How to Prepare for OSCP

Preparing for the OSCP is not primarily about reading — it is about accumulating hours of hands-on practice until unfamiliar machines stop intimidating you. The exam is a 24-hour practical against targets you have never seen, so effective preparation replicates that: build the prerequisite skills, work the PEN-200 labs until the method is automatic, harden yourself against fresh machines outside the course, and rehearse the endurance and documentation the exam demands.

This roadmap gives you a phased plan for doing exactly that. It is a preparation guide, not a difficulty rating or a certification overview — if you still need the format, cost and scoring basics, start with the OSCP certification guide, and if you want an honest read on the exam's brutality, see how hard the OSCP exam is. Here, the focus is entirely on what to do, in what order.

Phase 0: Close the prerequisite gaps first

The OSCP has no formal prerequisites, but the PEN-200 course assumes real technical fluency and will not teach it to you. Before you spend a single day of your paid lab clock, you want these foundations solid, because OffSec explicitly recommends them:

• TCP/IP networking — ports, protocols, routing, how services expose themselves. You will enumerate networks constantly; gaps here slow everything downstream.
• Linux administration — the command line as a first language, not a struggle. File permissions, processes, services, package management.
• Windows administration — users, groups, services, the registry, PowerShell basics. Half the exam's privilege-escalation surface is Windows.
• Bash and Python scripting — enough to read an exploit, modify it, and automate repetitive enumeration.

The reason this phase comes first is economic as much as technical. Lab access is time-boxed and paid for; learning what a subnet is on OffSec's clock is expensive. Spend free time on this groundwork now so that paid time later goes to penetration testing, not fundamentals.

Self-check to leave Phase 0: you can stand up a Linux and a Windows VM, move confidently around both, write a short Bash or Python script without a tutorial open, and explain what a port scan is doing. If any of those makes you hesitate, stay in this phase — it is the cheapest place to improve.

Phase 1: Work the PEN-200 course and labs properly

PEN-200, "Penetration Testing with Kali Linux", is the official course — 20-plus modules and roughly 321 hours of material spanning enumeration, exploitation, web attacks, privilege escalation and Active Directory attacks, with cloud (AWS) content included. How you consume it matters more than that you consume it.

A method that works:

1. Read a module, then immediately apply it. Passive reading produces recognition, not recall. The exam needs recall under pressure. After each module, reproduce the technique in the labs before moving on.
2. Prioritise the Active Directory modules. The exam awards 40 of its 100 points to a single AD environment, and you cannot pass on the standalone machines alone. Treat AD as core, not an appendix — this is where thin preparation shows up on exam day.
3. Work the lab machines as first-attempt exam rehearsals. For each lab target, force yourself to enumerate from scratch and exhaust your own ideas before consulting any guidance. The skill the exam grades is what you do when you are stuck, and only unassisted practice builds it.
4. Do not skim past web attacks and enumeration. Shallow enumeration is the single most common reason capable candidates fail; the labs are where you build the patience to enumerate thoroughly by default.

The 90-day bundle gives a hard three-month lab clock; the Learn One subscription gives a year. Choose the runway that matches your available weekly hours honestly — the certification guide breaks down which purchase option suits which candidate.

Phase 2: Harden yourself on machines outside the course

Here is the uncomfortable truth about lab-only preparation: the exam's machines are not OffSec's lab machines. If your entire practice history is inside PEN-200, exam day is the first time you meet a genuinely unfamiliar target under pressure. The fix is to practise on machines you have never seen from other reputable sources.

Platforms such as Hack The Box provide large pools of vulnerable machines that stretch your method against variety the course cannot fully supply. How to use outside practice well:

• Favour variety over comfort. Deliberately pick machines outside your strengths — more Windows if you lean Linux, more web if you lean binaries. The exam will not let you choose your weaknesses.
• Practise chained, multi-host scenarios, not just single boot-to-root boxes. The exam's AD set demands pivoting and multi-stage compromise; isolated single machines under-train exactly that.
• Time-box every attempt. Give yourself a fixed budget per machine and, when it expires, force the decision every OSCP candidate must make live: keep digging or move on. This is how you train against rabbit-holing before it costs you a pass.
• Rebuild your method from anything you had to look up. Every walkthrough you consulted marks a gap; note the underlying technique and re-derive it on the next machine unaided.

Aim to reach the point where you can compromise unfamiliar intermediate machines end to end, unassisted, more often than not. That consistency — not any single impressive solve — is the real readiness signal.