OSCP+ Exam Tips: Format, Rules and a 24-Hour Exam-Day Strategy

    From December 1, 2026 there's no raw point total to stop at, so your OSCP+ (OSCP Plus) exam-day plan has to change. Here's how to run the 23 hours and 45 minutes, what to check the day before, and how to make every flag you earn count.

    By Hacker Blueprint··Updated ·17 min read

    The short answer

    The OSCP® exam tips that matter most on the day are about planning and paperwork as much as hacking. The exam format is fixed: 23 hours and 45 minutes for three standalone machines and an Active Directory set, then 24 hours for the report. Split that exam time into timed blocks with meals and sleep built in, screenshot and submit every flag the moment you get it, and keep working every machine until your wrap-up hour. Then submit the report, whatever you think your total is.

    That last part is new. For OSCP+™ (OSCP Plus) exams starting on or after December 1, 2026 at 08:00 GMT, OffSec converts your raw points into a scaled score and doesn't publish how many raw points pass your exam set. Counting to 70 and going to bed stops working, because no raw total tells you that you've passed. OffSec's advice is to attempt every machine, submit every flag, document to the exam guide and always submit the report.

    Some of the easiest points to lose have nothing to do with skill: a proof screenshot without the IP address, a flag read through a web shell, a local.txt never pasted into the control panel, a report uploaded without the final Submit File click. Each one costs points, and each one is avoidable.

    We're Hacker Blueprint. Our instructor holds the OSCP, and our academy has more than 600 students. This is the exam-day plan we'd give any of them. If you're still mapping out your prep, start with the OSCP+ roadmap.

    In How I Crushed The OSCP with 100 Points (And How You Can Too!), our instructor covers the prep that leads into exam day. The parts most useful here are methodology and note taking (1:40), accountability partners (3:35) and using walkthroughs strategically (4:27).

    The OSCP+ exam format at a glance

    This is the exam structure from OffSec's OSCP+ Exam Guide and Exam FAQ, checked on November 3, 2026:

    Part What OffSec says
    Exam length 23 hours and 45 minutes, so a 09:00 GMT start ends at 08:45 GMT the next day
    Standalone machines 3 machines, 20 points each: 10 for initial access, 10 for privilege escalation
    Active Directory set 3 machines worth 10, 10 and 20 points, starting from a username and password you're given
    Maximum score 100 raw points, with no bonus points
    Proctoring Every exam is proctored, with your webcam and screens shared
    Resources Open book: your notes, online resources and the OffSec Learning Platform, with AI chatbots banned
    Report A PDF uploaded within 24 hours of the exam ending
    Passing 70 raw points for exams starting before December 1, 2026 at 08:00 GMT, then a scaled score of 400 on a 100 to 500 scale

    The check-in doesn't add time to the 23 hours and 45 minutes, so arrive early. The passing row is the one part that changes on December 1, and the next section explains how.

    What scaled scoring changes about exam day

    Everything else in that table stays the same after the cutoff: the machines, the raw point values, the time limit, proctoring and the report rules. What changed is the math after grading. Raw points convert to a score from 100 to 500, 400 passes, and the conversion is set per exam set. On a harder set, fewer raw points pass. On an easier one, you need more.

    For exam day, that means three things:

    • You can't count your way to a pass, so plan to work every machine until the final hour, with sleep scheduled around that.
    • Partial points always matter. A foothold on the last standalone, or the first machine in the AD set, could be what lifts your result over 400.
    • The report is never optional. OffSec grades every submitted report in full and says a total that seems low may still pass on your set. If you don't submit one, you can't pass.

    Exams that start before the cutoff still pass at 70 raw points, and the plan below works for those too. Results also take longer now: OffSec's scaled scoring FAQ says to allow up to 15 business days. For the full breakdown, read OSCP+ scaled scoring explained.

    The day before: setup and proctoring checks

    Anything that breaks at check-in eats into your hacking time or ends the attempt, so run these checks a day or two out. OffSec updates its exam and proctoring pages, so reread them in your exam week. For the check-in itself, step by step, see our guide to what to expect from OSCP+ exam proctoring.

