Offensive Security Courses

What are the Offensive Security (OffSec) courses?

Offensive Security, now OffSec, is the company behind Kali Linux, Exploit-DB and the best-known certification in pentesting: the OSCP. Its courses combine written and video material with labs of vulnerable machines, and each one ends in a demanding hands-on exam. The house motto, "Try Harder", sums up the approach: you get the foundations, but you are expected to research and solve problems on your own.

Main catalog

Course	Certification	Focus
PEN-200	OSCP	Network, Windows, Linux and Active Directory pentesting
PEN-300	OSEP	Defense evasion and advanced lateral movement
WEB-200	OSWA	Black-box web assessment
WEB-300	OSWE	Code review and white-box web exploitation
EXP-301	OSED	Windows exploit development
SOC-200	OSDA	Detection and defensive analysis (blue team)

There is also Proving Grounds, their practice machine platform, widely used to prepare for OSCP.

What they are good for

• Landing pentesting jobs: OSCP appears in a large number of pentester and red team job ads as a requirement or a plus.
• Learning real methodology: thorough enumeration, manual exploitation, privilege escalation and Active Directory attacks.
• Specializing: OSWE for code auditors, OSED for exploit developers, OSEP for red teamers.

What the OSCP exam looks like

The OSCP exam is practical: you have almost 24 hours to compromise a set of machines (including an Active Directory environment) and then another 24 hours to submit a professional report with evidence. Since late 2024 OffSec also issues the OSCP+, which has a limited validity period and must be renewed, while the classic OSCP does not expire. Check the current rules on the official site before you sit the exam, because OffSec updates them frequently (for example, restrictions on Metasploit and AI tools).

Learning path to OSCP

1. Foundations: Linux, Windows, networking and basic Bash or Python scripting. If you lack them, start with TryHackMe or OverTheWire.
2. First step: a junior certification like eJPT gives you method and confidence.
3. Intensive practice: Hack The Box machines and Proving Grounds. The community's "OSCP-like" machine lists are a good starting point.
4. PEN-200: complete the course exercises and as many labs as possible, including the Active Directory sets.
5. Mock exam: run a 24-hour session including the report to gauge your pace.

An example of the checks you will run constantly when escalating privileges on Linux:

id; sudo -l
find / -perm -4000 -type f 2>/dev/null
cat /etc/crontab
ls -la /home/*/.ssh 2>/dev/null

And in Active Directory, authenticated enumeration with lab credentials:

nxc smb 10.10.10.0/24 -u user -p 'Password1' --shares
impacket-GetUserSPNs domain.local/user:'Password1' -dc-ip 10.10.10.5 -request

Use these techniques only in the labs or on systems you are explicitly authorized to test.

Pro tips

• Enumeration is everything: most dead ends come from something you missed, not an exploit you do not know.
• Write the report as you go: screenshots and commands captured on the spot save you hours at the end.
• Manage your energy: sleep and eat during the exam; 24 hours non-stop usually goes worse.
• Pick the right plan: OffSec sells the course with lab access and an exam attempt, plus annual subscriptions (Learn One, Learn Unlimited). Compare current prices on the official site.

Pros and cons

• Pros: the offensive certification most recognized by HR, 100% practical exams, updated content including Active Directory, clear progression into specializations.
• Cons: high price, steep learning curve, the material assumes a lot of autonomy and the exam is very stressful.

Alternatives

• INE Security: eJPT and eCPPT certifications, more affordable.
• Hack The Box: machines plus Academy certifications such as CPTS.
• PentesterLab Pro: a budget option for web, useful before OSWE.
• PortSwigger Web Security Academy: free and excellent for the web side.

Frequently asked questions

Are OffSec courses free?

No, they are paid. OffSec offers some free content (such as introductory material and Kali documentation), but the certification courses require payment. Check current prices on their site.

How much does OSCP cost and how long does it take to prepare?

The price depends on the bundle; check the official site. Time-wise, with a solid foundation it usually takes several months of steady practice.

Can you pass OSCP without experience?

It is possible but very hard. The recommended approach is to arrive with experience on CTF-style machines and an entry-level certification like eJPT.

Does the OSCP expire?

The classic OSCP does not expire; the OSCP+ has a validity period and must be renewed under OffSec's terms.

If you are building your foundations before taking the leap, practice Linux, networking and exploitation at the Hackers en Acción Academy.