OSCP+ Study Plan

The classic "Try Harder" rite of passage. A free, day-by-day OSCP+ schedule built from the official PEN-200: Penetration Testing with Kali Linux syllabus, scaled to your exam date and weekly hours.

Approx. cost: $1,749–$2,749
Difficulty: ♥♥♥♥♥
Study time: about 365h
Start level: Intermediate

▶ Build my OSCP+ plan

> How long does OSCP+ take?

The plan assumes about 365 study hours. Here is how that stretches across different weekly schedules.

Hours per week	Time to finish
5 hours	about 73 weeks (16.9 months)
10 hours	about 37 weeks (8.5 months)
15 hours	about 25 weeks (5.8 months)
20 hours	about 19 weeks (4.4 months)
30 hours	about 13 weeks (3.0 months)

> OSCP+ exam format

OffSec · PEN-200: Penetration Testing with Kali Linux

23h 45m hands-on exam + 24h to submit report
3 standalone machines (20 pts each)
1 Active Directory set of 3 machines (40 pts, assumed breach)
70 / 100 points to pass
OSCP+ valid 3 years; base OSCP never expires

Official OSCP+ page ↗

> OSCP+ syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

Boot Sequence

Warm up the fundamentals before diving into PEN-200.

Linux & Windows command line refresh8h · learn
Networking fundamentals6h · learn
Scripting with Bash & Python6h · learn

PEN-200 Course

Work through the official modules and their exercises.

Course intro, learning strategy & report writing6h · learn
Information Gathering12h · learn
Vulnerability Scanning5h · learn
Introduction to Web Application Attacks8h · learn
Common Web Application Attacks12h · learn
SQL Injection Attacks10h · learn
Client-side Attacks8h · learn
Locating & Fixing Public Exploits10h · learn
Antivirus Evasion6h · learn
Password Attacks10h · learn
Windows Privilege Escalation16h · learn
Linux Privilege Escalation12h · learn
Port Redirection, SSH Tunneling & DPI Tunneling12h · learn
The Metasploit Framework6h · learn
Active Directory Introduction & Enumeration10h · learn
Attacking Active Directory Authentication12h · learn
Lateral Movement in Active Directory10h · learn
Cloud Infrastructure Modules (AWS)8h · learn
Assembling the Pieces8h · learn

Challenge Labs

Chain skills together in realistic networks.

PEN-200 Challenge Labs (network-style)40h · lab
OSCP-style Challenge Labs A / B / C36h · lab
Extra boxes: Proving Grounds / HTB40h · lab
Active Directory practice sets20h · lab

Final Boss Prep

Sharpen methodology and simulate exam day.

Consolidate methodology & cheat sheets10h · review
Report template & practice write-up6h · review
Full mock exam (24h simulation)12h · review

> Where to practise for OSCP+

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

TJ Null lists of OSCP-like boxes (HTB, PG, VulnHub) (Community)
PG Practice (OffSec practice machines) (Proving Grounds)
Retired machines and Pro Labs (Hack The Box)
Offensive Pentesting path (TryHackMe)

> OSCP+ exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

Schedule your exam and add the start time, time zone and deadline to your calendar
Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
Re-read the tool rules in the current exam guide (for example Metasploit limits and banned auto-exploitation tools)
Practice the assumed-breach Active Directory set: start from the credentials you are given
Complete a full-length timed practice run (24 hours if you can) on your exam setup
Finalize your note-taking setup and templates (see the notes starter below)
Build and review your cheat sheets and command references
Arrange time off, tell people you will be unavailable, and plan your meals ahead
Check your ID is valid and matches the name on your exam account

Machine and network

Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
Plug in your laptop and turn off sleep, updates and notifications for the exam
Test the VPN or lab connection early and know how to reconnect after a drop
Update your attack VM, take a clean snapshot and keep a spare
Install and test every tool you plan to use, and check none of them are banned
Test your screenshot hotkeys and make sure you have plenty of free disk space

Proctoring and room

Test your webcam, microphone and screen sharing on the proctoring platform
Clear your desk and room as the rules require, and tell housemates not to interrupt
Confirm what is allowed at your desk (second monitor, phone, notes, paper) and follow it exactly
Learn the rules for breaks and for leaving the camera view
Have your ID ready and know the check-in steps

During the exam

Sleep well the night before, and skip last-minute cramming
Prepare food and water, and set timers for break reminders
Read the brief and scope carefully before you touch anything
Write notes and capture proof as you go, not at the end
Time-box each target and move on when stuck. You can come back later
Stop new attacks with enough time left to verify your evidence

Report and submission

Copy your report template and fill in the easy parts (scope, methodology) while you work
Check every finding has reproducible steps and screenshots
Proofread: could someone else follow each step?
Export in the exact format and naming the exam guide requires
Submit with a buffer before the deadline and confirm it was received

Suggested exam-day rhythm

Hour 0 to 0:30. Connect, confirm the VPN, read the brief and set up your notes.
Hour 0:30 to 2. Enumerate everything first. Rank targets by points and how promising they look.
Through the day. Work in blocks of about 90 minutes with a 10-minute break after each. Time-box each target and rotate when stuck.
Meals. Eat real meals away from your desk roughly every 5 to 6 hours.
Around hour 12. Decide on a sleep window of 4 to 6 hours. A rested brain spots what a tired one misses.
Last 3 hours. Stop new attacks unless you are very close. Verify proof, collect screenshots and outline the report.
After the hands-on part. Write the report in one focused block, proofread, and submit with a buffer before the deadline.

▶ Open the interactive OSCP+ exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed OSCP+ with PWN PATH

No OSCP+ debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Frequently asked questions

How long does it take to prepare for OSCP+?

PWN PATH builds the OSCP+ plan on about 365 study hours. At 10 hours a week that is roughly 37 weeks, and at 20 hours a week roughly 19 weeks. Your own timeline depends on how much of the material you already know.

What is the OSCP+ exam like?

23h 45m hands-on exam + 24h to submit report. 3 standalone machines (20 pts each). 1 Active Directory set of 3 machines (40 pts, assumed breach). 70 / 100 points to pass. OSCP+ valid 3 years; base OSCP never expires.

How hard is OSCP+?

We rate OSCP+ 3 out of 5. It suits anyone who wants the certification most recruiters know by name. Solid Linux, Windows and networking. Some lab practice on other platforms first is strongly advised.

How much does OSCP+ cost?

OffSec bundles start around $1,749 (course, 90 days of labs, one exam attempt); Learn One is about $2,749 per year with two attempts. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for OSCP+?

Start with the "Boot Sequence" phase: Linux & Windows command line refresh, Networking fundamentals, Scripting with Bash & Python. The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for OSCP+?

Solid Linux, Windows and networking. Some lab practice on other platforms first is strongly advised.

What should I do the week before the OSCP+ exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and VPN or lab connection, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the OSCP+ exam?

Hour 0 to 0:30: Connect, confirm the VPN, read the brief and set up your notes. Hour 0:30 to 2: Enumerate everything first. Rank targets by points and how promising they look. Through the day: Work in blocks of about 90 minutes with a 10-minute break after each. Time-box each target and rotate when stuck. Meals: Eat real meals away from your desk roughly every 5 to 6 hours.

What should I take after OSCP+?

Common next steps are OSEP, OSWE, CRTO, OSED. See the roadmap to compare them.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Good stepping stones before OSCP+:

Where it leads: