How to Take OSCP Notes: Obsidian vs CherryTree vs Notion

    The OSCP+ (OSCP Plus) exam is open book, so your notes come with you. Here's how to structure them so you find the next step in seconds and can write the report from them, plus Obsidian, CherryTree and Notion compared on cost, offline use and file format.

    By Hacker Blueprint··12 min read

    The short answer

    Good OSCP® notes come in two sets. Methodology notes are the playbook you build during prep, sorted by phase and service so you find your next step in seconds. Engagement notes are a fresh page per target, holding every command, output and screenshot your report will need.

    The app matters less than the structure. Obsidian suits you if you want plain Markdown files you own and can back up with Git. CherryTree suits you if you want one file with a tree of nodes, and it comes with Kali's default tools. Notion works if you already use it, though offline access is switched on page by page.

    The OSCP+™ (OSCP Plus) exam is open book, so whatever you write during prep comes with you, as long as it opens on the machine running the proctoring software.

    We're Hacker Blueprint. Our instructor holds the OSCP, our academy has more than 600 students, and around 7,000 people have claimed our prep materials. We sell methodology notes for OSCP prep in both CherryTree and Markdown, so this page has no reason to favour one app.

    Video: how we take notes in Obsidian

    Our video "How HACKERS Take Notes with Obsidian" shows how we structure notes in Obsidian, link commands and boxes together, and pull the right material back up in seconds during an exam. The vault comes up at 1:02, and checklists and note taking at 2:38. It runs just under five minutes and has more than 13,000 views.

    For what to write down and what to leave out, our video "Most Effective Notes for OSCP Exam, CTFs and Pentesting" gets to checklists at 0:20.

    Why notes matter on an open-book exam

    OffSec's exam FAQ says the "OSCP+ exam is an open book exam, meaning you are permitted to use your notes, online resources (Except for AI chatbots and LLMs with direct prompt access), the OffSec Learning Platform, and similar materials." All of it happens on the host machine running the proctoring application. Other electronic devices are off limits, though the proctoring FAQ allows "printed books, notes, paper, and pen".

    AI is where note apps get tricky. The exam guide says: "You are not required to disable tools with built-in AI features like Notion or Google AI Overview. However, using LLMs and AI chatbots (OffSec KAI, ChatGPT, Deepseek, Gemini, etc.) is strictly prohibited." So Notion can stay installed, and so can an AI add-on in any other app, but prompting one is using an LLM, which the FAQ bans during the exam and the reporting phase. Our OSCP+ allowed tools guide covers the rest.

    Open book only helps if you find things fast. You get 23 hours and 45 minutes for the exam, then 24 hours to upload the report, and every minute spent hunting for something you've done before comes out of that time.

    Notes also carry the report. The guide wants documentation "thorough enough that your attacks can be replicated step-by-step by a technically competent reader", and once you submit, "If any screenshots or other information is missing, you will not be allowed to send them". What you capture during the exam decides what you can prove afterwards.

    Methodology notes vs engagement notes

    A lot of advice treats OSCP notes as one giant cheat sheet. You'll do better with two kinds, because they do different jobs.

    Detail Methodology notes Engagement notes
    Written Through months of prep During each target, as you go
    Contents Checklists, steps, tested commands Commands, output, credentials, screenshots, proof
    Sorted by Phase, service and tool Target, then time
    Used for Deciding the next step Writing the report

    Methodology notes are your playbook. They grow with every machine you practice on, and on exam day they answer one question: what do I check next?

    Engagement notes are a record. Open a page when you start a target and write as you work: what you ran, what came back, what failed, every credential and where you found it, and a screenshot at each step that matters. On the Active Directory set, add one credentials page for the whole set. Credentials in unusual places and skipped re-enumeration are two of the most common reasons we see people fail the AD set, and a page you reread on every new machine helps with both. Our OSCP+ Active Directory guide covers the method.

    OffSec's own AD prep article says the same: "Document all commands, outputs, scripts, and code you use", "Use terminal loggers to automatically log all commands and outputs in your shell", and "Take snapshots and backups of your work." When the exam ends, those notes become the report, and our OSCP report template guide shows how.

