OffSec

How OffSec grades your exam report

Applies to OSCP, OSEP, OSDA, OSWE, OSED, OSWP.

What the OSCP, OSEP, OSWE, OSED, OSWP and OSDA report has to contain, how it is marked, and the mistakes that fail an otherwise passing exam.

OSCP: 23h 45m + 24h report
OSEP: 47h 45m + 24h report
OSDA: 23h 45m + 24h report
OSWE: 48 hours
OSED: 47h 45m + 24h report
OSWP: 3h 45m + 24h report

OffSec runs six certifications on one report standard. Pass the practical and fumble the document and you still fail, which happens often enough that it is worth treating the report as half the exam rather than paperwork at the end.

The rule that catches people

Your report has to let a competent stranger reproduce everything you did, without asking you a single question. That is the whole standard, and every other requirement follows from it. A marker who cannot follow your steps to the same result will not award the points, even when they can see you clearly compromised the host.

This is why “I got root” with a screenshot is worth nothing on its own. The screenshot proves an outcome. The report has to prove a method.

What has to be in it

A step for every step. Every command, in order, with its output. If you ran something four times with different flags before it worked, the report shows the version that worked. Nobody wants your dead ends, but nobody can follow a jump either.

Proof screenshots taken correctly. The screenshot of proof.txt or local.txt must show the file contents and the target’s IP address in the same frame, from the compromised host. A pasted hash on its own is not proof — it could have come from anywhere. Get the IP in the shot: type proof.txt next to ipconfig, or cat proof.txt; ip a on Linux.

Enough detail to rebuild the exploit. If you modified a public exploit, include the modified code and say what you changed and why. A link to Exploit-DB and a note saying “adjusted the offsets” is not reproducible.

Local privilege escalation as its own section. Initial access and escalation are separate findings. Treat them that way.

How the time actually works

The practical window and the report window are separate. OSCP gives you 23 hours 45 minutes on the machines, then a further 24 hours to submit. OSEP, OSWE and OSED give you 48 hours hands-on, then 24 to write.

That second window sounds generous and is not. You will be tired, and reconstructing what you did fourteen hours ago from memory is where reports go wrong. Write as you go — paste commands and screenshots into a working document while the shell is still open. People who leave the writing to the report window are the people who discover a missing screenshot for a host they can no longer reach.

What fails an otherwise passing exam

A proof screenshot without the IP in frame. The single most common avoidable loss.
Steps that do not run. A typo in a command you pasted from memory rather than from the terminal.
A missing escalation path. You showed root, but not how you got there.
Restricted tooling. OffSec limits automatic exploitation tools; using a banned one and documenting it honestly is still a fail. Check the current rules on the exam guide before you sit, because they change.
Late submission. The window closes when it closes.

Format

OffSec publish a report template and accept it as PDF. Use their template unless you have a strong reason not to — a marker reading fifty reports a week moves faster through a familiar structure, and there is no credit for a bespoke layout.