OSCP Report Template: How to Write the Exam Report (OffSec or SysReptor)

The short answer

The simplest way to write the OSCP^® exam report is in OffSec's official template. It comes in Word and LibreOffice formats and already has a section for every part of the exam. If you'd rather write in Markdown in a browser, SysReptor is a free reporting tool with an OffSec design that follows the same layout. The exam guide also accepts a template of your own, as long as it's structured, professional and meets every requirement.

Whatever template you use, the OSCP exam report is a PDF penetration test report. For each target it needs every step, command and console output, detailed enough that a technically competent reader could repeat the attack, plus a proof screenshot for every flag. You archive the PDF as a .7z and upload it within 24 hours of the exam ending. Points only count for objectives you document, and a missing screenshot can't be added once you've submitted.

The rules below come from OffSec's OSCP+^™ exam guide and help pages, checked on November 2, 2026. We're Hacker Blueprint, an independent prep site with no ties to OffSec. Our instructor holds the OSCP, our academy has more than 600 students, and around 7,000 people have claimed our prep materials.

Video: how to write the OSCP report

Our video "OSCP Exam - How to Write the Report" runs just under five minutes. It covers the report template at 0:25, screenshots at 0:47 and making your steps reproducible at 2:40. It went up in June 2025, so where it and the current exam guide differ, follow the guide.

It's part of our OSCP Exam Prep Guide playlist, next to our note-taking videos and full course.

OffSec's report rules in one table

OffSec calls its documentation requirements "very strict", and its exam guide says insufficient documentation means "reduced or zero points". These are the rules that shape the report, all from the exam guide unless the row says otherwise.

Two lines in the guide's Point Disqualification list are worth reading twice. Each flag has to appear in both places, the control panel and an interactive shell screenshot, or the target scores nothing. "Lack of documentation" is on the same list.

Read the whole exam guide before exam day, the proof and screenshot rules most of all. A proof screenshot without the IP address is one of the easiest ways to lose a target you've already compromised, and nothing can be added after you submit.

The report matters even more under scaled scoring. For exams starting on or after December 1, 2026 at 08:00 GMT, OffSec's FAQ says raw points still come only from objectives you complete and document in the report, and every submitted report is graded in full. A total that looks low may still pass on your exam set, so always submit. Our scaled scoring explainer covers how the conversion works.

Where to get OffSec's official report template

OffSec publishes its report template as a Word file and a LibreOffice file. Both are linked from the exam guide, and OffSec's Reporting Requirements page says you're "highly encouraged" to use them. OffSec's AD preparation page adds one more piece of advice: set your template up before the exam.

The Word version we downloaded on November 2, 2026 is version 2.0, and it comes filled in with a worked example. Its layout:

• Title page and introduction. Your email and OSID, then the objective and a list of what the report must include.
• High-Level Summary, with a Recommendations section.
• Methodologies. Information Gathering, Service Enumeration, Penetration, Maintaining Access and House Cleaning.
• Independent Challenges. A section per standalone target, split into Service Enumeration, Initial Access, Privilege Escalation and Post Exploitation.
• Active Directory Set. A section per machine, split into Initial Access, Privilege Escalation where there is one, and Post-Exploitation.

Each finding opens with four short fields: Vulnerability Explanation, Vulnerability Fix, Severity and Steps to reproduce the attack. The commands, output and screenshots follow.

Make it yours before the exam:

1. Put your email and OSID on the title page, then clear out the example's text, IP addresses and screenshots, keeping the headings.
2. Copy the target section until you have three standalone targets, and check the AD set has three machines.
3. Rewrite the Methodologies to match how you work. If you add no accounts and leave nothing behind on the targets, a sentence under Maintaining Access and House Cleaning saying so is enough.
4. Update the table of contents before you export, so its names and page numbers match.

Some older templates shared online still have a slot for a buffer overflow machine and no AD set section. Check any template you pick up elsewhere against the current exam: three standalone targets and an AD set of three machines.

How to write the OSCP report in SysReptor

SysReptor is a penetration test reporting tool. You write each section in Markdown in your browser, and it renders the PDF in the report's design. Its OffSec designs follow the structure of OffSec's official reports, which SysReptor says it does with OffSec's permission. OffSec's guide only names Word and LibreOffice, so treat SysReptor like your own template: every rule in the table above still applies.