    How to structure your methodology notes

    Organise the notes in the order you work, so they read like a checklist from the first scan to the final proof. This layout works in any app:

    • Checklists. One short page per stage (new target, web app, Linux privilege escalation, Windows privilege escalation, Active Directory), each a numbered list of what to check.
    • Services. One page per service, named with its port (SMB 445, for example), so a search for either finds it.
    • Active Directory. Separate pages for enumeration, credential attacks, lateral movement and domain compromise.
    • Tools. One page per tool, with only the syntax you've used successfully and a line on when to reach for it.
    • Pivoting and file transfers. You'll need both on most sets, so keep them one search away.
    • Report. Your template, a screenshot checklist and OffSec's proof rules, such as showing each proof file next to the target's IP address.

    A few habits decide if you'll use these pages or scroll past them:

    • Write commands with obvious placeholders for IPs, users and ports, so you can paste and edit them in seconds.
    • Give each command a line of context: what it's for and what to look for in the output. Our notes video puts it bluntly: stop copying every command into a wall of text.
    • Log failures too, so you don't retry a dead end at 3 a.m.
    • Test the notes. OffSec suggests that once you've finished the AD sets, you "redo it without looking at the notes." Do the same with practice machines and fill the gaps you find.

    For a methodology to build your notes around, our My Pentesting Methodology playlist walks through our approach to initial access, Linux privilege escalation and Active Directory.

    Obsidian vs CherryTree vs Notion for OSCP notes

    These are the three apps people ask about most, checked on each vendor's site on November 2, 2026.

    App Cost Works offline Stores notes as
    Obsidian Free; Sync add-on from $4 a month Yes Markdown files in a local folder
    CherryTree Free and open source Yes One file with a tree, or a folder
    Notion Free plan, plus paid plans Pages you mark for offline A cloud workspace

    Obsidian stores your notes "as Markdown-formatted plain text files in a vault", and the vault is a folder on your own disk. It's free, needs no sign-up, and a commercial license is optional. Plain files are its biggest strength: any tool can search them, Git or any sync service can back them up, and another Markdown app can open them if you switch. It runs on Windows, macOS, Linux (including .deb and AppImage builds, handy on Kali), iOS and Android. The trade-off is setup: it isn't in Kali by default, and a new vault starts empty.

    CherryTree calls itself "a hierarchical note taking application, featuring rich text and syntax highlighting". Notes live in a tree of nodes, and the whole tree can sit in one SQLite or XML file that's easy to copy and back up. It's free under the GPL, has Windows and macOS installers, and is part of Kali's default tools, so it's often already on your VM. You can password-protect a single-file notebook with 7-Zip, though an unprotected copy sits in a temporary folder while it's open. Version 1.7.2 came out on August 22, 2026. The trade-offs: Git can store the binary SQLite file without showing what changed, and one file is one point of failure until you back it up.

    Notion is a cloud workspace of pages and databases, and databases are handy for tracking practice machines. The Free plan caps uploads at 5 MB, plenty for screenshots. Offline use works only in the desktop and mobile apps: you mark each page "Available offline" on each device, sub-pages one by one, and only a database's first 50 rows download automatically. You're online for the whole exam anyway, since it runs over a VPN with a live proctor, so this matters more for speed than access.

    Two more come up often. Joplin is open source, runs on desktop and mobile, offers Markdown and rich-text editors, and has end-to-end encryption. OneNote is free from Microsoft, and some older OSCP guides recommend it alongside CherryTree.

    Which note-taking app to pick for the OSCP

    Pick by how you work:

    • You want notes that outlast the exam. Obsidian. Plain Markdown opens anywhere, and Git gives you history.
    • You live in Kali and want one file. CherryTree. It's probably installed already, and backing up means copying one file.
    • You already plan your studies in Notion. Stay there, mark your methodology pages for offline use on the computer you'll test from, and leave Notion AI alone during the exam.
    • You want Markdown with encryption built in. Joplin.
    • You can't decide. Pick Obsidian or CherryTree today. Writing after every machine counts for far more than the app.

    Then run three checks before exam day:

    1. The app opens on the host machine running the proctoring software, the only computer you're allowed to use.
    2. A search across all your notes returns in a second or two.
    3. Your notes are backed up outside the Kali VM. Reverting a snapshot wipes anything saved inside the VM after it was taken.

    OSCP notes on GitHub and Notion templates

    Search for OSCP notes on GitHub and you'll find public vaults, cheat sheets and templates, plus Notion templates for tracking machines. They're useful for seeing how others organise things. Three cautions before you copy one.

    Check the date. OffSec last updated its exam guide on October 21, 2026, so compare any rules in a template with the current guide.