    • Your ID. A physical, valid, government-issued photo ID in English showing your full legal name, photo, year of birth, country of issue, issue date and expiry date. You'll show the front and back, or a fully opened passport, and the name has to match your OffSec profile. Hold it up to your webcam and check the text is readable.
    • Your host machine. OffSec lists minimum specs (8 GB of RAM recommended), a webcam that isn't a phone or tablet, a supported browser (Chrome, Firefox, Chromium, Brave or Edge) and a stable connection of at least 20 Mbps down and 10 Mbps up. Your Kali VM runs locally on that host.
    • Linux hosts. If your host runs any Linux variant, OffSec requires a test session with the proctoring team before the exam, so request one by ticket early. Use Xorg/X11, because screen sharing mostly fails under Wayland.
    • Kali. Do any updates early, check your usual tools still start, confirm OpenVPN connects, then snapshot the VM and keep a spare copy. Your exam VPN pack only arrives once the exam starts and check-in is done.
    • Backups. OffSec expects a contingency plan for problems on your side, such as a backup internet connection, a spare Kali VM and power.
    • Your room. Phones and other electronic devices go off the desk and out of reach. Printed notes, books, paper and a pen are allowed. If anyone else will be in the room, OffSec says to tell them the exam protocol beforehand.
    • Report and notes. Open OffSec's report template (Word or LibreOffice) or your SysReptor project and create an empty section for each machine. Set up terminal logging and have your cheat sheet open and searchable.
    • Food and water. Have 24 hours of easy meals ready so a break takes minutes.
    • Timing. Check the time zone of your start time. OffSec recommends logging in to the proctoring tool 15 minutes early, and if you haven't logged in within one hour of the start, the exam is cancelled.

    A sample 24-hour OSCP+ exam timeline

    OffSec's own prep guide suggests a timer per machine: 2 to 3 hours per standalone, about 4 hours for the AD set, and roughly another 2 hours for privilege escalation once you have a shell. It also says to schedule breaks, meals and sleep and stick to the schedule, and its scaled scoring FAQ says you don't need to stay awake for the whole exam.

    Here's one way to lay that out for a 09:00 start, which ends at 08:45 the next day:

    Time Block What to do
    08:45 Check-in Log in, show your ID, scan the room, connect the exam VPN
    09:00 to 09:45 Read and scan Read every objective in the control panel, start light scans, set up report sections
    09:45 to 13:45 AD set Work the chain from the credentials you're given
    13:45 to 14:30 Break Eat away from the desk
    14:30 to 20:30 Standalones, first pass About 2 hours each, move on when the timer ends
    20:30 to 21:30 Break and check Dinner, then confirm every proof so far is screenshotted and submitted
    21:30 to 01:30 Second pass Privilege escalation on footholds, the AD machine you stalled on
    01:30 to 05:30 Sleep Tell the proctor, leave the session running
    05:30 to 07:45 Fresh eyes Work through your "next ideas" list on anything unfinished
    07:45 to 08:45 Wrap-up Fill documentation gaps first, then keep hacking until the end

    This sample starts with the AD set because it's the largest block of raw points and the assumed-breach start gives you credentials at minute one. If standalones are your strength, warming up on one first is a fair choice. OffSec leaves the order to you and only says to decide it from the objectives in your control panel. If your exam starts at another hour, shift the whole table, and settle the plan before exam day.

    When a timer runs out, write down what you tried and your next two ideas, then switch machines. That note is what makes the second pass fast.

    Before every break, tell the proctor in the proctoring chat, and again when you're back. You don't need to wait for a reply. OffSec recommends leaving the proctoring session running while you're away, which keeps your exam VPN up, so a long scan can keep going. If you disconnect, the VPN pauses until you rejoin.

    Treat the last hour as protected time. Check that every flag is in the control panel and every proof screenshot exists. If you have time, OffSec suggests reverting a machine and exploiting it again from your notes to confirm the steps work. Don't click End Exam early: once the session ends, the VPN is cut and you can't rejoin.

    How to document as you go so every flag counts

    OffSec's proof rules are strict, and the control panel won't tell you if you got them wrong. To score a machine, you need all of this:

    • The contents of local.txt or proof.txt, read with type or cat in an interactive shell on the target, from the file's original location. Web shells don't count. OffSec's FAQ confirms a PSSession counts as an interactive shell.
    • The target's IP address from ipconfig, ifconfig or ip addr in the same screenshot.
    • For full points, a shell as SYSTEM, Administrator or a user with administrator rights on Windows, or as root on Linux.
    • The flag submitted in the exam control panel before the exam ends. The panel doesn't confirm whether a flag is correct.
    • Every step in your report, with the commands and console output, detailed enough that a technically competent reader could repeat the attack.

    Miss the proof screenshot or the control panel submission and that machine scores zero. Once your report is submitted it's final, and OffSec won't accept missing screenshots afterwards.

