thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

OffSec · Cybersecurity · Expert

OffSec Experienced Penetration Tester (OSEP) exam guide

Exam PEN-300 / OSEP

The OffSec Experienced Penetration Tester (OSEP) proves you can breach hardened corporate networks: client-side attacks, antivirus and application whitelisting evasion, Active Directory abuse and lateral movement. It is the natural step after OSCP+ for red team work, and passing it also renews the OSCP+ designation.

QuestionsSee official page
Time limit2880 minutes
Passing score100 points or access to the final objective (secret.txt)
Exam fee$1,749 USD
Valid forSee official page
DeliveryOnline, proctored by OffSec over VPN

Format: 48-hour proctored practical against a simulated corporate network, followed by a report. Fee note: Course + Cert Bundle with 90 days access and 1 attempt; Learn One $2,749/year with 2 attempts.

Who it's for

OSCP+ holders and experienced pen testers moving into red teaming and adversary simulation.

What the exam covers

Client-side code execution (Office, JScript)—
Antivirus and AMSI evasion—
Application whitelisting bypass—
Process injection and migration—
Active Directory exploitation—
Lateral movement in Windows and Linux—
Bypassing network filters—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None formal; PEN-200/OSCP+ is highly recommended.

Recommended: Kali Linux fluency, Bash/Python/PowerShell scripting, AD fundamentals; C# is a plus.

Keeping it active

None; OSEP does not expire. Passing it also renews an OSCP+ '+' designation.

Skills & careers

Skills it validates

  • Crafting payloads that evade AV and AMSI
  • Bypassing AppLocker and constrained language mode
  • Process injection techniques
  • Kerberos delegation and AD abuse
  • Lateral movement across Windows and Linux
  • Writing custom C# tooling

Job roles

Red Team OperatorSenior Penetration TesterAdversary Emulation SpecialistOffensive Security EngineerPurple Team Engineer

Where it fits in your path

You are here

OffSec Experienced Penetration Tester (OSEP)

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Month 1: PEN-300 modules on client-side execution, process injection and evasion; build your own loaders in C#.
  2. Month 2: AD exploitation and lateral movement modules.
  3. Month 3: Complete the six challenge labs end to end without hints.
  4. Month 3: Book the exam once you can finish challenge labs inside 24 hours.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Prepare and test your payloads and loaders against Defender before the exam.
  • Map the network carefully; there are multiple paths to the objective.
  • Document as you go; the report must show how you reached each flag.
  • Use the 48 hours with planned rest; exhaustion causes most mistakes.

Key terms for this exam

All 2 terms Study with thinQcards™

Frequently asked questions

How much does OSEP cost?

The Course + Cert Bundle is $1,749; Learn One is $2,749/year with two attempts.

Does OSEP expire?

No.

Do I need OSCP+?

It is not formally required but strongly recommended.

How long is the exam?

48 hours plus 24 hours to write the report.

Does OSEP renew OSCP+?

Yes, passing OSEP before your OSCP+ expires keeps the '+'.

Official page: www.offsec.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.