You can use it two ways:

On the cloud, download the PDF from the project's publish page and export the project as a backup, so the three-month rule never matters.

To self-host:

1. Install Docker and the packages listed in SysReptor's installation guide, then run its install script: bash <(curl -s https://docs.sysreptor.com/install.sh).
2. Open http://127.0.0.1:8000/ in your browser.
3. From the sysreptor/deploy folder, run the import command on SysReptor's OffSec reporting page to add the OffSec designs.

Copy the commands from SysReptor's docs on the day you install, since they can change.

What helps during the exam:

• Notes beside the report. Each project has a notes tree that stays out of the PDF, so you can keep raw output and dead ends there. A note can also be an Excalidraw whiteboard, which is handy for drawing the AD set: each machine, each user and where you used them next.
• Screenshot editing. The built-in image editor crops and adds boxes, lines and text, enough to point the reader at the line that matters.
• Plugins. A self-hosted install keeps most plugins off until you enable them in the settings. CyberChef and a hash identifier are among the official ones.
• The AI agent stays off. SysReptor offers an AI agent for report writing. OffSec bans AI chatbots during the exam and the reporting phase, so don't use it for your exam report.

SysReptor's own advice is to test your reporting tool before the exam. Write up one practice machine, render the PDF, then run the export checks in the PDF section below.

How to write the high-level summary

OffSec's advice is to treat the exam network as a penetration test you were hired to do, and its AD preparation page calls the report "the product you deliver to the client". The summary is the page a client would read first.

Keep it to about a page. Say what you tested and when, then list each target with the access you reached: none, user, or root, SYSTEM or administrator. Add the most serious weaknesses in one line each and a short set of recommendations. Write it last, once the target sections are done, so it matches them.

How to write each target section

Every target section follows the order you attacked it:

1. Service enumeration. The open ports and services that mattered, with the scan command and its output. If a scan runs to pages, keep the lines that show what you used and mark where you cut it. OffSec's sample AD machines skip this part, but adding a short version for them too shows where each step came from.
2. Initial access. The weakness and the steps that got you in. This is where local.txt usually comes in.
3. Privilege escalation. The same pattern, up to root on Linux or SYSTEM, Administrator or an administrator-level user on Windows. Those are the levels the exam guide requires for full points.
4. Post-exploitation and proof. The screenshots for each proof file (next section).

Each finding, such as initial access or privilege escalation, opens with the four fields from OffSec's template:

• Vulnerability Explanation. The weakness and why it worked on this host.
• Vulnerability Fix. The patch, setting or credential change that closes it, in a line or two.
• Severity. Every rated finding in OffSec's samples is Critical, and a finding that ends in a shell or administrator rights usually is.
• Steps to reproduce the attack. Numbered steps from first contact to the flag, each with the exact command, its output and a screenshot where the result needs proving. Proof of concept code goes in these steps too, as text.

The AD set needs one extra thread. OffSec gives you a username and password at the start, so write it as one connected path from that account to the domain controller. For each machine, show where every credential or access you used came from and where you used it next. Numbering the users in the order you found them (user 1, user 2 and so on) makes the chain easy to follow. Our Active Directory set guide covers the methodology behind that path.

Order matters too. The exam guide says machines are graded in the order you document them, and OffSec's AD preparation page says to format your template in line with the requirements of each machine, which the control panel lists. Label every section with the machine name and IP address exactly as the control panel shows them, and list the proof files the panel expects for that machine.

A single step can look like this:

3. Logged in to the admin page with the password found in step 2.
   Command: the exact command or request, copied from the terminal log
   Output: the lines that show the login worked
   Screenshot: s1-03-admin-login.png

What the proof screenshots must show

Each local.txt and proof.txt needs its own screenshot. According to the exam guide, that screenshot shows:

• The contents of the file, read with type or cat from its original location.
• The target's IP address from ipconfig, ifconfig or ip addr, in the same frame.
• An interactive shell on the target. A web shell, or reading the file any other way, scores zero for that target. OffSec's FAQ confirms a PowerShell remoting session counts as a shell.

