Free OSCP+ Course: The Full 2-Hour Video Course and How to Use It

The short answer

Yes, there is a free OSCP^® course: our Full OSCP Course on YouTube, 2 hours and 5 minutes of video training with more than 120,000 views. It covers the OSCP+^™ (OSCP Plus) exam structure, an Active Directory methodology with a full domain takeover, post-exploitation, Windows privilege escalation, pivoting and tunneling, initial access, and exam-day habits. You can watch it further down this page.

OffSec's own course for the exam, PEN-200, is paid. On offsec.com it starts at $1,749 for 90 days of access and one exam attempt.

The mistake to avoid with any free course is treating the video as the preparation. Two hours of watching gives you a method and an order of operations. Passing comes from running that method on machines you haven't seen, many times, with the walkthrough closed. This post shows what each part of the video teaches, how to turn it into practice, and what a 2-hour course leaves out.

We're Hacker Blueprint. Our instructor holds the OSCP, our academy has more than 600 students, and around 7,000 people have claimed our prep materials. The free video is a 2-hour preview of our 30+ hour course for OSCP prep.

What the free OSCP+ course covers

The video is the first one in our OSCP Exam Prep Guide playlist, uploaded on May 6, 2025. The chapters show under the player, so here is what each part teaches and what to take from it.

The exam map (0:00 to 7:20). What the OSCP costs and includes, why employers value it, and how the exam is built: three standalone machines and an Active Directory set of three, two clients and a domain controller. The useful part is the reasoning about what the AD set is likely to test, given that you start it with domain credentials. One correction: the video explains the 70-point pass mark. That rule still applies to exams that start before December 1, 2026 at 08:00 GMT. Exams from then on are scored on a scale from 100 to 500, and 400 passes. We cover the change in OSCP+ scaled scoring explained.

Active Directory, start to finish (7:20 to 43:02). First the methodology: what changes when you begin with credentials, the attacks you have to know cold (AS-REP roasting, Kerberoasting, hash dumping, pass-the-hash, BloodHound), and checking your user's privileges for a quick escalation. Then, from 11:43, a full walkthrough of a practice domain controller, from no credentials to domain admin. It includes anonymous share access, building a username list from documents, roasting and cracking hashes, testing every new credential against every service, and a password left in a script. The walkthrough starts without credentials, a step the exam's AD set skips, so treat those first minutes as extra enumeration practice.

Post-exploitation (43:02). What to do once you own a host: dump hashes and credentials from everywhere they're stored, remotely when you can, turn the output into clean user and hash lists, then spray them across every host and protocol. The video keeps returning to one point: a credential that gives you no shell over SMB can still give you one over WinRM or WMI, so test it everywhere.

Windows privilege escalation (55:26). A blind run on a Windows host. It covers checking privileges, running PowerUp first for short output and winPEAS after it for more, moving tools across with an SMB share, and exploiting an unquoted service path to SYSTEM. Watch for one detail: accesschk reported the service as locked down when the user could in fact stop and start it, and the video shows how to confirm what you can do with a service before you give up on it.

Pivoting and tunneling (1:14:57 to 1:38:59). Why it matters (OffSec's exam FAQ says there may be pivoting on the AD machines), then two demos with Chisel and proxychains. The first finds hosts from inside a compromised machine and reaches an internal web app through a SOCKS tunnel. The second starts from a foothold that is missing wget, curl and netcat, so the tools have to get across another way.

Initial access (1:38:59). The habits that decide standalones: rescan every host at least twice because lab environments can be unstable, fingerprint every open port, scan UDP, fuzz for content, and keep Burp running in the background. Then a practice box goes from an odd web port to a public exploit that needs fixing before it works, and on to a shell.

Exam tips (1:57:18). Scan with more than one tool, keep every binary you need in one folder, keep copy-paste commands in your notes, know the allowed and banned tools, and take screenshots as you go, because the lab is gone by the time you write the report.