    Five habits make this automatic:

    1. Screenshot the flag the moment you read it, with the IP in the same frame, then paste it into the control panel straight away. Copy it from the terminal, because the panel won't warn you about a typo.
    2. Log your terminal. OffSec's prep guide recommends a terminal logger, so every command and its output is saved for the report.
    3. Name screenshots by machine and step as you take them, like ms01-03-privesc.png. At hour 20, nobody remembers which default file name was which.
    4. Close each machine in the report. Spend 10 to 15 minutes writing its steps and screenshots into its section before you move on. A machine isn't done until that section is.
    5. Keep a copy of every exploit you change. For a modified exploit, the report needs the modified code, the original URL, the command used to generate any shellcode, the changes highlighted and the reason for them. An unmodified exploit only needs its URL.

    The exam is open book: OffSec allows your notes, online resources and the OffSec Learning Platform, with AI chatbots banned. A cheat sheet you can search in seconds saves a lot of time. If yours is half-built, our OSCP notes are copy-paste methodology in CherryTree and Obsidian, in the order you work through a box. Our short video Passed the OSCP! Here's Everything I Wish I Knew... also covers reporting guidelines at 3:43 and taking exam notes at 3:57.

    What to do when you're stuck on a machine

    Getting stuck is a normal part of this exam. What matters is how long you stay stuck before you change something.

    • Respect the timer. When it ends, write your next ideas down and switch. OffSec's prep guide says the same: a different machine or a break brings a fresh perspective.
    • Re-enumerate before you reach for harder exploits. Scans can be inaccurate, so OffSec suggests re-running them and checking results with a second tool. Treat enumeration as a loop: every new user, shell or login means enumerating again from that position.
    • Read an exploit before you run it. Check whether it needs files or permissions set up, or changes for your target, and compare more than one exploit for the same vulnerability.
    • Revert when a machine seems broken or after you've run something unsafe. You get 24 reverts, and the limit can be reset once during the exam.
    • Report problems on OffSec's side in the proctoring chat. You can ask for a machine to be tested, though OffSec won't give hints on any exam objective.
    • Choose your Metasploit target on purpose. You can use it against one machine only, and the choice locks in as soon as you use it, even if the attack fails. msfvenom and multi/handler are fine on every machine.
    • Stay inside the rules when you search. You can read online resources and even search Discord, but you can't ask anyone for help, and AI chatbots are banned during the exam and while you write the report.

    If you hit the same wall twice in a row, take your next break early. Tired eyes make rabbit holes look like progress.

    For a methodology to fall back on, our My Pentesting Methodology playlist shows how we approach initial access, Linux privilege escalation and Active Directory on any machine.

    Why people fail the AD set, and what to check when it stalls

    The AD set is where exam plans most often fall apart. The five reasons we see most often double as a checklist for the moment the chain stops moving:

    Where it goes wrong Ask yourself
    Pivoting Is there a host I can only reach from a machine I already own?
    Relaying and coercion Is there authentication I can trigger and capture or relay, within the rules?
    Credentials in unusual places Have I checked descriptions, shares, scripts, config files and history?
    Not re-enumerating Have I enumerated the domain again as every user I've compromised?
    Overconfidence Am I skipping a topic because I assumed it wouldn't be on the exam?

    Each machine in the set is credited on its own, so even one client adds to your result. Skipping the set is a bad bet: the standalones top out at 60 raw points, and our breakdown of passing the OSCP+ without the AD set runs the numbers. The full methodology is in our guide to the OSCP+ Active Directory set.

    If pivoting is your gap, our Pivoting and Network Tunneling playlist covers Ligolo-ng and Chisel. For the rest of the domain, our Hacking Active Directory playlist goes from the basics to BloodHound, Kerberoasting and lateral movement.

    How to write and submit the OSCP report

    The report is due within 24 hours of your exam ending, and OffSec's own prep advice is to sleep first because there's time. If you documented as you went, the report is mostly assembly and proofreading. These are the submission rules from the exam guide:

    Requirement Detail
    Format PDF, with any scripts or PoCs as text inside it
    File name OSCP-OS-XXXXX-Exam-Report.pdf with your OSID, case-sensitive
    Archive Only the PDF, in OSCP-OS-XXXXX-Exam-Report.7z, without a password
    Size 200 MB at most
    Upload upload.offsec.com, within 24 hours of the exam ending
    Finish Compare the MD5 hash, click Submit File, wait for the confirmation email

    A few things trip people up at this stage:

    • Check the PDF before you archive it. Open it and confirm the formatting and screenshots survived the export.
    • Mind the order. OffSec grades the machines in the order they're documented in your report, so give each one its own clearly labelled section.
    • Upload from Kali if Windows 11 complains. Some Windows 11 users get a "file is not a proper format" error, and OffSec's fix is to upload from a Kali VM.
    • Finish the upload. Uploading alone doesn't submit the report. Click Submit File, then look for the confirmation email, spam folder included.
    • Write it yourself. OffSec's FAQ bans AI chatbots during the reporting phase too.
    • Submit even if you think you fell short. Every submitted report is graded. If OffSec later emails you for clarification, you have 24 hours to reply.