    Make the notes yours. Copying a vault gives you someone else's memory. The learning happens when you test each page on machines you've done, rewrite it in your own words and delete what you never use.

    Keep course and exam material out of anything you publish. OffSec's Terms and Conditions bar "sharing all or part of our course materials with any third party including by posting on any platform" and list "Any walkthrough for any of our course or exam labs" as a breach of confidentiality. The exam FAQ adds that you "should not discuss anything about exam in any online resources". For an Academic Policy breach, OffSec can revoke all your certifications and bar you for life from its courses and exams.

    Our methodology notes for OSCP prep

    If you'd rather start from a finished set than an empty vault, that's what our notes are: 690+ topics in 7,600+ lines and 44,000+ words of attack methodology, with copy-paste commands and 480 screenshots, in the order you work through a box.

    The download arrives by email after checkout: a CherryTree file (.ctb), a .zip with the same notes in Markdown for Obsidian or any Markdown app, and a password for the .zip. In CherryTree, open the .ctb from File > Open. In Obsidian, unzip with the password and choose "Open folder as vault". Both hold the same content. Antivirus can flag the .zip because pentesting notes contain scripts and commands, so a few Markdown commands are defanged or swapped for links. The .ctb doesn't trigger Windows Defender.

    The notes are meant to be edited. Add pages from your own practice, cut what you don't use, and they become the methodology notes this post describes. Many people have used them during the OSCP exam, including their author. They're our own methodology and contain no OffSec course, lab or exam material.

    They cost $249.90, paid once, with updates included (send proof of purchase for the latest version).

    FAQ

    Can you use notes in the OSCP exam?

    Yes. The OSCP+ exam is open book: your notes, online resources and the OffSec Learning Platform are allowed on the host machine running the proctoring software. Printed notes are allowed too, while AI chatbots and LLMs are banned.

    What is the best note-taking app for the OSCP?

    For most people, Obsidian or CherryTree. Both are free and work offline. Obsidian keeps plain Markdown files in a folder, and CherryTree keeps a tree of notes in one file and comes with Kali's default tools.

    Is Obsidian or CherryTree better for OSCP notes?

    Neither wins outright. Choose Obsidian for Markdown and Git backups, and CherryTree for a single file that's already on Kali. How you structure the notes matters more than the app.

    Can you use Notion AI during the OSCP exam?

    Notion can stay installed, because OffSec says tools with built-in AI features don't have to be disabled. Using LLMs and AI chatbots is strictly prohibited, so don't prompt Notion AI or any other assistant during the exam or the report.

    Can I use OSCP notes from GitHub?

    Yes, they're fine to learn from, and the exam allows online resources. Check them against OffSec's current exam guide, make them your own, and never publish course material, lab walkthroughs or exam details yourself.

    Should I keep my OSCP notes inside the Kali VM?

    You can work on them there, but keep a copy outside the VM. Reverting a snapshot wipes anything saved after it was taken, and OffSec advises taking "snapshots and backups of your work."

    Build your notes while you practice

    Open the app you picked, create the checklist pages above and fill them from practice. Every machine you root should add or fix something. Our free AD chains start from an assumed breach, like the exam's AD set, so they're good practice for an engagement page per machine and a credentials page per set. Our OSCP+ roadmap lays out the rest of your prep, and if you want a finished base to edit, our methodology notes for OSCP prep open in CherryTree and Obsidian.

    One of our students, Seb, wrote: "Currently, a senior pentester, And I'm really enjoying the course on whop along with the great discord support I get in the VIP Chat, would definitely recommend grabbing the cherry tree notes if you have the budget!" (More reviews)

    Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

    Want to see how other students organise their notes? Ask in the Hacker Blueprint Discord.

    Sources

    Keep reading

    Hacker Blueprint

    Hands-on certification prep, trusted by certified hackers around the world.

    Want new labs and discount codes first?

    We'll email you when a new lab drops or a sale goes live.

    Your email is safe with us. We don't spam.

    © 2026 Hacker Blueprint. All rights reserved.

    Built for hackers, by hackers.

    OSCP® and OSCP+™ are trademarks of OffSec. Hacker Blueprint is an independent training provider and is not affiliated with, endorsed by, or sponsored by OffSec. All content is our own original material and contains no OffSec course, lab, or exam content. Individual results vary: passing any exam depends on your own study and practice. * Lifetime access and lifetime updates run for as long as Hacker Blueprint operates, with no renewal and no extra charge.