How to prepare for OSCP from scratch

OSCP (Offensive Security Certified Professional) is one of the most recognised offensive certifications in the world and a common entry ticket into penetration testing. It also has a well-earned reputation for being hard: a 24-hour hands-on exam where you have to genuinely compromise machines and write a professional report. If you’re starting from scratch — no Linux, no networking, no scripting — that doesn’t put OSCP out of reach. It just means you need the right order. This guide shows how to build the foundations before you ever open the official PEN-200 material.

First, an honest word: what OSCP is not

OSCP is not a beginner course, even though many people treat it as one. The official OffSec material (PEN-200) assumes you can already move around Linux, understand basic TCP/IP networking and aren’t scared of the terminal. People who “bounce off” OSCP rarely struggle with the certification itself — they have a gap in the fundamentals that the exam ruthlessly exposes.

So preparing for OSCP from zero splits into two phases:

Foundations (weeks to months): Linux, networking, scripting, the attacker mindset. OffSec won’t teach you this — you’re expected to arrive with it.
PEN-200 proper (2–3 months of focused work): methodology, labs, Active Directory, privilege escalation, the report.

This article focuses mostly on phase one, because that’s where it’s decided whether OSCP will be hard or impossible.

Foundation 1: Linux, until it stops feeling foreign

Pentesters live in the terminal. If you have to look up every command today, you’ll lose hours you don’t have on exam day. The goal isn’t to memorise everything — it’s fluency: navigating the filesystem, permissions, processes, services, redirection and pipes need to become reflexes.

A practical approach: install Kali Linux in a virtual machine (VirtualBox or VMware) and use it for everyday small tasks. Don’t learn Linux “in theory” — set yourself real micro-tasks: find every file changed in the last hour, list processes listening on ports, fix a directory’s permissions. Each one is one less reflex to look up later.

Foundation 2: networking, or how traffic actually flows

You can’t hack what you don’t understand. Before you touch exploitation, you need to know what happens between a packet and a service: IP addressing and subnets, the difference between TCP and UDP, what ports are for, how DNS works, what HTTP is and why SMB shows up in almost every Windows scenario.

This is the knowledge that turns “the scan showed port 445” into “that’s SMB — I’ll check the version, the shares and known vulnerabilities”. Without it, enumeration is guesswork. For a sense of how methodical service mapping and working from hypotheses looks in practice, see our web application penetration testing guide.

Foundation 3: a little scripting

You don’t need to be a programmer, but you do need to read and modify someone else’s code and automate repetitive work. In practice that means:

Bash — loops, pipes, text processing (grep, awk, sed). Your everyday glue.
Python — enough to understand and tweak a public exploit when it doesn’t work out of the box.

On the exam you’ll almost never paste an exploit without a single change. Being able to swap an IP, a port or a payload in someone else’s script is often the difference between a machine owned and a machine abandoned.

Foundation 4: the attacker mindset

The hardest to drill and the most important. It’s the habit of asking “what else is here that I can’t see?” and being systematic: methodical enumeration instead of chaotic clicking, writing down every hypothesis, and patience when the first path turns out to be a dead end. OSCP rewards persistence and order more than flashy tricks.

How long does it really take?

There’s no single answer, but for orientation:

Complete beginner (no IT background): expect 6–12 months of solid, regular work before the exam.
With an IT background (sysadmin, development, networking): often 3–6 months.
The PEN-200 + labs phase alone: realistically 2–3 months at ~20 hours a week.

The key word is consistency. Two hours a day for six months beats occasional weekend marathons. Security is a skill, not a body of facts to cram — and skills are built by repetition.

Where to practise once the foundations are in place

Once Linux and networking stop being a barrier, move to hands-on practice on legal platforms with machines to capture. Starting out, keep a simple discipline: do machines without looking at the walkthrough, and only compare your approach to others afterwards. That builds the self-sufficiency the exam demands.

When you feel confident, move to a concrete technical schedule: we’ve published a ready 12-week OSCP study plan with measurable gates. It’s also worth knowing up front what the OSCP+ exam in 2026 looks like — because the report can weigh on your result just as much as the machines you compromise.

Build the foundations in BreachRoad Academy — for free

The biggest problem for people starting from zero isn’t a lack of material — it’s a lack of order: the internet buries you in random courses, and a beginner has no way to know what comes after what. That’s why we launched BreachRoad Academy — a free knowledge path into the profession, released one module at a time.

The “Pentester Path” starts with a safe-use model for Kali Linux, then terminal, system, and networking foundations, followed by adversarial thinking, written case analysis, remediation, and detection. Every module ends with a knowledge check; the course requires no lab downloads or execution.

Let’s be honest: the Academy is not an official OffSec course and does not replace PEN-200 or the OSCP exam itself. Its job is to get you to the point where the official material stops being overwhelming, because you already have solid ground under your feet. Everything is free right now — you create an account, track your progress and earn ranks as you go.

👉 Start learning in BreachRoad Academy — from zero, at your own pace.

Common early mistakes

Skipping the foundations and jumping straight into PEN-200 — the fastest route to frustration.
Collecting courses instead of solving machines. You learn security with your hands, not by watching.
No notes. Your own organised base of commands and payloads is your most valuable asset on the exam.
Learning one tool. Understand what a command does, not just which one to type — tools change, mechanisms don’t.

Summary

OSCP from scratch is doable if you respect the order: foundations first (Linux, networking, scripting, mindset), then the official material and labs, and the exam last. Don’t cut phase one short — it decides everything. Start calmly, practise regularly and build your own notes. If you’d rather have a ready, ordered path than a chaos of random tutorials, create a free BreachRoad Academy account and finish the first module today.

Questions about studying for OSCP or breaking into the field? Get in touch — we’re happy to point you to a starting line.