OSCP+ Preparation Guide for 2026: Exam Format, a 12-Week Plan, and an Exam-Day Playbook#

Most OSCP guides are either a list of links or a motivation speech. This one tries to be the document you keep open while you study: how the exam is scored, which rules actually change your approach, a week-by-week plan, the commands you will run on every target, and what the report needs so that points you earned are not lost on paperwork.

Before you book: OffSec changes exam rules from time to time. The exam facts below were checked against the official OSCP+ Exam Guide in October 2026. Read the current version before your attempt, and treat it as the source of truth if anything here differs.

The exam in one table#

Source: the official OSCP+ Exam Guide. Rules change, so read the current version before you book.

The math that should shape your strategy#

The guide lists exactly four ways to reach 70:

• 40 (AD) + 3 local.txt flags = 70
• 40 (AD) + 2 local.txt + 1 proof.txt = 70
• 20 (AD) + 3 local.txt + 2 proof.txt = 70
• 10 (AD) + 3 fully completed standalone machines = 70

Points inside the AD set are chained: machine 3 is worth 20, and you only get there through machines 1 and 2. Two things follow. A full AD chain makes the standalones much less stressful, and a stuck AD set is not the end, because three complete standalones plus the first AD machine still passes. Also note that the guide says the order in which you document machines in the report is the order they are graded.

Rules that change how you work#

These are the restrictions that matter in practice. The exam guide has the full list, including the ones about spoofing, commercial tools, and mass vulnerability scanners.

• Metasploit on one machine only. Metasploit modules (auxiliary, exploit, post) and the Meterpreter payload can be used against one target of your choice. The choice locks in as soon as you use either on a machine, even if the attack fails, and check counts as use. It cannot be used for pivoting. multi/handler and msfvenom can be used against all machines, but Meterpreter payloads only on your one chosen target. Plan exploits so you never need Metasploit, and keep it as a fallback.
• No automated exploitation tools. sqlmap, db_autopwn, browser_autopwn, and similar are prohibited, and so are mass vulnerability scanners (Nessus, OpenVAS, and similar). Nmap with NSE, Nikto, Burp Free, and DirBuster-style tools are allowed.
• No spoofing and no commercial tools. IP, ARP, DNS, and NBNS spoofing are out, and so are Metasploit Pro and Burp Pro.
• No AI chatbots. OffSec KAI, ChatGPT, Gemini, DeepSeek, and similar are prohibited and treated as third-party help. Tools that merely have built-in AI features (Notion, for example) are not a violation. If you used a chatbot as a crutch during preparation, stop at least a month before the exam.
• Proof must come from an interactive shell. Every local.txt and proof.txt must be shown with type or cat from its original location in an interactive shell on the target, in a screenshot that also shows the target's IP (ipconfig, ifconfig, or ip addr). A web shell, or a file read any other way, gives zero points for that machine. On Windows you need a shell as SYSTEM, Administrator, or a user with administrator privileges, and on Linux a root shell.
• Submit the flags in the control panel too. The panel does not tell you whether a flag is correct.
• Things that cost you all points for a target: a restricted tool, Metasploit on more than one machine, a missing proof file in either the panel or a shell screenshot, and missing documentation.

The 12-week plan#

This assumes you can already use Linux comfortably, read basic Python and Bash, and understand TCP/IP and HTTP. If not, spend two to four weeks on that first. The plan below assumes about 15 to 20 hours per week.

Two rules for this plan:

1. Writeups only after a time box. Give a machine 3–4 hours of honest effort before you read a hint, then read only enough to get unstuck. Write down why you missed it. That note is worth more than the machine.
2. Every machine produces notes. Commands that worked, the version strings that mattered, and the privesc vector. Your notes are the only resource you can search during the exam, so they need to be searchable.

The enumeration routine#

Most failed attempts come from missed enumeration, not missing exploits. Run the same routine on every target until it is automatic.

Ports#

# Full TCP sweep first, then details only on what is open
sudo nmap -p- --min-rate 2000 -T4 -oN ports.txt $IP
PORTS=$(grep -oP '^\d+(?=/tcp\s+open)' ports.txt | paste -sd, -)
sudo nmap -p$PORTS -sCV -oN services.txt $IP
 
# UDP is slow; the top ports are usually enough
sudo nmap -sU --top-ports 25 -oN udp.txt $IP

SNMP (161/udp) is the classic UDP finding. If it is open, try snmpwalk -v2c -c public $IP before anything else.

Web#

whatweb http://$IP
feroxbuster -u http://$IP -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt,bak,zip
ffuf -u http://$IP -H "Host: FUZZ.target.local" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0

Read the page source, check robots.txt, note every version number, and search each one with searchsploit and a web search. Try default credentials on every login page before you brute-force anything.

