OSCP Prep Roadmap: A Realistic Study Plan

The OSCP exam changed significantly in late 2024: Active Directory is no longer optional, and the whole exam runs on an "assumed compromise" model for the AD portion — you start with a standard domain user's credentials and work toward full domain compromise, rather than needing an initial-access exploit for every machine. If your prep material or a guide you're reading predates that change, some of it is outdated.

This assumes you've already been through the general ethical hacking roadmap — OSCP is not where you learn Linux fundamentals or basic enumeration for the first time.

What the exam actually tests

• 3 standalone machines — 60 points total, 20 each (10 for initial access, 10 for privilege escalation)
• 1 Active Directory set of 3 machines — 40 points total (10, 10, and 20 for the domain controller), starting from an assumed-compromise foothold
• 70 points needed to pass, out of 100
• 23 hours 45 minutes for the practical exam, then 24 hours to write and submit your report

That last part matters more than people expect: a technically successful exam with a poorly written report can still fail you. Report writing is a real, gradeable skill here, not paperwork.

How to structure your prep

1. Go through the PEN-200 course material fully before touching extra boxes. It's tempting to skip straight to practice labs, but the course covers technique categories (buffer overflows are no longer mandatory, but enumeration methodology, AD attack chains, tunneling, and privesc patterns are all covered deliberately and in an order that builds on itself).
2. Practice AD attack chains specifically, not just individual machines. The exam's AD set is a chain, not three unrelated boxes — Kerberoasting, lateral movement, and abusing trust relationships need to click together, not just work in isolation on a single practice VM.
3. Do untimed practice first, then add time pressure later. Learning under a countdown and learning the technique are two different skills — conflating them early just adds stress without building competence.
4. Use Proving Grounds Practice and HackTheBox's retired boxes as your main practice pool. Both are built by/aligned with the same skill expectations OSCP tests. See Labs for methodology on approaching a box rather than just grinding through as many as possible.
5. Practice your enumeration and privesc checklist until it's automatic. See the script privesc checklist for the Linux side — you should be running through a process like this without having to think about what to check next, because the clock is running.
6. Write practice reports, not just practice exploits. Time-box a report for a box you've already rooted, as if it were exam day. Most people who fail on a technical pass still lose it here by running out of report-writing time they didn't budget for.

Timeline

Realistic range: 2-4 months of dedicated prep if you're already comfortable with the fundamentals roadmap above, longer if you're building those fundamentals at the same time. This varies a lot by how much time you can actually put in per week — treat any fixed "X weeks" claim you see elsewhere skeptically.

Common mistakes

• Treating the course material as sufficient on its own. It's the foundation, not the whole prep — you need volume of practice on machines the course didn't cover.
• Ignoring AD until close to the exam. It's 40% of the exam now, not an optional bonus section — start it early, not last.
• Not practicing under time pressure at all until exam day. The clock changes how you work; find that out in practice, not during the real attempt.
• Underestimating the report. Budget real time for it in your practice, not just on exam day.

Next step

If you haven't built a session workflow yet, set one up before exam day — the exam is not the time to be improvising your working setup for the first time.