Administrator desktop. You must submit the file contents in the exam control panel before the exam ends. The panel does not confirm whether a submission is correct, so track your own submissions.
The exam guide is strict about how proof is captured. Valid proof is the file's contents shown with the type or cat command, in an interactive shell, from the file's original location. Reading the files through any kind of web-based shell earns zero points for that target. Your screenshot must show the file contents plus the target IP address from ipconfig, ifconfig or ip addr.
Privilege levels also gate full points. On Windows targets you need a shell as SYSTEM, Administrator, or a user with Administrator privileges. On Linux targets you need a root shell for full credit.
The report itself must describe every attack step, command and console output thoroughly enough that a technically competent reader could replicate your work. Insufficient documentation reduces or zeroes points, and once you submit, the report is final. If a screenshot is missing, OffSec will not request it and you cannot send it later.
Official sources used: OSCP+ Exam Guide – OffSec Support Portal — Updated April 20, 2026
Tool restrictions that void points
Spoofing, commercial tools, automated exploitation, mass vulnerability scanners and AI chatbots are banned, and Metasploit or Meterpreter may touch only one target of your choice. Using a restricted tool forfeits the points for that target.
The restrictions list is explicit. You cannot use spoofing of any kind (IP, ARP, DNS, NBNS and similar), commercial tools or services, automatic exploitation tools such as SQLmap or browser_autopwn, or mass vulnerability scanners such as Nessus, OpenVAS or Nexpose. AI chatbots and LLMs, including OffSec KAI and ChatGPT, are strictly prohibited during both the exam and the reporting phase.
This is where course content and exam rules diverge: PEN-200 teaches vulnerability scanning with Nessus, but Nessus is forbidden on the exam. Always check the current exam guide rather than assuming that a tool in the course material is permitted.
The Metasploit rule needs care. You may use Metasploit modules or the Meterpreter payload against exactly one target machine of your choice, and the choice locks in on first use, even if the attack fails. You cannot probe several machines with it first, and Metasploit cannot be used for pivoting because that would span multiple targets. The guide permits msfvenom and multi/handler, but these allowances do not remove the one-target restriction on Meterpreter. Read the current rule before selecting payloads or handlers.
The exam FAQ names allowed tools including BloodHound (Legacy and Community Edition), SharpHound, Impacket, evil-winrm, Rubeus, Mimikatz and Crackmapexec. Responder is listed, but poisoning and spoofing with it are not allowed. Permitted general tools include Nmap with its scripting engine, Nikto and Burp Suite Free.
The exam is open book for your own notes, the OffSec learning platform and online resources, with two conditions: all activity happens on the host running the proctoring software, and you may not discuss the exam or ask for hints anywhere online, including Discord.
Official sources used: OSCP+ Exam Guide – OffSec Support Portal — Updated April 20, 2026; OSCP+ Exam FAQ – OffSec Support Portal — Updated July 31, 2026; OSCP+ Body of knowledge – OffSec Support Portal — Updated April 23, 2026
What PEN-200 teaches and what to prioritize
The course and exam body of knowledge span enumeration, vulnerability scanning, web and client-side attacks, privilege escalation, tunneling, Metasploit and Active Directory. The Assembling the Pieces module and the challenge labs are the closest preparation for the exam format.
OffSec's published body of knowledge for the OSCP+ groups the tested learning objectives into module areas. Treat this as your coverage checklist, and link each area to lab time rather than reading alone.
For the Active Directory set specifically, OffSec's own FAQ recommends working through the three AD modules (introduction and enumeration, authentication attacks, lateral movement), then the Assembling the Pieces module, and attacking every AD set inside the PEN-200 challenge labs. The FAQ also notes that pivoting may be required in the AD set and that anything in the course material is subject to appearing on the exam.
- Reporting: note-taking, technical reports, executive summaries and documenting findings
- Information gathering: passive and active reconnaissance, Netcat and Nmap scanning, DNS, SMB, SMTP and SNMP enumeration
- Vulnerability scanning: theory, Nessus and the Nmap Scripting Engine are in the course; the exam bans mass vulnerability scanners such as Nessus but explicitly permits Nmap and its scripting engine.
- Web applications: enumeration, XSS, directory traversal, file inclusion and upload flaws, command injection and SQL injection, including manual and automated exploitation
- Client-side attacks: reconnaissance, Microsoft Office macros and Windows library files
- Public exploits and fixing exploits: locating exploit code safely, adapting memory-corruption and web exploits
- Antivirus evasion and password attacks: evasion concepts and practice, attacks on SSH, RDP and HTTP logins, hash cracking and relay techniques
- Privilege escalation: Windows services, scheduled tasks and components; Linux file permissions, cron jobs, SUID binaries, capabilities and sudo
- Tunneling: port redirection, local, dynamic and remote SSH forwarding, HTTP and DNS tunneling
- Metasploit Framework: modules, payloads, post-exploitation, pivoting and automation
- Active Directory: manual and automated enumeration, authentication attacks, lateral movement and persistence
- Integration: Assembling the Pieces, a full engagement-style module combining the above
Official sources used: OSCP+ Body of knowledge – OffSec Support Portal — Updated April 23, 2026; OSCP+ Exam FAQ – OffSec Support Portal — Updated July 31, 2026; Get your OSCP+ certification with PEN-200 | OffSec — PEN-200 course page
Practice reading the scoring table
Worked example: a documented outcome of two fully completed standalones, initial access only on the third, and two machines of the AD set totals exactly 70 points and passes at the minimum.
