OSEP review

I passed OSEP on 5 August 2025, first attempt, with 15 flags. I’d already done OSCP, CRTO and CRTP before this, which helped a lot, because so much of OSEP is Active Directory and I wasn’t picking that up from scratch. If you’re coming straight off OSCP with no AD exposure, the jump will be bigger for you than it was for me, so give the directory material extra time.

How I studied

I went with the 90-day lab access and spent about two months going through the course, roughly 4-5 hours a night. I got through six of the eight challenge labs and ran out of time on 7 and 8, and still passed fine, so you don’t have to finish all of them.

A couple of things outside the official material helped. One was Cas van Cooten’s OSEP-Code-Snippets repo on GitHub, which has working code for most of the techniques and saved me a lot of time. The one I’d single out is the process hollowing payload, which you can reuse almost as-is. The other thing that helped was having my own lab to build and test payloads in before using them, so I knew they’d get past Defender instead of finding out the hard way on a target.

One thing I’d do sooner if I started again is use AI to explain the topics I didn’t understand. I’d get Claude to explain something to me like I was five and then work up from there. For the delegation types and some of the .NET bits, that turned days of being stuck into an evening.

The exam

It’s 48 hours hands-on and then another 24 for the report. You need 10 flags to pass. I finished the hands-on part in about 24 hours with 15, so I wasn’t cutting it close, and no, I didn’t get full compromise. I never got secret.txt, and you don’t need it to pass.

Getting the first foothold took about two hours. After that it’s mostly enumeration and pivoting: get in somewhere, look at what else you can reach, dump and spray credentials, run the AD attacks, and keep going. There was always a path from one machine to the next.

The phishing part caught me out. I wasn’t even sure there was phishing in the exam until I found something that pushed me towards trying it, and then getting a payload to actually land took me around two hours of trying different ones and testing them in my own lab. Steffin Stanly’s phishing notes are a good reference for the payloads here. And if something should work but doesn’t, revert the box before you assume your payload is broken. A few times it was the machine and not me.

What kept me on track was putting a time limit on each lead. If I didn’t get anywhere with a vector in 30-45 minutes I’d drop it and try the next one, otherwise it’s easy to disappear down a rabbit hole. The exam isn’t trying to catch you out with things from outside the course, so look for the obvious stuff first and use what you did in the labs. I also went back over my enumeration notes more than once, because the thing I thought I’d missed was usually already sitting in a scan I’d run.

I slept the night before and made sure I was rested going in. During the exam I took breaks for food and to cool off when I got stuck, and got maybe three hours of sleep. The rest of the time went on the report.

The report

Mine took about eight hours and came out to 80-something pages with screenshots. I used OffSec’s OSEP report template, and my OSCP and CRTO reporting habits carried over. One piece of advice: write the report during the first 48 hours, not in the spare 24 at the end. When I started writing it up I realised I was missing a few screenshots, and I was lucky the machines were still up so I could redo those steps and grab them. If I’d left it to the last day I might not have been able to.

What it covers

The main things I came away comfortable with:

• AV and Defender evasion, and testing payloads against it beforehand.
• Windows post-exploitation: dumping credentials, trusts, moving around once you’re on a host.
• Active Directory: constrained and unconstrained delegation, resource-based delegation, and generally how someone moves through a domain. I probably spent too long here trying to understand them.
• SQL Server. I figured I’d run into a database or two, so getting RCE and escalating through MSSQL and linked servers was worth the time.
• Config management like Ansible and Vault, for when you land in that kind of setup.

One bit of advice

If I could give one piece of advice to someone about to take it: go through the challenge labs and come up with a methodology for what you do once you’re inside the network. Then run the same enumeration steps on every machine and you’ll keep finding your next target. Enumerate, enumerate, enumerate. A lot of the time the vector isn’t as complicated as it looks. NetExec (nxc) is extremely useful for this.

Worth it?

I’d say yes, up to a point. It made me better at evasion and at moving through a Windows network, and those carry over. The thing to keep in mind is that a real engagement isn’t as tidy as the exam. In the labs there’s always a clean path to the next box; on an actual job there often isn’t, the defences are less predictable, and a loud payload has real consequences. Take OSEP for the skills and the habits it forces on you, just don’t expect real networks to lay themselves out as neatly.