OSCP Study Guide 2026 — Pay After Pass | FsKnockouT

The OSCP (Offensive Security Certified Professional, formerly PEN-200, now OSCP+) is the industry benchmark for hands-on offensive security. The 2026 exam tests whether you can compromise a small Active Directory forest and a set of standalone machines inside a strict 24-hour window and then write a professional report. This guide walks through the current exam structure, scoring, common mistakes, a realistic 90-day plan, and how FsKnockouT's walkthroughs and remote exam support fit into your preparation.

What OSCP+ is

OSCP+ is Offensive Security's flagship practical penetration-testing certification. It validates that you can perform reconnaissance, exploitation, Active Directory attack chains, pivoting, and privilege escalation under exam pressure. The 2026 refresh (announced on OffSec's grading update) uses an Active Directory set worth 40 points plus three standalone machines worth 20 points each, giving a 100-point maximum.

Unlike a multiple-choice exam, OSCP+ is pure practical. You exploit real vulnerable machines, document each step, and then submit a professional report. Earning the cert requires both a high enough score on exam day and a complete, accurate report delivered in the 24-hour post-exam window.

Who OSCP+ is for

Junior penetration testers looking to break into the field with a vendor-neutral practical credential.
Security engineers and SOC analysts moving into offensive security roles.
Red-team candidates building a baseline before OSEP / CRTP / OSWE.
Bug-bounty hunters who want to formalise on-prem and AD skills.
Hiring-manager candidates — many SOC2 and government contracts list OSCP as a hiring filter.

Exam format and scoring

You get 23 hours and 45 minutes of hands-on time plus a mandatory 10-minute break and a post-exam 24-hour window to write the report. The environment contains:

One Active Directory set — three domain-joined machines you chain through, worth 40 points. Full compromise of the domain controller is required to unlock the 40.
Three standalone machines — unrelated boxes worth 20 points each (60 total).

Pass threshold is 70 points, so you need either the full AD set plus two standalones, or the AD set plus one standalone and heavy partial credit from the third. Submitting your lab-report bonus (10 points) no longer applies to OSCP+; the bonus-point path was retired in the 2024 update.

Common failure points

Most failed OSCP+ attempts share a handful of root causes:

Enumeration gaps. A missed SMB share, an unscanned UDP port, or an ignored HTTP virtual host costs the whole machine. Automated scanners are a starting point, not a finishing line.
Active Directory tunnel vision. Candidates spend six hours trying to kerberoast when the attack chain was a misconfigured ACL or an AS-REP roastable account. Map first, attack second.
Pivoting fatigue. Many standalones require chisel, ligolo-ng or SOCKS proxies. Candidates who never practiced multi-hop pivoting lose hours re-learning on exam day.
Report panic. A clean 70-point exam has been failed due to an incomplete or incoherent report. Build your report template before exam day and screenshot aggressively during the exam itself.
Sleep debt. Candidates who try to run 24 hours straight burn out by hour 14 and miss obvious wins. A planned nap around hour 10 typically outperforms sleep-deprivation heroics.

Study timeline (12 weeks typical)

A realistic preparation plan assuming 2 hours per weeknight plus 6 hours per weekend:

Weeks 1-3: PEN-200 course videos + guided exercises. Finish every exercise, not just the labs.
Weeks 4-7: PEN-200 labs. Aim for 40+ machines rooted, including every challenge AD set.
Weeks 8-10: External practice — Hack The Box's OSCP-prep tracks, VulnHub boxes, and TJ Null's OSCP-like list.
Week 11: Simulated 24-hour mock exam using retired OSCP boxes. Use the real report template.
Week 12: Light review, report template polish, exam booked for the end of the week.

Recommended practice

If you want targeted practice on the exact machine profiles that recur in the current OSCP+ exam pool, FsKnockouT maintains walkthroughs for every standalone and AD variant. See the OSCP+ collection, the 37-machine standalone bundle for subnet-wide coverage, and the AD challenge mega bundle (v4-v9) for Active Directory chains.

Frequently asked questions

How hard is OSCP+ compared to OSCP?

The 2024/2026 OSCP+ refresh added fresh machines, stricter grading on report quality, and dropped the lab-report bonus. The underlying skill ceiling is similar to the classic OSCP, but the margin for error on report quality is smaller.

What is the passing score?

70 points out of 100. Full AD set (40) plus two standalones (40) is a clean pass. Full AD plus one standalone plus substantial partial credit on the third is the most common pass pattern.

How long do I have for the report?

You get 24 hours after the exam ends. Treat the report as a non-negotiable deliverable — submit early rather than late.

Can I use ChatGPT during the exam?

You may use any publicly available tool or documentation during the exam, including language models. You may NOT ask another human. The report must be your own work.

What tools am I allowed to use?

Metasploit is restricted to one machine per exam. Commercial scanners (Nessus, Burp Pro Scan, Nexpose) are prohibited. Manual Burp Suite, nmap, enum4linux, and most open-source tooling are fair game.

What happens if I fail?

You get one free retake within 60 days, included with the original voucher. Additional retakes cost extra.

How does FsKnockouT help?

Two paths. One, our walkthroughs document every active exam-pool machine with nmap, exploitation, and privilege-escalation steps so you can study the exact profiles. Two, our pay-after-pass remote support lets you book live assistance where nothing is charged until the exam is completed.

Ready to prepare?

Start with the Complete OSCP+ Mega Bundle for full 980-point coverage across AD and standalones, or match individual variants from the OSCP+ catalogue or match individual variants from the OSCP+ catalogue. When you want a real human on call during the exam, reach us on Telegram at @FsKnockouT — nothing is charged until your exam is complete.