OSEP and PEN-300: a technical exam preparation guide

OSEP and PEN-300 develop skills for assessing mature environments where simple payloads are detected and segmentation blocks a direct path. The official syllabus covers client-side execution, process injection, antivirus and application-whitelisting bypass, post-exploitation, Windows credentials, lateral movement, MSSQL and Active Directory.

The practical OSEP exam lasts 47 hours and 45 minutes, followed by 24 hours for reporting. Success depends on combining techniques into one reproducible chain.

Beyond OSCP+

OSCP+ tests enumeration, access, escalation and foundational AD. OSEP assumes fluency in those areas. The challenge becomes delivering code, bypassing controls, pivoting through zones and adapting tools to constraints.

Do not memorise one loader. Understand signatures, AMSI, behavioural detection and application control. In labs, compare disk artefacts, memory, process trees and network traffic.

Operational method

Maintain a graph of identity → host → privilege → next resource. Record prerequisites, execution, evidence and fallback. Re-test SMB, WinRM, WMI, MSSQL and administration channels after every new credential.

Analyse segmentation as routing: traffic origin, listener location and permitted protocols. A tunnel without a diagram quickly becomes guesswork.

Technical preparation

Before PEN-300, be comfortable with PowerShell, C#, Windows APIs and basic debugging. Modify and compile code, diagnose failures and reproduce behaviour without a full framework.

Practise:

• delivery and client-side execution;
• processes, tokens and credentials;
• allowlist and filter bypasses;
• pivoting and lateral movement;
• multi-domain AD relationships;
• reporting a complex chain.

Readiness gate

Complete several multi-stage scenarios without walkthroughs and reproduce them the next day from notes. Reports should contain code, parameters, tunnel architecture and impact for each access level.

OSEP is a logical step after OSCP+ for internal testing and red-team work. If application source or exploit development is the target, compare the complete OSCE3 path.

Building an attack chain without losing control

The most useful preparation artefact is not a command list but a dependency map. For every host, record interfaces, reachable networks, the active user context, local security controls and credentials that have actually been verified. Keep hypotheses separate from facts. “This account may be an administrator” is not equivalent to evidence of successful privileged access.

Give each stage a primary method, a quieter alternative and a recovery path. When a payload fails, isolate the layer first: compilation, transfer, execution, callback, token or network filtering. Changing several variables at once makes diagnosis difficult and produces accidental successes that cannot be reproduced later.

Evidence and the exam report

Use a fixed note structure for every target: time, source, destination, command or code, result, evidence file and next decision. A screenshot should prove a specific claim rather than merely show an open tool. Store code and scripts with their version, compiler parameters and the resulting artefact hash.

The report should let a technical reader reproduce the complete path. A diagram explains traffic across segments, a credential table keeps security contexts clear, and a target-by-target section connects initial access, escalation, pivoting and impact. Before submission, check every required proof against the current OffSec guide, remove unnecessary sensitive data and make sure the written steps match what was actually executed.

An eight-week preparation plan

Use weeks 1–2 for Windows APIs, PowerShell, C# and process analysis. During weeks 3–4, practise delivery and application control while observing artefacts in memory, process trees and network traffic. Weeks 5–6 should cover credential access, MSSQL, lateral movement and routing through several segments. Spend the final two weeks on timed end-to-end scenarios and reports written during, not after, the work.

Readiness means explaining the mechanism behind every bypass, reproducing the path after a lab reset and declining a technique whose effects you do not understand. That matters more than collecting a large set of loaders.

---

Rehearsing the complete chain

Do not learn techniques only in isolation. Build a legal lab where entry leads through enumeration, escalation, pivoting and objective proof while you document assumptions and decisions. After each step, explain which logs and controls could detect it. This improves understanding and reporting.

Automate repeatable collection but reproduce and validate results manually. Practise partial tunnel failure, lost sessions and constrained privilege. The current syllabus defines course scope and the Exam Guide defines exam requirements; check both while planning and again before the date.

Sources: PEN-300 Syllabus, OffSec OSEP Exam Guide.