OSCP+ report: evidence, notes and OffSec requirements

The OSCP+ report is part of the exam, not an administrative task afterwards. OffSec requires enough detail for a technically competent reader to reproduce each attack step by step. Missing valid evidence can mean zero points even when the host was compromised.

The safest workflow writes the report during testing: notes, commands and screenshots are captured immediately after each stage.

Prepare directories before starting

Use the same structure for every target:

10.10.10.10/
  scans/
  web/
  exploits/
  loot/
  screenshots/
  notes.md

In notes.md, record time, hypothesis, command, result and conclusion. Raw output alone is insufficient. “Port 445 open” is weaker than “SMB 3.x; anonymous listing rejected; retest after obtaining a domain identity”.

Minimum evidence chain

For each machine, show:

1. information leading to the vector;
2. request, command or modified exploit;
3. output proving initial access;
4. enumeration leading to escalation;
5. execution of the escalation;
6. the required flag from its original location;
7. current user and host identification.

Every step should follow from the previous one. Do not hide a critical parameter behind “ran the exploit”.

Capture a valid flag screenshot

The current guide requires local.txt and proof.txt to be read from their original locations in an interactive shell with cat or type. Submit the contents in the control panel before the technical period ends and include them in the report.

Use one readable screenshot containing the flag, IP or hostname and current identity. Do not crop away the context connecting proof to the target. Then mark three checklist items immediately: panel, screenshot and description.

Modified exploits

For an unchanged public exploit, OffSec asks for the URL rather than pages of copied code. For modified code, include:

• the changed version;
• original URL;
• highlighted edits;
• reason for each change;
• shellcode-generation command where applicable.

Save a diff when editing. Many hours later, it is difficult to reconstruct why an offset, port or payload format changed.

Make the report self-contained

Do not depend on terminal history or a file absent from the PDF. PoCs and scripts required to reproduce the attack should appear as text in the report. The archive accepts only the PDF.

Document Python version, listener, tunnel, host header and DNS mapping. For HTTP, show method, path, relevant headers and body.

Quality control after the exam

There are 24 hours after the VPN closes to submit. Do not spend them writing from scratch. Run three reviews:

• technical: are steps complete and reproducible;
• evidence: does every scored flag have a valid screenshot;
• publishing: are code and images readable in the PDF?

The current filename is OSCP-OS-XXXXX-Exam-Report.pdf, packed into an unencrypted .7z with the same base. The maximum archive size is 200 MB. Compare the upload portal’s MD5 with the local file.

Final 30-minute VPN checklist

• every flag entered in the panel;
• screenshot for every flag and target;
• IP, hostname and user retained;
• notes and modified exploits exported;
• tunnels and dependencies documented;
• points table consistent with evidence.

Practise the process on every machine in the OSCP+ study plan. A strong report protects exam points and builds the discipline that separates exploitation from a professional penetration test.

---

A full report rehearsal

Before the exam, prepare a template against the current OffSec guide and produce a complete lab report under time pressure. Each proof should connect host, user, command and result unambiguously. Take notes during work; reconstructing steps many hours later increases the chance of missing required screenshots.

Open the final PDF on another device and check images, command copyability, numbering and filename. Exam requirements can change, so consult the official Exam Guide and Reporting Requirements immediately before the date. A blog, course or old report is not authoritative.

Sources: OffSec OSCP+ Exam Guide, PEN-200 Reporting Requirements.