The privilege rule is easy to trip over on Windows. Some privileges, such as SeBackupPrivilege and SeManageVolumePrivilege, let a low-privileged user read files anywhere on the disk, so you can see proof.txt without ever becoming an administrator. That read doesn't count. The guide wants the flag read in a shell running as SYSTEM, Administrator or a user with Administrator privileges, and on Linux in a root shell. Use the privilege to get that shell first, then read the flag.

Running whoami in the same frame puts the privilege level next to the flag. OffSec doesn't require it, but it makes the proof.txt screenshot easier to read.

Take the screenshot the moment you read the flag, check the IP address is in the frame, then paste the value into the control panel. The control panel won't tell you if a submitted flag is wrong, so copy it from the terminal and don't retype it. Keep the terminal font large enough that the flag is readable in the final PDF.

How to make every step reproducible

The guide's test is that "a technically competent reader" could repeat your attacks step by step. In practice that means three things for every step: the command as text the reader can copy, the output that shows it worked, and a screenshot where the result needs proving. Commands typed out as text are much easier to repeat than commands inside an image.

Write the steps in the order of the path that worked, from first contact to proof, so the reader can follow it in one pass. Your notes keep the dead ends.

If you have time before the exam ends, OffSec's AD preparation page suggests reverting a machine and exploiting it again from your notes. Following your own steps on a fresh machine is the quickest way to find a missing one.

How to document exploit code you changed

The exam guide splits exploit code into two cases.

If you used a public exploit unchanged, give its URL and nothing more. The guide says not to include the full code, "especially if it is several pages long".

If you changed it, the report needs five things: the modified code, the URL of the original, the command used to generate any shellcode, the changes highlighted, and an explanation of why you made them. A diff block shows the changed lines clearly, with the full modified code below it as text. Any script or proof of concept you wrote yourself goes in the PDF as text too, since the .7z may only contain the PDF.

Keep a copy of every exploit you edit during the exam, saved per target, so the version in the report is the version you ran.

How to collect report material during the exam

The report is far easier when it's half written before the exam ends. OffSec's Reporting Requirements page suggests documenting important information as you work and writing it into the final report while it's fresh. The habits that make that work:

• Log your terminal. OffSec's AD preparation page recommends terminal loggers so every command and its output is saved. Start logging before your first scan.
• Name screenshots as you take them. Use target, step number and what it shows, like ad-m1-04-local.png or s2-05-privesc.png, so they sort in order and you never hunt through default file names at the end.
• Keep one note per target. Ports, services, credentials found, what worked and what didn't. Our guide to OSCP note-taking compares Obsidian, CherryTree and Notion for this.
• Keep a credential map. Every user and password or hash you find, numbered in order, with where it came from and where it worked. In the AD set it becomes the path your report follows.
• Close each machine in the report. Once you have a flag, move that machine's steps and screenshots into its section before you start the next one. Our OSCP exam tips build this into the exam-day timetable.
• Use screenshots and logs only. OffSec's proctoring FAQ says you may not video record your screen while working on exam machines.

Then sleep. OffSec's own advice for the report is: "You have 24 hours for the report; there is time to rest."

Those 24 hours start when the exam ends. Once you end the proctored session, the exam VPN closes and you can't rejoin, so check every screenshot is on disk first. Our guide to ending the exam under OSCP+ proctoring covers that last step.

How to export, check and submit the PDF

How you get the PDF depends on where you wrote the report:

• Word or LibreOffice. Save or export as PDF.
• SysReptor. Render the report and download the PDF from the project's publish page.
• Markdown. Obsidian has a built-in Export to PDF that includes embedded images. Pandoc converts from the command line; by default it goes through LaTeX, which has to be installed first, and other PDF engines are available.

Run the whole pipeline once during practice, from template to PDF to .7z, so exam day isn't the first time you try it. Then, after the exam:

1. Export the PDF and read it page by page. The guide asks you to check that the format and content survived the export, and long code lines and images are the first things to check.
2. Copy one code block out of the PDF into a text editor. If a watermark, header or footer comes along with the code, fix the design or page layout so a reader can copy your commands cleanly.
3. Name it OSCP-OS-XXXXX-Exam-Report.pdf with your OSID, matching the case exactly.
4. Archive it into OSCP-OS-XXXXX-Exam-Report.7z on Kali, without a password. If it's over 200MB, compress the images.
5. Upload it at upload.offsec.com. Some Windows 11 users hit a "file is not a proper format" error there, and OffSec's fix is to upload from a Kali VM.
6. Compare the MD5 hash the site shows with your local file, then click Submit File. Uploading alone doesn't submit the report.
7. Look for the confirmation email, spam folder included.