Free and paid OSCP courses compared

Search for a free OSCP course and you'll find plenty of pages that promise one, then link to a list of platforms or to a paid course. Here's what is free, and what the paid options cost as of October 29, 2026.

The OffSec prices come from the PEN-200 page. Whichever course you study with, the exam attempt is bought from OffSec.

PEN-200 (Penetration Testing with Kali Linux) is the course OffSec, the company that runs the exam, builds for it. It comes with 9 challenge labs, three of which are "designed to closely replicate the OSCP+ exam environment." Its exam FAQ also says anything in the course material can be on the exam, so PEN-200 is the reference for what's in scope.

A course like ours teaches one method, in the order you use it on a machine. You can combine the two, using OffSec's labs to practice and our checklist to work each machine.

Who the free course is for

It suits you if:

• You've done some boxes on Hack The Box, TryHackMe or Proving Grounds and want to see one complete method across every part of the exam.
• You're working through PEN-200 and want a second explanation of Active Directory, post-exploitation or pivoting.
• Active Directory is the part that worries you. The 48 minutes from 7:20 to 55:26 are AD and what you do after a compromise.
• You want to see how we teach before you start the free trial of the full course.

It's too early if the terminal still slows you down. The video moves at the pace of someone who has done this many times, and it assumes Linux, networking and Kali basics. OffSec's recommended background for PEN-200 makes a good self-check: TCP/IP networking, reasonable Windows and Linux administration, and basic Bash or Python scripting. If those are shaky, start with the free beginner paths in our academy (Linux, Python, virtual machines and offensive security), then come back to this video. You don't need a beginner certification first, though our guide to the eJPT or Security+ before the OSCP covers when one helps.

How to study with the free OSCP course

Watching all two hours in one sitting is the easy option and the least useful one. Split the video by part and practice each part the same day.

1. Watch the exam map first (0:00 to 7:20), with our OSCP+ roadmap open for the full study plan.
2. Take the AD block in two sittings. Watch the methodology and walkthrough (7:20 to 43:02), then post-exploitation (43:02 to 55:26). If terms like Kerberoasting or pass-the-hash are new to you, watch the first chapters of our free 5+ hour Active Directory course before going further.
3. Run a free AD chain cold. Each of our free AD chains starts from an assumed breach with domain credentials, the same way the exam's AD set does, and runs as three VMs on your own machine: two Windows clients and a domain controller. Check the RAM and processor the chains need before you download one. Set a time limit and keep the walkthrough closed until you stop. Our OSCP+ Active Directory guide has the step-by-step loop to follow, and our free OSCP labs guide shows where to open each walkthrough when you're stuck.
4. Practice privilege escalation on standalones. After 55:26, work Windows machines from a list of OSCP-like boxes. The video points to two community lists for this: Lain Kusanagi's list and the NetSecFocus list.
5. Build a tunnel until it's boring. After the pivoting block, set up a tunnel through a host you own and reach a machine behind it. If that takes you more than 10 minutes, keep repeating it.
6. Write your notes while you watch. For each phase, keep the commands you'd paste on exam day, in the order you'd run them. That's the video's own tip at 1:57:18. If you'd rather start from finished notes, our OSCP notes are copy-paste methodology in CherryTree and Obsidian.
7. Rewatch the exam tips the week before your exam, then read our OSCP exam tips for exam-day strategy under the new scoring.

To go deeper on Active Directory or tunneling, see our Hacking Active Directory and Pivoting and Network Tunneling playlists. For single techniques, one per video, there's Most Common OSCP Attacks.

What a free 2-hour course can't do

Two hours is enough to show a method. It can't cover the whole syllabus or make the method automatic, and there are three gaps to plan around.

Coverage is the first. PEN-200's syllabus includes web attacks (XSS, command injection, directory traversal, file uploads, SQL injection), client-side attacks, password attacks, antivirus evasion, Windows and Linux privilege escalation, pivoting and tunneling, Active Directory and AWS. The free video goes deep on AD, Windows privilege escalation, pivoting and initial access. Linux privilege escalation gets a mention without its own walkthrough, and client-side attacks and AWS aren't covered. Since anything in the course material can show up on the exam, those topics need another source.

