OSWP Study Plan

Break WEP, WPA and WPA2 networks over the air. A free, day-by-day OSWP schedule built from the official PEN-210: Foundations of Wireless Network Attacks syllabus, scaled to your exam date and weekly hours.

Approx. cost
$450–$1,749
Difficulty
♥♥♥♥♥
Study time
about 76h
Start level
Beginner

▶ Build my OSWP plan

> How long does OSWP take?

The plan assumes about 76 study hours. Here is how that stretches across different weekly schedules.

Hours per weekTime to finish
5 hoursabout 16 weeks (3.7 months)
10 hoursabout 8 weeks (1.8 months)
15 hoursabout 6 weeks (1.4 months)
20 hoursabout 4 weeks (0.9 months)
30 hoursabout 3 weeks (0.7 months)

> OSWP exam format

OffSec · PEN-210: Foundations of Wireless Network Attacks

  • 4-hour hands-on exam against a live wireless network
  • Recover keys and demonstrate a full compromise, then submit a report
  • Requires a compatible monitor-mode & injection-capable wireless adapter
  • 90 days of lab access included with the course
  • OSWP certification does not expire

Official OSWP page ↗

> OSWP syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

RF & 802.11 Fundamentals

Understand the airwaves before you attack them.

  • Wireless networking fundamentals6h · learn
  • Linux wireless tooling & monitor mode4h · learn

PEN-210 Course

Work through the official modules and their exercises.

  • The Aircrack-ng Suite4h · learn
  • Wireless Network Sniffing4h · learn
  • Bypassing WLAN Authentication5h · learn
  • Attacking WEP Encryption5h · learn
  • Attacking WPA/WPA2 Personal Networks8h · learn
  • Attacking WPA/WPA2 Enterprise Networks8h · learn
  • Attacking Access Points and Clients6h · learn

Range Time

Rep every attack until it is muscle memory.

  • Rebuild the lab attacks from memory8h · lab
  • Practice against varied AP configurations8h · lab

Final Boss Prep

A quick, sharp review before exam day.

  • Per-encryption attack cheat sheet4h · review
  • Timed mock exam6h · review

> Where to practise for OSWP

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

> OSWP exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

  • Schedule your exam and add the start time, time zone and deadline to your calendar
  • Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
  • Test your wireless adapter in monitor mode and with packet injection
  • Check the adapter requirements in the exam guide
  • Complete a full-length timed practice run (4 hours if you can) on your exam setup
  • Finalize your note-taking setup and templates (see the notes starter below)
  • Build and review your cheat sheets and command references
  • Arrange time off, tell people you will be unavailable, and plan your meals ahead
  • Check your ID is valid and matches the name on your exam account

Machine and network

  • Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
  • Plug in your laptop and turn off sleep, updates and notifications for the exam
  • Test access to the exam platform and check any browser or device requirements
  • Install and test every tool you plan to use, and check none of them are banned
  • Test your screenshot hotkeys and make sure you have plenty of free disk space

Proctoring and room

  • Test your webcam, microphone and screen sharing on the proctoring platform
  • Clear your desk and room as the rules require, and tell housemates not to interrupt
  • Confirm what is allowed at your desk (second monitor, phone, notes, paper) and follow it exactly
  • Learn the rules for breaks and for leaving the camera view
  • Have your ID ready and know the check-in steps

During the exam

  • Sleep well the night before, and skip last-minute cramming
  • Prepare food and water, and set timers for break reminders
  • Read the brief and scope carefully before you touch anything
  • Write notes and capture proof as you go, not at the end
  • Time-box each target and move on when stuck. You can come back later
  • Stop new attacks with enough time left to verify your evidence

Report and submission

  • Copy your report template and fill in the easy parts (scope, methodology) while you work
  • Check every finding has reproducible steps and screenshots
  • Proofread: could someone else follow each step?
  • Export in the exact format and naming the exam guide requires
  • Submit with a buffer before the deadline and confirm it was received

Suggested exam-day rhythm

  • First 10 minutes. Connect, read the brief, set up your notes and start a timer.
  • Minutes 10 to 210. Split the time by target or application before you start, and stick to each slice. Move on when you hit the limit.
  • Every hour. Stand up, drink water and look away from the screen for a couple of minutes.
  • Last 30 minutes. Stop new attacks. Confirm your evidence, screenshots and answers are saved.

▶ Open the interactive OSWP exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed OSWP with PWN PATH

No OSWP debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Frequently asked questions

How long does it take to prepare for OSWP?

PWN PATH builds the OSWP plan on about 76 study hours. At 10 hours a week that is roughly 8 weeks, and at 20 hours a week roughly 4 weeks. Your own timeline depends on how much of the material you already know.

What is the OSWP exam like?

4-hour hands-on exam against a live wireless network. Recover keys and demonstrate a full compromise, then submit a report. Requires a compatible monitor-mode & injection-capable wireless adapter. 90 days of lab access included with the course. OSWP certification does not expire.

How hard is OSWP?

We rate OSWP 1 out of 5. It suits anyone who wants a short, focused wireless credential. Basic networking. A monitor-mode capable adapter is required.

How much does OSWP cost?

Pricing has varied by plan over time. Confirm the current price with OffSec. You also need a compatible wireless adapter. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for OSWP?

Start with the "RF & 802.11 Fundamentals" phase: Wireless networking fundamentals, Linux wireless tooling & monitor mode. The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for OSWP?

Basic networking. A monitor-mode capable adapter is required.

What should I do the week before the OSWP exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and exam platform access, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the OSWP exam?

First 10 minutes: Connect, read the brief, set up your notes and start a timer. Minutes 10 to 210: Split the time by target or application before you start, and stick to each slice. Move on when you hit the limit. Every hour: Stand up, drink water and look away from the screen for a couple of minutes. Last 30 minutes: Stop new attacks. Confirm your evidence, screenshots and answers are saved.

What should I take after OSWP?

Common next steps are CWPE. See the roadmap to compare them.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Where it leads:

CWPE

More in wireless:

CWPE

Not sure OSWP is right for you? Take the one-minute cert quiz.