If OffSec later asks for clarification, the guide gives you 24 hours to reply.

Common report mistakes

• A proof screenshot without the IP address, or a flag read through a web shell. Either one costs the target's points.
• A proof.txt read as a low-privileged user through a file-read privilege, with no SYSTEM, Administrator or root shell.
• A flag in a screenshot that never went into the control panel, or the other way round.
• A step that jumps ahead, such as a shell appearing with no command or output before it.
• A full unmodified exploit pasted in, or a modified one without its changes highlighted and explained.
• Machines documented in an order you didn't intend, with names and IPs that don't match the control panel.
• Leftover example text from a template, or a table of contents that no longer matches the sections.
• A file name with the wrong case, a password on the .7z, or a second file inside it.
• An upload that never got its Submit File click.
• Asking an AI chatbot or a report tool's AI assistant to write, rephrase or check the report. OffSec bans chatbots during the reporting phase too, and our allowed tools guide has the full list of tool rules.
• Reading the exam guide for the first time after the exam. Read the proof and screenshot rules before you start.
• Leaving the report unsubmitted because the points feel short. Every submitted report is graded, and OffSec only gives exam feedback to learners who submitted one and fell short.

FAQ

Is there an official OSCP report template?

Yes. OffSec publishes its report template in Word and LibreOffice formats, linked from the exam guide and its Reporting Requirements page. It has a high-level summary, a methodology section, a section per standalone target and a section per AD machine, and each finding opens with Vulnerability Explanation, Vulnerability Fix, Severity and Steps to reproduce the attack. You may also use your own template, as long as it's structured, professional and meets every rule in the guide.

Can I use SysReptor for the OSCP report?

Yes. OffSec's exam guide accepts your own template as long as it's structured, professional and meets every requirement, and SysReptor's OffSec design follows the structure of OffSec's official report. Use the free cloud version or install it yourself with Docker, test it before the exam, and leave its AI agent off, since OffSec bans AI chatbots during the reporting phase.

Where do the steps for each machine go?

Under Steps to reproduce the attack, in each finding of that machine's section. Number them from first contact to the flag, with the exact command, its output and a screenshot where needed. Any proof of concept code goes there too, as text.

Do I need a severity rating and a fix for every finding?

The exam guide doesn't list them, but OffSec's template gives every finding a Vulnerability Fix and a Severity field, so fill them in. A line or two for the fix is enough, and most findings that give you a shell or administrator rights rate Critical, like OffSec's samples.

Do I need the Maintaining Access and House Cleaning sections?

They're part of the methodology section in OffSec's template, so keep the headings and describe what you did. If you added no accounts or services and left nothing on the targets, a sentence saying so is enough.

Can I read proof.txt without an administrator shell?

No. The exam guide requires a shell running as SYSTEM, Administrator or a user with Administrator privileges on Windows, or a root shell on Linux, for full points. Reading proof.txt through a privilege such as SeBackupPrivilege or SeManageVolumePrivilege from a low-privileged shell doesn't meet that rule, so use the privilege to get an administrator or SYSTEM shell first.

Can I write the OSCP report in Markdown?

Yes, as long as you submit a PDF. Write in Markdown and export with Obsidian or pandoc, or use SysReptor, which renders the PDF for you. Check the PDF before you archive it, because the .7z may only contain a PDF.

How long should an OSCP exam report be?

OffSec sets no page count. It needs every step, command and output for each target you compromised, plus proof screenshots, so the length follows from how many targets you document and how many steps each one took.

How long do you have to submit the OSCP report?

24 hours from the end of the exam, which itself runs 23 hours and 45 minutes. Upload the .7z at upload.offsec.com and click Submit File; once submitted, the report is final.

Can I use ChatGPT to write my OSCP report?