    For more on the report itself, see our OSCP report template and writing guide or the video OSCP Exam - How to Write the Report on our channel.

    How to rehearse exam day before it counts

    A plan you've never run is a guess. OffSec's prep guide recommends simulating the exam: work the machines on a timer, avoid hints and walkthroughs, and write a report afterwards. If you have PEN-200 access, challenge labs 4, 5 and 6 (OSCP A, B and C) each include an AD set.

    For the AD block, our free AD chains start from an assumed breach, the same way the exam does. Give yourself the four hours OffSec suggests, take your proof screenshots to exam standard, and write each machine's report section before you open a walkthrough. To test your thinking under pressure, try Prove You're OSCP Ready (The Ultimate OSCP Scenario Quiz): 13 exam-style questions from recon to root, each with a reveal and a diagram of the attack path.

    If you're earlier in your prep, our free OSCP+ course covers the techniques this plan assumes you have.

    FAQ

    How long is the OSCP exam?

    The OSCP+ exam lasts 23 hours and 45 minutes from your scheduled start, and check-in doesn't add time. After it ends, you have another 24 hours to upload your report.

    Is the OSCP open book?

    Yes. OffSec allows your notes, online resources and the OffSec Learning Platform, as long as you use them on the host running the proctoring tool. AI chatbots, LLMs and asking anyone for help are banned, and our guide to what the open-book rule allows covers the edge cases.

    How should I split my time on the OSCP exam?

    OffSec's prep guide suggests a timer per machine: 2 to 3 hours per standalone and about 4 hours for the AD set, with breaks, meals and sleep planned in advance. When a timer runs out, note your next ideas and move to another machine.

    Can you sleep during the OSCP exam?

    Yes. OffSec expects you to take breaks, eat and sleep within the 23 hours and 45 minutes, and its scaled scoring FAQ says you don't need to stay awake for the whole exam. Tell your proctor in the chat when you leave and when you return.

    Should I stop hacking once I have 70 points?

    For exams starting before December 1, 2026 at 08:00 GMT, 70 raw points passes, though a buffer protects you if a proof gets rejected. From then on, results are scaled (400 passes) and the raw points you need depend on your exam set, so keep working and submit every flag.

    What do OSCP proof screenshots need to show?

    The contents of local.txt or proof.txt, read with type or cat in an interactive shell on the target, plus the target's IP address from ipconfig, ifconfig or ip addr, all in the same screenshot. Web shells don't count, and each flag must also be submitted in the control panel.

    How long do you have to submit the OSCP report?

    24 hours from the end of your exam. Upload a PDF inside a .7z archive, both named with your OSID, to upload.offsec.com, then check the MD5 hash and click Submit File.

    Can I use ChatGPT or other AI during the OSCP exam?

    No. OffSec bans KAI and other AI chatbots during the exam and the reporting phase. Asking anyone for hints, on Discord or elsewhere, also breaks its academic policy. Our OSCP+ allowed tools guide has every tool rule in one place.

    Run a timed AD chain this week

    Find the holes in your exam-day plan during practice, when they cost nothing. Run one of our free AD chains on a four-hour timer, with proof screenshots and a report section for every machine, then run it again a week later.

    Palak, one of our students, wrote: "I went from scoring 10 points on my first attempt to passing with 70 points in under 8 hours, just three months later." (More reviews)

    Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

    Questions about your exam-day plan? Ask in the Hacker Blueprint Discord.

    Sources

    Keep reading

    Hacker Blueprint

    Hands-on certification prep, trusted by certified hackers around the world.

    Want new labs and discount codes first?

    We'll email you when a new lab drops or a sale goes live.

    Your email is safe with us. We don't spam.

    © 2026 Hacker Blueprint. All rights reserved.

    Built for hackers, by hackers.

    OSCP® and OSCP+™ are trademarks of OffSec. Hacker Blueprint is an independent training provider and is not affiliated with, endorsed by, or sponsored by OffSec. All content is our own original material and contains no OffSec course, lab, or exam content. Individual results vary: passing any exam depends on your own study and practice. * Lifetime access and lifetime updates run for as long as Hacker Blueprint operates, with no renewal and no extra charge.