OSEP PEN-300 Preparation — AV Evasion & AD | FsKnockouT

The Offensive Security Experienced Penetration Tester (OSEP), earned through the PEN-300 course, is OffSec's advanced offensive-security certification. It focuses on the attacker tradecraft that comes after initial access — antivirus evasion, Active Directory abuse under hardened defences, lateral movement without detection, and payload crafting that survives real EDR. This guide covers the exam format, the skills that differentiate PEN-300 from OSCP+, a 16-week study plan, and how FsKnockouT walkthroughs help on the final stretch.

What OSEP is

OSEP is a 48-hour hands-on practical exam that assumes you already have OSCP-level fundamentals and tests whether you can operate in a hardened enterprise environment. The exam environment typically includes application whitelisting (AppLocker or WDAC), antivirus solutions (Defender, sometimes with added EDR), network segmentation, and defensive logging.

Unlike OSCP+, OSEP does not reward blunt-force exploitation. The exam rewards custom payload development, process injection, AMSI and ETW bypass, Kerberos abuse under PKI constraints, and attack chains that complete without triggering the defensive stack. You are being tested on tradecraft, not just capability.

Who OSEP is for

  • OSCP holders ready for the next OffSec step.
  • Red-team operators moving from assumed-breach engagements to adversary-simulation work.
  • Internal red-teamers at organisations with mature defensive stacks.
  • Candidates building toward the OSCE3 trifecta (OSEP + OSWE + OSED).

Exam format and scoring

You get 47 hours and 45 minutes of hands-on time plus a 10-minute mandatory break, followed by a 24-hour report window. The exam environment contains:

  • An initial-access path that requires custom payload development to bypass AV/EDR.
  • Multiple lateral-movement opportunities requiring stealth-focused tradecraft.
  • An Active Directory environment with hardened configurations — sometimes including PKI, LAPS, protected users.
  • A final objective (typically domain or forest admin plus a specific "flag" objective).

Scoring is 100 points total. Passing requires 100 points — this means a complete attack chain end-to-end, with "secret.txt" content from the final target. Partial credit exists but historically has been minimal.

Common failure points

  1. Payload development gap. Candidates who relied on msfvenom and basic obfuscation in OSCP find themselves unable to bypass Defender's current signatures. Custom C#, PowerShell, and Nim payloads are table stakes.
  2. AMSI / ETW unfamiliarity. Your PowerShell will be caught if you don't bypass AMSI. Your in-memory loader will be caught if you don't disable ETW.
  3. Kerberos under constraints. OSEP's AD environment constrains Kerberos abuse in ways CRTP candidates haven't seen. Understanding why constrained delegation fails in specific setups is critical.
  4. Application whitelisting. AppLocker and WDAC bypasses require specific technique knowledge. Candidates who never practiced AppLocker bypass have no path forward.
  5. Lateral movement noise. Noisy lateral movement triggers detection. Candidates who psexec their way across the network fail silently (the attack works, but the exam machine logs them out of further attacks).

Study timeline (16 weeks)

  • Weeks 1-5: PEN-300 course videos + guided exercises. Complete every exercise, build every payload yourself.
  • Weeks 6-9: PEN-300 labs. Complete every challenge chain in the lab environment.
  • Weeks 10-11: Supplementary payload development — study C# and Nim loaders, build your own AMSI/ETW bypass harness.
  • Weeks 12-13: AD depth — CRTE lab practice for advanced AD attack chains beyond what PEN-300 teaches.
  • Week 14: Mock exam using retired PEN-300-like environments.
  • Weeks 15-16: Report template polish, final weak-area work, exam scheduling.

Recommended practice

FsKnockouT maintains the OSEP Latest Exam Walkthrough covering current exam-pool attack chains including payload development, AV/EDR bypass techniques, and the specific AD constraints that appear in the exam. See also the OSEP Lab Challenge Guide for PEN-300 lab environment coverage.

Frequently asked questions

How much does OSEP cost?

The PEN-300 course with 90-day lab access and exam voucher is typically around $1,649 USD. Lab extensions and retakes cost additional.

Is OSEP harder than OSCP?

Significantly. OSCP tests broad offensive fundamentals; OSEP tests specialised evasion tradecraft on top of those fundamentals. First-attempt pass rates are lower.

Do I need OSCP before OSEP?

Officially no, practically yes. The PEN-300 course assumes OSCP-level knowledge from day one.

What is the pass rate?

OffSec does not publish an official pass rate. Anecdotal evidence suggests first-attempt pass rates around 30-40%, second-attempt rates substantially higher.

Can I use commercial tools like Cobalt Strike?

No. The exam prohibits commercial C2 frameworks. You must build or use open-source tooling only. Custom payloads and open-source C2 (like Havoc or Mythic) are acceptable.

What happens if I fail?

You get one free retake within 60 days of your original exam, included with the voucher. Additional retakes require new voucher purchase.

What is the next cert after OSEP?

OSCE3 — the combined designation achieved by passing OSEP + OSWE + OSED. Each cert is independent but the OSCE3 badge requires all three.

Ready to prepare?

Pick up the OSEP walkthrough and OSEP lab guide. Message @FsKnockouT on Telegram for live 48-hour exam support. Related reading: OSCP study guide 2026 and OSWE study guide.