No. OffSec's FAQ bans KAI and other AI chatbots during the exam and the exam reporting phase, and its exam guide treats chatbot use as a breach of its academic policy. The same goes for AI features inside your report tool.

Do I include the full exploit code in the OSCP report?

Only if you modified it. For an unmodified public exploit, the guide asks for the URL alone. For a modified one, include the modified code, the original URL, any shellcode command, the highlighted changes and why you made them.

Practice the report before exam day

Write one complete report before your exam, with the template, screenshot names and PDF export you'll use on the day. OffSec's preparation page recommends practicing report writing after you exploit machines, and it's much calmer to find a broken export in practice.

Our machine walkthrough videos teach the method for solving each box and leave the write-up out. The report is covered in the course's reporting section, our exam advice and this page, so practice both: solve a box with the method, then write it up as a report section.

Our free AD chains start from an assumed breach like the exam's AD set, so each one makes a full practice report: a starting account, a path across machines and proof at every step. Our methodology notes for OSCP prep follow the order you work through a box, which is also the order of a target section. For where the report fits in the wider plan, see the OSCP+ roadmap.

thehuskyhacker, one of our students, wrote: "Your program has been the best I've seen. The notes have been more than helpful, and seeing a step-by-step helped out a lot." (More reviews)

Try our 30+ hour course for OSCP prep with a free trial, or write your first practice report on one of our free Active Directory chains.

Not sure how much detail a step needs? Ask in the Hacker Blueprint Discord.

Sources

• OffSec: OSCP+ Exam Guide (documentation requirements, exploit code, proof files, screenshot requirements, privilege levels for full points, Point Disqualification, grading order, suggested templates and your own template, submission checklist, file names, .7z archive, 200MB limit, upload and Submit File, MD5 check, Windows 11 upload note, clarification requests; checked Nov 2, 2026)
• OffSec: OSCP+ Reporting Requirements (templates "highly encouraged", treating the exam as a hired penetration test, documenting as you work, PDF with screenshots; checked Nov 2, 2026)
• OffSec: Exam report template (Word) and LibreOffice version (OffSec's own templates; Word version 2.0 checked Nov 2, 2026 for its sections, the four finding fields and the sample severity ratings)
• OffSec: OSCP+ Exam FAQ (example report templates, AI chatbots banned during the exam and reporting phase, PowerShell sessions as shells, feedback only after a submitted report)
• OffSec: OSCP+ Exam with AD Preparation (prepare a template before the exam, format it to each machine's requirements, terminal loggers, practicing report writing, checks before ending the exam, rest before writing, the report as the client deliverable; checked Nov 2, 2026)
• OffSec: OSCP+ Equated Scaled Scoring FAQ (raw points only for documented objectives, every submitted report fully graded, submitting even if you think you fell short, start date Dec 1, 2026)
• OffSec: Proctored Exam Requirements FAQ (no video recording of your screen during the exam)
• OffSec: General Proctoring FAQ (ending the exam closes the VPN for good, no rejoining; checked Nov 3, 2026)
• OffSec: Troubleshooting Exam Report Upload Issues (uploading alone doesn't submit, the Submit File step, the confirmation email)
• SysReptor: OffSec Reporting with SysReptor (free cloud service for OffSec reports with Pro features, designs that follow OffSec's official reports with OffSec's permission, importing the designs on a self-hosted install; checked Nov 2, 2026)
• SysReptor: Installation (Ubuntu, 8GB RAM, Docker, install script, http://127.0.0.1:8000/; checked Nov 2, 2026)
• SysReptor: Exam reports FAQ (free for exam reports, global designs locked in the cloud, private designs, data deleted after three months without login, PDF download and project export; checked Nov 2, 2026)
• SysReptor: OSCP reporting tools (test your tool before the exam)
• SysReptor: Notes, Image editor, Plugins and AI agent (notes kept out of the PDF, Excalidraw notes, crop and drawing tools, plugins off until enabled, the AI agent; checked Nov 2, 2026)
• Obsidian Help: Export to PDF (built-in PDF export)
• Pandoc User's Guide: Creating a PDF (LaTeX as the default PDF engine, other engines)
• Hacker Blueprint: OSCP Exam - How to Write the Report (YouTube, Jun 11, 2025)