OSCP+ Certification: Training, Exam Cost, Requirements and Preparation Guide
The OSCP+ certification is the OffSec Certified Professional Plus certification. It validates practical penetration-testing skills through a remotely proctored exam. Candidates receive 23 hours and 45 minutes to compromise standalone and Active Directory systems, followed by 24 hours to submit a technical report. A score of 70 out of 100 is required. Candidates who pass receive the lifetime OSCP credential and the three-year OSCP+ designation.
What Is OSCP+?
OSCP+ is a hands-on cybersecurity certification offered by OffSec, previously known as Offensive Security. It is designed for candidates who want to prove that they can perform a structured penetration test rather than simply answer multiple-choice questions.
The certification assesses your ability to:
Identify security vulnerabilities
Exploit vulnerable services
Gain access to Linux and Windows systems
Escalate privileges
Attack Active Directory environments
Use tunnelling and lateral movement
Collect acceptable evidence
Prepare a professional penetration-test report
OffSec introduced the updated OSCP+ exam on November 1, 2024. Candidates who pass receive two credentials:
OSCP: Remains valid indefinitely
OSCP+: Remains valid for three years and must be maintained
You may see this credential described as the Offensive Security OSCP+ certification, OSCP certification OffSec, OSCP offensive security certification, or Offensive Security Certified Professional certification. These terms generally refer to the same OffSec certification path.
OSCP+ Certification Exam Format
The OSCP certification exam is completed remotely inside a private VPN. Candidates connect to the exam network using Kali Linux and work on several vulnerable machines.
Standalone Machines
The examination contains three standalone machines. Each machine is worth 20 points:
10 points for initial access
10 points for privilege escalation
Compromising all three standalone systems provides a maximum of 60 points.
Active Directory Set
The Active Directory section contains three connected machines worth 40 points in total:
First machine: 10 points
Second machine: 10 points
Final machine: 20 points
Candidates receive a username and password that simulate an existing network breach. They must examine the domain, identify attack paths and move through the connected systems.
Because the passing score is 70, candidates need points from both sections. Completing the full Active Directory set gives 40 points, but additional points must be earned from the standalone machines.
Skills Covered in OSCP+ Certification
The OSCP+ certification focuses on practical penetration testing. Candidates must understand why an attack works, how to modify an exploit and what to check when a technique fails.
The official body of knowledge covers five main areas:
Reporting receives the highest published weight. This means that compromising a machine is not enough. Candidates must record their commands, results, proof files and screenshots correctly.
Important learning areas include:
Information gathering and enumeration
Vulnerability identification
Common web application attacks
SQL injection
Password attacks
Public exploit research
Exploit modification
Client-side attacks
Antivirus evasion concepts
Windows privilege escalation
Linux privilege escalation
Port forwarding and tunnelling
Active Directory enumeration
Kerberos and authentication attacks
Lateral movement
Metasploit fundamentals
AWS cloud infrastructure enumeration and attacks
Penetration-test report writing
A reliable OSCP training course should balance these topics with regular lab practice.
OSCP Certification Requirements
OffSec does not require a degree, previous certification or specific amount of work experience to attempt OSCP+.
PEN-200 is the official OSCP certification course, but completing it is not a mandatory eligibility requirement. Candidates with sufficient practical experience can purchase the standalone OSCP+ exam.
However, OffSec recommends that candidates have:
A solid understanding of TCP/IP networking
Practical Windows administration experience
Practical Linux administration experience
Familiarity with Bash or Python scripting
Candidates should also know how to enumerate network services, troubleshoot payloads, research vulnerabilities and keep organised technical notes.
OSCP+ may be difficult for complete beginners. Candidates without these foundations should first study networking, Linux, Windows and basic scripting before beginning intensive OSCP certification training.
OSCP Certification Cost
The OSCP certification cost depends on whether you need only the exam or want official training and lab access.
These are OffSec’s published prices as of September 2026. Taxes may apply, and prices can change. Candidates should confirm the latest amount before purchasing.
The OSCP training cost is different from the OSCP certification exam cost. The standalone option suits experienced professionals who do not need the official course. The Course + Certification Bundle and Learn One provide access to PEN-200 training and practical labs.
Some users search for “OCSP certificate cost.” OCSP normally means Online Certificate Status Protocol. The correct certification acronym is OSCP.
