OSED: OffSec Exploit Developer

What OSED is and who runs it

OSED — the OffSec Exploit Developer certification, course code EXP-301, “Windows User Mode Exploit Development” — is run by OffSec, the same vendor behind the OSCP. It is squarely a Windows exploit-development credential, not a general pentest cert. You reverse engineer 32-bit Windows binaries using IDA Freeware and WinDbg, find memory-corruption bugs, and write working exploits: stack buffer overflows, SEH overwrites, custom position-independent shellcode, egghunters, and bypasses for DEP and ASLR, finishing with format-string read/write primitives. OSED is one of three certs (with OSWE and OSEP) that together make up OSCE3. If you want cloud, web-app, or general penetration testing, this is the wrong cert; if you want to understand how memory-corruption exploits are actually built, it is the right one.

Cost and what’s included

OSED starts at $1,749 for the Course + Cert Bundle, which gives 90 days of access to the EXP-301 course, its hands-on labs, and a single exam attempt. The alternative is Learn One at $2,749/year, stretching access to a full year of the course and labs and including two exam attempts — better value if you expect to need more lab time or a likely second attempt. Both are self-paced, and the certification itself does not expire. Re-check the figures before buying, since OffSec adjusts pricing periodically.

Time: the exam and the report

The exam is proctored and marketed as “48-hour,” but the exam guide states the precise clock: 47 hours and 45 minutes of hands-on time. When the clock stops you have another 24 hours to write and submit a professional report documenting each exploit, including proof.txt screenshots and your Python3 code. That near-two-day window is deliberate — you are expected to sleep, eat, and step away. Results arrive by email within ten business days. Do not underestimate the report: missing screenshots or proofs mean zero points for that task, and there is no chance to send them afterward.

How hard it is, honestly

It is hard, and reviewers say so plainly. The exam is three independent tasks worth 100 points total, and you need 60 to pass — in practice usually meaning you fully solve at least two, since points are only awarded for full completion. Nothing is outside the syllabus, but you must apply the techniques in less obvious ways, so a shaky grasp of fundamentals shows immediately. Reverse engineering with only free IDA — raw assembly, no decompiler pseudocode — is the steepest part for newcomers.

Is it worth it — and for whom

OSED is worth it if you specifically want exploit development, vulnerability research, malware analysis, or red-team tooling skills. It is not a beginner cert and not a résumé box-checker; the skills are narrow but deep. If your role is general pentesting, OSCP or OSEP give more day-to-day return. But for anyone heading toward a security-research or exploit-dev seat — or chasing the OSCE3 — it is one of the few structured, hands-on paths into the discipline.

How to prepare

Get comfortable reading and writing 32-bit Intel assembly, driving WinDbg, and scripting exploits in Python3 before you start; basic C helps. Work every lab and as many “extra miles” as time allows — reviewers agree the extra miles build the creative thinking the exam demands. Finish the three end-of-course challenges; they mirror the exam’s difficulty. Practice bypassing DEP with different Win32 APIs and ROP sources, and write your own shellcode from scratch. Keep tidy notes and reusable code snippets so report-writing is fast when you are exhausted.

SourcesOffSec EXP-301 course & pricingOSED Exam Guide