OSCP+ Update Exam Still Worth it on 2026?
Take this certification indicate you preapare for mentality
Hello — after a long hiatus from blogging, I’ve decided to write a review of the OSCP+ certification this time. I’d like to mention that this certification is Offsec’s entry-level professional certification. To earn this certification, you can visit portal.offsec.com and purchase the Pen 200 package right away. You have two options at the same price : package 1 includes 3 months of OSCP modules and challenges plus one exam attempt, while Package 2 includes two exam attempt vouchers. The OSCP lab consists of one Active Directory cluster comprising three machines, including a domain controller, and features three standalone Linux or Windows challenges
Here’s a little background, I purchased this certification in August 2026. I had previously taken a similar exam from Hack The Box — the CPTS. I felt that the modules provided during my CPTS preparation were sufficient and covered everything I needed, so I spent the two months of the course working on the Pen 200 OSCP challenges included in the first package and subscribing to PG Practice to familiarize myself with Offsec’s machines. The difference I noticed when working on Offsec machines compared to HTB was in the depth of the enumeration and the exploitation techniques. Offsec machines don’t require highly complex exploits like those on HTB, but to successfully exploit them, we must perform in-depth enumeration and gather a lot of information to piece together into an attack strategy. Two months after purchasing my OSCP package, I immediately scheduled my exam for September. While preparing, I also diligently took notes on every machine I worked on — whether I finished it or not, I still recorded it. Furthermore — whether it proves useful or not — when you have an OSCP package that includes modules and challenges, you’ll receive three retired OSCP exam packages from Offsec. I worked through all three repeatedly, up to 6–7 times, to explore different solution approaches and to familiarize myself with the Offsec Active Directory environment.
Exam Day: The OSCP exam is proctored live with the camera on and all active screens shared. The exam session is divided into two parts: the pre-exam and the exam itself. During the pre-exam, preparations are made — such as running scripts from Offsec to prevent cheating and conducting identity verification to ensure no cheating occurs or that a different person takes the exam. Next, my VPN credentials were finally sent via email, and I began the exam. Of course, what I had in mind about this exam was that it lasted 24 hours, and we were given challenges to complete within that time. For the first 4 hours, I had 0 points on the AD machine. It was stressful, and I couldn’t perform privilege escalation on the first machine. I took a break to calm down and eat. After returning, I tried working on a standalone Windows machine, and finally got my first 10 flags at the 7-hour mark, followed by a privilege escalation 30 minutes later. My total score was 20 after the first 8 hours. After that, I took a break. When I returned in the late afternoon, I obtained a local flag on another Windows machine but was unable to achieve privilege escalation. Then I moved on to a Linux machine and obtained a local flag after 1 hour of enumeration; it took another 2 hours before I finally achieved the root privilege escalation flag. My total flags stood at 50 after the first 11 hours. After that, I took a fairly long break and came back. Then I thought of an AD service, so I tried to exploit it — and it turned out I successfully gained admin access and an additional 10 flags, bringing my total to 60 flags at the 15-hour mark. I needed 10 more flags to pass, but I didn’t manage to get them by the end. My first attempt failed.
Comeback Stronger: After failing my first exam, I tried to review my mistakes by reading my notes from the previous exam. Eventually, I concluded that I needed to improve the methodology I was using, because if I relied solely on muscle memory, I would just feel and guess — even though that might actually be the right approach. An example of the methodology I applied was taking action when I received information without guessing and writing down everything I discovered. Finally, after a 4-week cooling-off period (Offsec’s rule before being allowed to retake the exam) and working through several exercises from Hack Smarter, I scheduled the exam for October — four weeks after my first attempt. This time, I approached it with a different mindset, more effective preparation (rather than just focusing on quantity), and better sleep.
The day of the retake exam arrived: I approached it much more calmly than the first exam and treated it as just another machine challenge as usual. As a result, I successfully pwned the AD machine within 3 hours, followed by earning the points needed to qualify in the next 3 hours, so within the first 6 hours I had earned enough points to qualify. After that, I felt tired — perhaps because my goal of seeing if I could pass this exam had already been achieved. I tried to reach 100 points, but I ended up just at the passing threshold. That’s okay — I gave it my best shot and proved myself.
The day after the exam, I submitted a detailed and thorough report, and the next day I finally received a message saying I had passed the exam. Here are the takeaways from my experience:
- The OSCP exam requires a lot of enumeration, but the exploitation level isn’t difficult.
- The OSCP will test your time management skills from preparation through the exam.
Here are some tips if you want to take the OSCP:
- Sign up for a bundle that includes a course if you have no prior experience in a similar field.
- Work through the challenge lists from Kusanagi, whether from “Hack Smarter” or other circulating lists.
- Develop a methodology that works for you so you don’t have to guess, stay on the right track, and avoid wasting time on dead ends.
Here are some great links for preparation in addition to the OSCP course and PG practice
- Lain kusanagi practice exam on hacksmarter: https://www.hacksmarter.org/paths/c7380cbd-bdb7-4cf8-a6bc-0976fa49c4c1
- Lain Kusanagi OSCP Prepare update list: https://docs.google.com/spreadsheets/d/18weuz_Eeynr6sXFQ87Cd5F0slOj9Z6rt/edit?gid=487240997#gid=487240997
Finally, I want to say: don’t underestimate the OSCP — even though some people say it’s simpler than other certifications, you should still prepare thoroughly. That’s all for this review — thank you!
Get Anugrah Gilang Ramadhan’s stories in your inbox
Join Medium for free to get updates from this writer.
#OSCP #OSCP+ #EXAM