How to Prepare for the OSCP+ Exam
Strengthen Your Technical Foundations
Before entering advanced labs, make sure you can use Linux confidently, understand network services and read basic scripts. Weak foundations can turn simple troubleshooting problems into hours of wasted time.
Focus on:
TCP/IP networking
Linux commands and permissions
Windows services and permissions
Bash and Python basics
Web application fundamentals
Active Directory basics
Create an Enumeration Checklist
Successful OSCP preparation depends heavily on enumeration. Avoid trying random exploits immediately after scanning a machine.
Create separate checklists for:
HTTP and HTTPS
SMB
FTP
SSH
Databases
Linux systems
Windows systems
Active Directory
Record open ports, service versions, usernames, credentials, software, web directories and possible privilege-escalation paths.
Practise Manual Exploitation
The OSCP+ exam limits tools that automate vulnerability scanning and exploitation. AI chatbots are also prohibited during the examination and reporting period.
Metasploit and Meterpreter may only be used against one selected target machine. Once you use them against that target, you cannot move their use to another machine.
Candidates should be comfortable using permitted tools such as:
Nmap
Nikto
Burp Suite Community
DirBuster
BloodHound
PowerView
Evil-WinRM
Impacket
Mimikatz
Netcat
The goal is not to memorise commands. You need to understand the output and know what to investigate next.
Spend Enough Time on Active Directory
Active Directory represents 40 exam points and 26% of the body of knowledge. It should have a dedicated place in your OSCP preparation course.
Practise:
Domain enumeration
User and group discovery
Kerberos-based attacks
Credential reuse
Password attacks
Service account weaknesses
Lateral movement
Privilege escalation
Domain controller access
Work through complete Active Directory attack paths instead of practising individual commands without context.
Prepare the Report During Practice
Candidates must submit a professional report explaining how each machine was compromised. The steps must be detailed enough for a technically competent person to reproduce the attack.
For each practice machine, document:
Initial scan results
Vulnerability identification
Exploitation commands
Initial access
Privilege-escalation process
Proof file
Target IP address
Recommended remediation
Missing proof files, incorrect screenshots or incomplete steps can lead to reduced or zero points for a target.
Complete a Timed Mock Exam
Before scheduling the OSCP+ exam, complete at least one full timed simulation. Use the same note-taking structure and report template that you plan to use during the real exam.
Your mock examination should test:
Technical ability
Time management
Break planning
Screenshot organisation
Credential tracking
Report preparation
Decision-making when an attack path fails
OSCP vs CEH: Which Should You Choose?
The CEH vs OSCP comparison depends on your career goal. CEH focuses on broad ethical-hacking knowledge, while OSCP+ focuses more deeply on practical penetration testing.
The standard CEH exam contains 125 multiple-choice questions. CEH Practical is a separate six-hour assessment with 20 practical challenges.
Choose CEH if you need broad coverage of threats, tools and ethical-hacking methods. Choose OSCP+ if you want to demonstrate practical exploitation, privilege escalation, Active Directory and reporting skills.
Is OSCP+ Worth It?
OSCP+ is suitable for professionals pursuing roles such as:
Penetration Tester
Ethical Hacker
Red Team Operator
Vulnerability Analyst
Security Consultant
Application Security Tester
Cybersecurity Engineer
The certification can show employers that you can work through a realistic penetration-testing environment under strict time limits. It does not replace professional experience, but it provides practical evidence that is useful for technical cybersecurity roles.
Maintaining the OSCP+ Certification
The OSCP+ designation remains valid for three years. The underlying OSCP credential remains valid indefinitely.
OSCP+ renewal options include:
Earning 120 CPE credits during the three-year cycle
Retaking and passing the OSCP+ examination
Passing a qualifying OffSec certification exam
Maintaining annual certification coverage
The current Annual Maintenance Fee is US$145 per year. Candidates following the CPE route should aim for approximately 40 credits each year.
Start Your OSCP+ Preparation
Check your current Linux, Windows, networking, scripting and Active Directory skills before scheduling the exam. A good preparation plan should include structured lessons, repeated lab practice, timed challenges and detailed report writing.
ExploreOSCP+ certification training to build a focused preparation plan and improve your readiness for OffSec’s practical examination.
Comments
Post a Comment