SMB and other services#

nxc smb $IP -u '' -p '' --shares
nxc smb $IP -u 'guest' -p '' --shares
smbclient -N -L //$IP
enum4linux-ng -A $IP

For every service, ask three questions: what version is it, does it allow anonymous access, and does it accept credentials I already have?

Privilege escalation#

Run the automated script, but also check the high-value items yourself, because scripts produce a lot of output and the real vector is easy to scroll past.

Linux

id; sudo -l
find / -perm -4000 -type f 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab; ls -la /etc/cron.*
ss -tlnp            # services listening only on localhost
ls -la /opt /srv /var/www /home/*

Check every sudo -l result and SUID binary against GTFOBins.

Windows

whoami /priv
whoami /groups
Get-ChildItem C:\Users\*\Desktop, C:\Users\*\Documents -Force -ErrorAction SilentlyContinue
Get-CimInstance Win32_Service | Where-Object { $_.PathName -notmatch '^"' -and $_.PathName -match ' ' } | Select Name, PathName
cmdkey /list
Get-History; (Get-PSReadLineOption).HistorySavePath

SeImpersonatePrivilege on a service account usually means a Potato-family exploit. Unquoted service paths, writable service binaries, saved credentials, and PowerShell history are the other common wins.

The Active Directory set#

The exam gives you credentials for a domain user. The workflow below is the one to practice until you can do it without notes.

# 1. Validate the credentials and map the domain
nxc smb $DC_IP -u $USER -p "$PASS"
nxc smb 10.10.10.0/24 -u $USER -p "$PASS"          # where can this user log in?
bloodhound-python -u $USER -p "$PASS" -d $DOMAIN -ns $DC_IP -c All
 
# 2. Roast what can be roasted
impacket-GetUserSPNs $DOMAIN/$USER:"$PASS" -dc-ip $DC_IP -request -outputfile kerberoast.txt
impacket-GetNPUsers $DOMAIN/ -usersfile users.txt -dc-ip $DC_IP -format hashcat -outputfile asrep.txt
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
 
# 3. Every new credential: spray it everywhere, carefully
nxc smb hosts.txt -u users.txt -p "$NEWPASS" --continue-on-success
nxc winrm hosts.txt -u $NEWUSER -p "$NEWPASS"

On every machine you compromise, collect credentials before you move on (mimikatz, impacket-secretsdump, files, history, configuration files), then repeat step 3 with what you found. The AD set is usually a chain where each machine gives you the credential for the next. If you are stuck, the answer is almost always a credential you collected and did not try everywhere.

For internal networks you cannot reach directly, practice one pivoting tool until it is routine. Ligolo-ng is the most comfortable option because it gives you a routed interface instead of a SOCKS proxy.

Exam day#

• Start with the AD set unless your practice shows that standalones go faster for you. 40 points in one chain is the single biggest block.
• Time-box every target. If you have made no progress for 90 minutes, switch targets. Coming back with fresh eyes works more often than pushing on.
• Take screenshots as you go. Every step that you will need for the report: the vulnerable request, the exploit command, the shell, the flag with the IP address. Reconstructing them later costs hours.
• Sleep. A 2–3 hour sleep around the middle of the exam is a normal strategy, not a weakness. Tired people miss obvious things in enumeration output.
• Check points before you stop. Count your flags, check every proof screenshot meets the rules, and only then end the exam.

The report#

Points that are not documented do not count. The report must let a reader reproduce each step.

For every machine:

1. The service and the vulnerability, with version.
2. Exact steps to reproduce, with the commands and any modified exploit code.
3. Screenshots for initial access, privilege escalation, and both flags with the IP address.
4. A short note on how to fix it.

Use OffSec's template, or a Markdown-based one that you have already used for your practice reports in weeks 9–10, such as the noraj OSCP report template or SysReptor, which has OSCP templates. Do not try a new template on exam day.

Common reasons people fail#

• Rushing to exploits before enumeration was finished.
• Not trying collected credentials on every service in the AD set.
• Running out of time on one machine because there was no time box.
• Missing or invalid proof screenshots.
• Depending on walkthroughs or AI tools during preparation, then facing the exam without either.

A module-by-module series#

This guide is the overview. A companion series walks the PEN-200 modules in order, each post with commands run against a real lab, not just prose: start with Part 1 — Note-Taking and Report Writing.

Related labs on this site#

The exam bans automated exploitation tools, so manual testing has to be second nature. These posts build small labs you can attack by hand:

• XSS by context: five XSS contexts tested in a real browser.
• NoSQL Injection, Part 1: operator injection and blind extraction without tools.
• HTB writeups: machines solved end to end, with the dead ends included.