Overview

During the course of my journey into the field of cybersecurity and ethical hacking, I quickly discovered that the Offensive Security Certified Professional (OSCP) certification is practically the gold standard for cybersecurity certifications, at least when it comes to resumes, HR, and broader recognition of demonstrated skill. For some time, I used that exam as a long term goal, something I would eventually get that would finally ease the imposter syndrome and make me feel like I was qualified to call myself an Ethical Hacker. After years of study and practice and 3 failed attempts, I am delighted to say that I passed the exam and earned my OSCP+ certification! It is currently hanging on the wall behind my desk along with a host of other certifications, including the PJPT, PNPT, CPTS, and Security+.

If you don't know much about the exam, it is a 24-hour (23 hours and 45 minutes, technically), proctored, penetration test. The

The Penetration Testing with Kali Linux (PEN-200) course is OffSec’s essential training program for aspiring penetration testers. The course teaches learners how to identify and exploit real-world vulnerabilities across computers, network security, web applications, and basic cloud environments. Emphasizing hands-on, practical learning, PEN-200 provides the core technical skills and mindset required to simulate offensive information security operations—and defend against them. It’s a critical resource for those pursuing roles such as penetration tester, security analyst, security specialist, or certified ethical hacker.

PEN-200 covers a wide range of topics and attack techniques, including:

Providing an introduction to cybersecurity and an effective learning strategy to help you get started Performing enumeration and information gathering, including vulnerability scanning and vulnerability assessment Understanding encryption and cryptography Utilizing perimeter attacks in web and application security as well as client-side attacks, where we go into depth in the commonly seen vulnerabilities such as XSS, Command Injection, Directory Traversal, File Uploads, and SQL Injection. We also cover password attacks and touch on Anti-Virus Evasion Performing Windows and Linux privilege escalation and lateral movements, including pivoting and tunneling techniques Using Active Directory, attacking Active Directory authentication, and lateral movement in Active Directory Enumerating and attacking AWS cloud infrastructure Learning how to use commonly used tools and commands in penetration testing, such as Nmap, Metasploit, Burp Suite, Hydra, Nessus, sqlmap, and Shellter PEN-200 is organized into 20+ modules. Most modules have companion videos for the visually inclined learners. Most modules have hands-on labs to help learners practice the concept and theory taught in that module. After mastering each of the techniques and skills taught in all modules, learners can move on to the 9 challenge labs to practice a combination of skills in one lab, mimicking the real-world penetration test engagement. To help learners get ready for their OSCP+ certification exam, three challenge labs are designed to closely replicate the OSCP+ exam environment.

PEN-200 is suitable for those wishing to embark on a professional pen testing career, or wanting to learn ethical hacking skills possessed by pen testers. Before taking this course, we do suggest having hands-on practical knowledge of Linux and Windows administration, networking, and network scripting.

Objectives

After completing this course, learners will be able to:

• Master information gathering and enumeration techniques
• Conduct vulnerability scanning with Nessus and Nmap
• Perform web application and client-side attacks
• Execute Windows and Linux privilege escalation techniques
• Implement port redirection and SSH tunneling
• Analyze and attack Active Directory environments
• Utilize public exploit resources and adapt them for specific scenarios
• Evade antivirus detection
• Generate and debug shellcode for penetration testing
• Write detailed and effective pen test reports

Price & Payment

The major barrier with the OSCP is the price, which is why most people only take the exam if it is paid for by an employer. That is a smart way to do it, but I had no employer at the moment, so I figured it was a "way down the line" goal. My idea was to somewhat make up for my lack of professional experience with as many hands on certifications as I could. I had heard that the OSCP was the best way to get past HR departments/AI resume processing tools, so I did some research and found out that I could pay for the Course + Cert Bundle, priced at $1749, in small monthly payments via Klarna.

The Course + Cert Bundle included an OSCP+ exam voucher, valid for one (1) attempt, and three (3) months (90 days) access to the PEN-200 training course as well as the Proving Grounds/Challenge Labs.

PEN-200: Penetration Testing with Kali Linux

Download the PEN-200 course syllabus here.

