What Is OSCP Certification? (Plus How-to Guide)

By Indeed Editorial Team

Published 19 July 2022

The Indeed Editorial Team comprises a diverse and talented team of writers, researchers and subject matter experts equipped with Indeed's data and insights to deliver useful tips to help guide your career journey.

Information security professionals may apply various techniques, such as penetration testing, to optimise the security of an information system. Certifications such as OSCP can help you show your skills and knowledge as a penetration tester. Learning about OSCP certification can help you prepare to take a course and gain the certification to advance your career. In this article, we discover OSCP certification, highlight the benefits of this certification, outline key topics and discuss how to get the OSCP certification.

What is OSCP certification?

An OSCP certification is a designation from Offensive Security (OffSec) that validates your professional skills and knowledge in penetration testing using tools on Kali Linux. Kali is an open-source distribution that allows you to assess the security features of your systems. It runs on the Debian operating system, which uses the Linux kernel. The certification also shows that you can provide professional reports on your findings after conducting penetration testing. IT professionals with OSCP training and certification may perform various tasks, including:

deploying tunnelling techniques to firewalls
analysing correct change cross-compile and port public exploit code
using information-gathering techniques to identify a target that may use or run on various operating systems and services
writing the basic script and using basic tools to execute the penetration testing process
conducting client-side and remote-side attacks
identifying and exploiting multiple vulnerabilities in web applications
employing creative problem solving and lateral thinking

Benefits of getting OSCP certification

An OSCP certification may offer various benefits, including information security knowledge and access to more job opportunities. Other benefits of OSCP certification may include:

gaining certification with international recognition for your knowledge and skills in information security matters
improving your service portfolio
helping sustain a business by managing information security risks
gaining an understanding of different systems and protocols, including the strengths and vulnerabilities
becoming an expert in vulnerability exploitation and penetration testing processes

Key topics and skill areas of OSCP certification

OSCP certification training covers information security and technology topics to improve your penetration testing or ethical hacking proficiency. Some of the key topics in the OSCP certification course are:

passive information-gathering
file transfers
active directory attacks
password attacks
privilege escalation
web application attacks
active information gathering
bash scripting
practical tools
buffer overflows for different operating systems
client-side attacks
antivirus evasion
active directory attacks
port redirection and tunneling
the metasploit framework
PowerShell empire
command line fun

How to get an OSCP certification

The following steps can help you get your OSCP certificate:

1. Understand the OSCP exam and certification requirements

The OSCP exam doesn't have any work experience or educational prerequisites. OffSec, the certification provider, suggests the following to help candidates complete the course efficiently and improve their chances of success in the exam:

reasonable understanding of TCP IP networking
solid understanding of Linux
competent knowledge of bash scripting using Perl a Plus or Python

2. Pay for the course and exam

OSCP certification training is available in packages with different prices. The minimum package may be around $1100 and features the exam voucher and 30 days of access to a lab environment. Other packages also cover the exam voucher and options to increase the lab time by 15, 30, 60 or 90-day increments.

3. Prepare for the OSCP exam

The OSCP certification course is available online or in-person for months. In-person classes last up to five days and provide access to the lab environment for the time you pay. After completing the course, you have at least 30 days to study and conduct lab practice. You may require longer if you have little background in penetration testing. Candidates have up to 90 days to take the exams after completing the course. Ensure you understand all the topics in the OSCP certification course.

4. Take the OSCP certification exam

The OSCP certification exam simulates a live network in a virtual private network with some vulnerable machines. You have 23 hours and 45 minutes to finish the exam. It's up to you to accommodate eating, drinking, sleeping and taking breaks. After completing the exam, you have 24 hours to upload the documentation. The documentation you provide as part of the exam includes a professional report. This report describes your exploitation process for all targets. The test reports include all steps, commands you issued and the console output.

Ensure your documentation is thorough to enable a reader with technical competency to replicate your processes step by step. OffSec administers the exam using a virtual connection with chat or webcam without audio and screen sharing. The exam provides five machines for candidates to conduct penetration testing and submit reports. You get a maximum of 60 points for successfully compromising three independent machines and 40 points for compromising two client machines, which makes 100 points. Candidates require at least 70 points to pass the exam.

5. Retake the exams to pass or get a score you want

You can retake the exam if you cannot meet the pass mark or want to improve your score. The exam retake policies depend on the package you purchase. Here are some guidelines on scheduling OSCP certification exam retakes:

Schedule the retake at least six weeks from the previous exam date in your first retake attempt.
Sit for your retake at least eight weeks after the exam date of the first retake attempt.
Schedule a retake at least 12 weeks from the exam date of your second retake attempt.

Jobs that might require OSCP certification

The OSCP certification may enable you to qualify for mid-level to high-level positions relevant to information security. Some positions that may require OSCP certification include:

1. Security analyst

National average salary: $6,584 per month

Primary duties: A security analyst is an information security professional who designs and implements systems to set security standards and protect computer networks. They also monitor networks to identify security issues, investigate cyber security incidents, document breaches and collaborate with the security team to perform tests to identify network vulnerabilities. Information security analysts help fix the vulnerabilities they detect, perform penetration testing and help instal software. They also verify the security of third-party vendors. An information security analyst researches the latest security enhancements, trends and standards and recommends strategies to help improve safety.

2. Penetration tester

National average salary: $7,457 per month

Primary duties: A penetration tester is an information security professional who analyses computer networks or systems to find weaknesses and protect digital assets. They may work individually or in teams to conduct penetration testing and develop methods to improve it. Penetration testers analyse the penetration test results and recommend actions to eliminate security weaknesses.

3. Lead security analyst

National average salary: $8,561 per month

Primary duties: A lead security analyst is an information technology expert who provides expert advice to help improve a company's security systems. They may participate in information security audits to ensure technical compliance with elements of industry frameworks and government policies. Lead security analysts collaborate with other IT risk and information security professionals to ensure business excellence. They may also meet stakeholders to research and maintain a risk rating table.

Lead security analysts may mentor and train other staff on security measures. After implementing a security system, lead security analysts provide post-implementation support to customers to help them solve any issues. They also apply data visualisation techniques to present information from the security analysis. Lead security analysts help translate business requirements into technical specifications.

4. Software architect

National average salary: $9,467 per month

Primary duties: A software architect is an information technology professional who uses computer code to design and develop software applications. They may determine a project's technical specifications, create technical blueprints, plan different features, integrate them into a functioning system and edit code to improve systems. Software architects also troubleshoot software systems and resolve issues, train and supervise development team members and maintain good working relationships with other professionals, such as product managers or marketing managers.

Please note that none of the companies, institutions or organisations mentioned in this article are affiliated with Indeed. Salary figures reflect data listed on Indeed Salaries at time of writing. Salaries may vary depending on the hiring organisation and a candidate's experience, academic background and location.