OSED Study Plan

Write your own working exploits from scratch, no Metasploit allowed. A free, day-by-day OSED schedule built from the official EXP-301: Windows User Mode Exploit Development syllabus, scaled to your exam date and weekly hours.

Approx. cost
$1,749–$2,749
Difficulty
♥♥♥♥♥
Study time
about 192h
Start level
Advanced

▶ Build my OSED plan

> How long does OSED take?

The plan assumes about 192 study hours. Here is how that stretches across different weekly schedules.

Hours per weekTime to finish
5 hoursabout 39 weeks (9.0 months)
10 hoursabout 20 weeks (4.6 months)
15 hoursabout 13 weeks (3.0 months)
20 hoursabout 10 weeks (2.3 months)
30 hoursabout 7 weeks (1.6 months)

> OSED exam format

OffSec · EXP-301: Windows User Mode Exploit Development

  • 48-hour hands-on exam building working exploits against several targets
  • Custom shellcode and mitigation bypasses required, no public exploit code
  • 24h to submit a professional report
  • Assembly, C and Windows internals experience strongly recommended
  • OSED certification does not expire

Official OSED page ↗

> OSED syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

Debugging & Assembly Warm-up

Get fluent in the tools before writing exploits with them.

  • x86 assembly & Windows internals refresh10h · learn
  • WinDbg & Immunity Debugger fundamentals8h · learn

EXP-301 Course

Work through the official modules and their exercises.

  • Exploit Development Concepts6h · learn
  • Exploit Mitigation Bypass I: Stack Cookies8h · learn
  • Exploit Mitigation Bypass II: SEH Overwrites8h · learn
  • Overcoming Space Restrictions: Egghunters8h · learn
  • Custom Shellcode Creation I10h · learn
  • Custom Shellcode Creation II10h · learn
  • Reverse Engineering for Bugs (fuzzing)10h · learn
  • Stack Overflows and DEP Bypass12h · learn
  • Stack Overflows and ASLR Bypass10h · learn
  • Format String Attacks8h · learn

Challenge Labs

Build exploits end to end under exam-like conditions.

  • Exam-style exploit dev challenges40h · lab
  • Reproduce disclosed Windows N-day exploits16h · lab

Final Boss Prep

A reusable toolkit and a full-length dry run.

  • Build a reusable ROP/shellcode toolkit8h · review
  • Write a full report from one challenge6h · review
  • Timed 48-hour mock exam14h · review

> Where to practise for OSED

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

> OSED exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

  • Schedule your exam and add the start time, time zone and deadline to your calendar
  • Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
  • Keep your ROP and shellcode toolkit ready and tested
  • Keep a clean debugging VM snapshot
  • Complete a full-length timed practice run (48 hours if you can) on your exam setup
  • Finalize your note-taking setup and templates (see the notes starter below)
  • Build and review your cheat sheets and command references
  • Arrange time off, tell people you will be unavailable, and plan your meals ahead
  • Check your ID is valid and matches the name on your exam account

Machine and network

  • Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
  • Plug in your laptop and turn off sleep, updates and notifications for the exam
  • Test the VPN or lab connection early and know how to reconnect after a drop
  • Update your attack VM, take a clean snapshot and keep a spare
  • Install and test every tool you plan to use, and check none of them are banned
  • Test your screenshot hotkeys and make sure you have plenty of free disk space

Proctoring and room

  • Test your webcam, microphone and screen sharing on the proctoring platform
  • Clear your desk and room as the rules require, and tell housemates not to interrupt
  • Confirm what is allowed at your desk (second monitor, phone, notes, paper) and follow it exactly
  • Learn the rules for breaks and for leaving the camera view
  • Have your ID ready and know the check-in steps

During the exam

  • Sleep well the night before, and skip last-minute cramming
  • Prepare food and water, and set timers for break reminders
  • Read the brief and scope carefully before you touch anything
  • Write notes and capture proof as you go, not at the end
  • Time-box each target and move on when stuck. You can come back later
  • Stop new attacks with enough time left to verify your evidence

Report and submission

  • Copy your report template and fill in the easy parts (scope, methodology) while you work
  • Check every finding has reproducible steps and screenshots
  • Proofread: could someone else follow each step?
  • Export in the exact format and naming the exam guide requires
  • Submit with a buffer before the deadline and confirm it was received

Suggested exam-day rhythm

  • Hour 0 to 1. Connect, confirm the VPN, read the brief, set up your notes and plan the first day.
  • Day 1. Enumerate everything, then go after the most promising targets in 90-minute blocks with short breaks.
  • 1 sleep window. Plan 6 or more hours each night. Write down where you stopped and your next three ideas before you sleep.
  • Meals and movement. Eat proper meals away from the desk and walk outside at least once a day.
  • Last 5 hours. Stop new attacks, verify evidence and outline the report while everything is fresh.
  • After the hands-on part. Write the report in focused blocks, proofread, and submit with a buffer before the deadline.

▶ Open the interactive OSED exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed OSED with PWN PATH

No OSED debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Frequently asked questions

How long does it take to prepare for OSED?

PWN PATH builds the OSED plan on about 192 study hours. At 10 hours a week that is roughly 20 weeks, and at 20 hours a week roughly 10 weeks. Your own timeline depends on how much of the material you already know.

What is the OSED exam like?

48-hour hands-on exam building working exploits against several targets. Custom shellcode and mitigation bypasses required, no public exploit code. 24h to submit a professional report. Assembly, C and Windows internals experience strongly recommended. OSED certification does not expire.

How hard is OSED?

We rate OSED 4 out of 5. It suits people who love assembly, debuggers and understanding how memory corruption works. Assembly, C and Windows internals experience.

How much does OSED cost?

OffSec bundles start around $1,749 (course, 90 days of labs, one exam attempt); Learn One is about $2,749 per year with two attempts. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for OSED?

Start with the "Debugging & Assembly Warm-up" phase: x86 assembly & Windows internals refresh, WinDbg & Immunity Debugger fundamentals. The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for OSED?

Assembly, C and Windows internals experience.

What should I do the week before the OSED exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and VPN or lab connection, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the OSED exam?

Hour 0 to 1: Connect, confirm the VPN, read the brief, set up your notes and plan the first day. Day 1: Enumerate everything, then go after the most promising targets in 90-minute blocks with short breaks. 1 sleep window: Plan 6 or more hours each night. Write down where you stopped and your next three ideas before you sleep. Meals and movement: Eat proper meals away from the desk and walk outside at least once a day.

What should I take after OSED?

Common next steps are OSEE. See the roadmap to compare them.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Good stepping stones before OSED:

OSCP+

Where it leads:

OSEE

More in exploit development:

OSEE

Not sure OSED is right for you? Take the one-minute cert quiz.