During the exam you will constantly recompute your position: is this next hour better spent chasing privilege escalation on a half-solved machine or pushing into the AD set? That judgment starts with reading the point table fluently. The exercise below uses only the verified structure from the exam guide.
Practice exercise
Assume the OSCP+ scoring structure exactly as published: each standalone machine is worth 20 points, split as 10 for initial access (local.txt) and 10 for privilege escalation (proof.txt); the Active Directory set is worth 40 points, split as 10 for machine #1, 10 for machine #2 and 20 for machine #3; the passing minimum is 70 points. Suppose you fully complete standalone machines A and B, obtain only initial access on standalone machine C, and capture the points for AD machines #1 and #2, with all proof correctly documented. What is your total, and does it pass?
Show answer
The total is exactly 70 points, which meets the passing minimum.
Standalones A and B: 20 + 20 = 40 points (both initial access and privilege escalation on each). Standalone C: 10 points for initial access only, with no privilege escalation points. AD machines #1 and #2: 10 + 10 = 20 points. Total: 40 + 10 + 20 = 70. This matches one of the passing combinations the exam guide lists: 20 points from the AD set, three local flags and two proof flags. With a 70-point floor, this outcome passes with no margin, which is why candidates track both partial and complete objectives as the exam progresses.
Official sources used: OSCP+ Exam Guide – OffSec Support Portal — Updated April 20, 2026
Scheduling, submission and results
Schedule from the Learning Library, connect with Kali Linux over OpenVPN, and submit a PDF report inside a password-free .7z archive of at most 200 MB within 24 hours. Results arrive within ten business days.
You schedule the exam directly from the Learning Library control panel. Your connection pack arrives by email at the exact start time, not earlier. OffSec supports connections made with Kali Linux and OpenVPN only, and the guide warns it cannot help with any other setup.
During the exam you can submit proof files, revert machines and view per-target objectives in the control panel. You get a limit of 24 reverts, which can be reset once during the exam. Machines start freshly reverted, and reverting a machine erases any changes you made to it.
Submission has a strict format. Your report must be a PDF named OSCP-OS-XXXXX-Exam-Report.pdf using your OSID, archived without a password into a .7z file of at most 200 MB, and uploaded to OffSec's upload site within 24 hours of finishing the exam. Verify the MD5 hash the site shows against your local file, and click the final Submit File button; a confirmation email follows on success.
Results come by email as pass or fail within ten business days of submitting your documentation. Detailed feedback is provided only to candidates who submitted a report and fell short of the passing score. Retakes carry a cooling-off period between attempts, and OffSec provides a policy for disability accommodations under the ADA.
Official sources used: OSCP+ Exam Guide – OffSec Support Portal — Updated April 20, 2026; OSCP+ Exam FAQ – OffSec Support Portal — Updated July 31, 2026; OSCP+ Candidate Handbook – OffSec Support Portal — Updated July 31, 2026
Building your preparation plan
OffSec's own minimum readiness suggestion is completing the course labs and exploiting the challenge labs. Add the exam-format habits: live evidence capture, replicable notes and fluency with the restrictions.
OffSec's FAQ answers the readiness question directly: at minimum, complete the course labs and exploit the challenge labs, and it notes this estimate carries no guarantee. Three of the challenge labs are designed to replicate the exam environment, so reserve them for full timed runs after you have worked through the module labs.
The recommended background is a solid understanding of TCP/IP networking, reasonable Windows and Linux administration experience, and familiarity with basic Bash or Python scripting. There are no formal prerequisites, but the hands-on pace makes those foundations the difference between practicing techniques and fighting your own tooling.
As general study advice, not an official requirement: build your evidence habits during the labs rather than inventing them on exam day. Capture a screenshot the moment each objective completes, showing the command, its output, the hostname and the target IP, and keep your notes detailed enough to reconstruct every solved machine from the notes alone. That habit maps directly onto the exam's replication standard for reports.
Plan your administrative timeline realistically: the 23-hour-45-minute exam is an endurance event, the 24-hour documentation window overlaps real recovery time, and results take up to ten business days. Read the full exam guide and candidate handbook before scheduling, since issuer details can change.
Official sources used: OSCP+ Exam FAQ – OffSec Support Portal — Updated July 31, 2026; Get your OSCP+ certification with PEN-200 | OffSec — PEN-200 course page; OSCP+ Exam Guide – OffSec Support Portal — Updated April 20, 2026; OSCP+ Candidate Handbook – OffSec Support Portal — Updated July 31, 2026
Official sources used
Facts checked against OffSec's official documents: