OSWP and PEN-210: a practical technical wireless exam guide

OSWP and PEN-210 focus on 802.11 security. The current exam lasts 3 hours and 45 minutes, provides three network scenarios and requires key recovery, AP connection and retrieval of proof.txt. Passing requires two scenarios, including one designated mandatory.

Radio lab preparation

Use a compatible Wi-Fi adapter supporting monitor mode and packet injection. Practise identifying interface, channel, BSSID, clients and security type. Driver failures can consume more time than the attack, so validate hardware in advance.

Scenario workflow

1. Enable monitor mode on the correct channel.
2. Confirm BSSID and client traffic.
3. Capture the required handshake or protocol material.
4. Validate capture quality before cracking.
5. Recover the key with a permitted method.
6. Join the AP and retrieve proof.
7. Capture screenshots of the key and flag.

OffSec prohibits full-process automation such as wifite, wifiphisher and besside-ng while allowing tools including aircrack-ng. Direct LLM and chatbot use is prohibited.

Reporting and time

The report must reproduce commands and results. Screenshots need to show the recovered key and proof.txt. There are 24 hours for documentation, but take notes during the technical portion.

OSWP is narrow but forces an understanding of radio mechanics rather than wizard-driven automation. Work only on authorised networks and control the impact of deauthentication frames on legitimate users.

Understanding captured wireless data

Wi-Fi assessment begins with correctly identifying the interface, channel, BSSID, stations and security mode. Capturing many frames does not guarantee useful evidence. You must know which element a technique requires, how to verify that it is present in the capture and when to collect again instead of repeatedly running an offline attack.

In the lab, record adapter configuration, mode, channel and filename before every attempt. This separates radio problems from tool-syntax errors. If collection fails, check rfkill, processes managing the interface, driver capabilities and whether the adapter remained on the intended channel.

A safe, repeatable procedure

Split each scenario into target identification, interface preparation, collection, capture validation, offline analysis and evidence. Perform active actions only where they are necessary and explicitly in scope. Deauthentication can disrupt real users, so a professional assessment requires an agreed window and stop condition.

Never combine captures from different BSSIDs or attempts. A filename containing the scenario and time, a checksum and a short channel note materially reduce the risk of attaching the wrong evidence.

Pre-exam checklist

• switch the interface between modes and restore networking manually;
• recognise whether a capture contains the material required by the selected technique;
• explain the role of every aircrack-ng command you use;
• complete a scenario without a tool that automates the whole attack;
• save the key, proof.txt, commands and readable screenshots as you work;
• keep a tested spare adapter and a driver troubleshooting procedure.

Practise on your own access point and isolated clients. This lets you observe the effects on both sides and builds the habit of minimising assessment impact.

Troubleshooting a failed scenario

Confirm the physical and radio state first: the adapter is present, supports the required mode, remains on the correct channel and receives frames from the target BSSID. Inspect the capture independently rather than assuming a large file contains useful material. Only then investigate cracking parameters and wordlists.

Record each result on one line. If channel, interface or client changes, start a new file. This identifies the point where the procedure failed and avoids “fixing” it through several uncontrolled changes.

Before the exam, rehearse from a clean system: connect the adapter, prepare the interface, collect and validate a capture, perform offline analysis and restore networking. The complete flow should be reproducible from notes without shell history.

---

A legal and repeatable laboratory

Practise only on your equipment or under explicit permission. Control channel, power and location so activity does not involve neighbouring networks. Record chipset, driver, interface mode, channel, BSSID and capture time; otherwise the same scenario can appear randomly unreliable.

Preparation combines 802.11 understanding, hardware diagnosis and clear reporting. After each exercise, reproduce the configuration, success condition and limitation. Check hardware, format and exam rules in the current OffSec Exam Guide and FAQ because community course information can age.

Sources: OffSec OSWP Exam Guide, OSWP Exam FAQ.