Course Material

The course material was pretty basic. It was mostly text based lessons with some videos spread throughout that covered the basics of AD penetration testing, web app penetration testing, and Amazon AWS. Once you log in to your account dashboard, there is an option to export the entire training course material via PDF, which was really nice for reference in Obsidian later.

I will be honest here and say that I did not go through the PEN-200 course as I had just passed the CPTS exam and completed all of the modules on that path, which were MUCH more intensive than the OffSec material. I was told to focus on the Challenge Labs, so that is what I did.

Challenge Labs

Most of the advice I read said to focus on the Challenge Labs, specically OSCP A, OSCP B, and OSCP C, so thats what I did. Apparently, those three labs in particular are previously retired OSCP exams, and format/experience wise I'd say they were a pretty accurate representation of the exam itself.

In addition to the challenge labs, OffSec provides a Proving Grounds, similar to HackTheBox Labs, without needing a subscription. This will give you hundreds of vulnerable machines to try out your skills!

Exam

The exam itself contains an Active Directory set with three connected machines along with three standalone machines. Compromising the AD domain is woth 40 points while each machine is worth 20 - 10 points for obtaining a foothold and 10 points for getting admin/root access. To pass the exam, you need a total of 70 points in whatever combination you can. I passed by compromising the AD set (40 points), completely rooting a standalone machine (20 points), and gaining a foothold on a second standalone machine (10 points).

While the format is very similar to the Challenge Labs, the exam itself is brutal. You will have 23 hours and 45 minutes to obtain 70 points, then an additional 24 hours to write a professional pentest report. The OSCP+ exam is also proctored, meaning you will need to share your screen, microphone, and camera for the entire exam. Before starting the test, you check in with the site they send you via email with credentials they provide, then a proctor will walk you through the process of assessing your machine. You will need to share all monitor screens and keep both the chat and the camera open the entire time. They will give you a command to run and a link where you can paste the output, which I think does a quick scan of your machine to make sure nothing is connected that shouldn't be and there's no obvious way to cheat. Once you pass, they will send you the exam dashboard and the VPN to download and connect to the exam environment.

It sounds scary, but you honestly barely notice it. You will need to run all of the tests and chat on your host machine, which you can leave minimized if you need to start a Kali VM like I did. You won't even see you are on camera until you minimize your VM. You can work at your own pace, and if you need to take a break for any reason, just let them know in the chat before you leave. You do not have to wait for a response, but make to sure to tell them when you get back.

Prohibited tools

One thing to note is that you are forbidden from using any AI or "autopwn" type of tools, which includes Metasploit. You can use Metasploit for one machine and only one, even if it doesn't work. You can, however, use the multi/handler module.

Screenshots and Flag Hashes

Once you obtain the local.txt or proof.txt files, you will need to copy/paste the hash into the exam control panel.

It is also important to note that OffSec has specific requirements for their screenshots. Each screenshot must include the contents of the file as well as the IP address command via ipconfig, ifconfig, or ip addr. For windows machines, a good practice is to use the command type local.txt; ipconfig or cat local.txt && ifconfig on linux.

Tips

The exam is tough, but it is doable. I compromised the AD domain in just a couple hours on my first attempt, then was unable to get any further. That was very disheartening, but if you fail they offer an exam retake for $250. I failed a couple times and was fortunate enough to have the exam retake voucher paid for.

Anyway, here are some tips to ensure the best testing experience.

• Get plenty of sleep
• Make sure to take lots of breaks. Getting your eyes off the exam and focusing on something else really does help if you get stuck.
• Don't just randomly attack the exam. Make sure you have a methodology for Windows machines, Linux machines, and Active Directory machines. A checklist was helpful for me, both fo foothold and privilege escalation.
• If you get stuck, double check the information you have. See what you can access with it and if you can use the credentials somewhere else.
• Do not overthink it. Sometimes the answer really is that simple.
• If you are doing some super complex and in depth coding or other attack, you are probably down a rabbit hole. Go back over what you have, take a quick break, and try again with fresh eyes.
• Everything you need is in the course material. The HTB CPTS course material was also invaluable, though not required.

Good luck! It may seem overwhelming, but you've got this!