Practice is the second. The video shows the method on a few machines. The exam asks you to run it on machines you've never seen, deep into a 23 hour and 45 minute session, with nobody explaining the next step. That only comes from your own hours on boxes and chains.

The third is a checklist. A video gives you one order of operations on one machine. When an exam box stalls, you need a list of everything to check for that phase, in order, so you can see what you skipped.

That's what our 30+ hour course for OSCP prep is for. It teaches the complete OSCP methodology from the ground up and comes with a structured checklist to work from when you're stuck. You can start with a free trial and cancel any time. The Ultimate Bundle on the same page adds every AD chain lab and our OSCP notes.

FAQ

Is there a free OSCP course?

Yes. Hacker Blueprint's Full OSCP Course on YouTube is free video training that runs 2 hours and 5 minutes, covering Active Directory, post-exploitation, Windows privilege escalation, pivoting, initial access and exam tips. OffSec's official course, PEN-200, is paid and starts at $1,749.

Is PEN-200 free?

No. On offsec.com, the Course + Cert Bundle is $1,749 for 90 days and one exam attempt, and Learn One is $2,749 a year with two attempts (checked October 29, 2026). The exam on its own is $1,699. Every fee, including retakes and renewal, is in our OSCP cost breakdown.

What is in the OSCP course syllabus?

PEN-200 has 20+ modules covering enumeration and information gathering, web and client-side attacks, password attacks, antivirus evasion, Windows and Linux privilege escalation, pivoting and tunneling, Active Directory attacks and lateral movement, and AWS. OffSec says anything in the course material can appear on the exam.

Is there a separate OSCP+ course?

No. OffSec has one course for it, PEN-200, and one exam. Passing the exam earns both the OSCP, which doesn't expire, and the OSCP+, which expires after three years.

Can you get the OSCP certification for free?

The preparation can be free, but the certification comes from passing OffSec's exam, and OffSec charges for the attempt: $1,699 for the exam on its own, as of November 3, 2026 (every fee is in our OSCP cost breakdown). Our free video course and AD chains cover the method and the practice, though free material rarely covers the whole PEN-200 syllabus, so check its module list against what you've studied.

Does the free course cover the new OSCP+ scoring?

No. It was uploaded in May 2025 and explains the 70-point pass mark, which applies only to exams that start before December 1, 2026 at 08:00 GMT. Later exams use a scaled score from 100 to 500, and 400 passes.

Watch the course, then run a chain

The video gives you the method. A chain you finish without the walkthrough tells you if it stuck. Start with the free course, try one of our free AD chains cold, then move to the full course when you want the complete method and the checklist.

Darren passed the OSCP+ on the first attempt with 70 points: "The videos and cheatsheets helped me build a solid methodology and improve my troubleshooting skills when things didn't work as expected during the exam." (More reviews)

Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

Questions about the course or a chain? Ask in the Hacker Blueprint Discord.

Sources

• OffSec: PEN-200 course page (course name, 20+ modules, 9 challenge labs, syllabus, recommended background, OSCP and OSCP+ validity, prices; checked Oct 29, 2026)
• OffSec: OSCP+ Standalone Exam ($1,699 for 2 exam attempts in a 90-day period, no course materials; checked Nov 3, 2026)
• OffSec: OSCP+ Exam FAQ (pivoting on the AD machines, course material in scope)
• OffSec: OSCP+ Exam Guide (exam structure and timing)
• OffSec: OSCP+ Scoring Update (Oct 21, 2026)
• OffSec: OSCP+ Equated Scaled Scoring FAQ (scaled scoring from Dec 1, 2026)
• Hacker Blueprint: Full OSCP Course (EVERYTHING You Need!) (YouTube, May 6, 2025)
• Hacker Blueprint: Hacking Active Directory Course for Beginners (Over 5+ Hours of Content!) (YouTube, Jul 22, 2025)