OffSec PEN-200 (OSCP)

Prerequisites

While there are no formal prerequisites, learners are strongly advised to have:

• A solid understanding of TCP/IP networking
• Familiarity with Linux and Windows operating systems
• Basic scripting ability in languages such as Bash or Python

To prepare for PEN-200, learners may benefit from completing the OffSec SEC-100: Security Essentials course.

Please note – learners are required to read the document in your MyQA portal after your course booking is confirmed. This document will advise learners to use a suitable personal computer, as corporate or organisation-managed laptops frequently restrict VPN connections, external lab access, and practical hacking activities, even when access is provided remotely by QA.

If learners must use a corporate laptop, they should ask their IT department to approve and test all required access before the course starts, or arrange an alternative computer without any restrictions.

For PEN-200, learners should arrive with Kali Linux already installed, configured and tested on their computer, following the course setup guidance. This will help us begin practical activities promptly and avoid spending valuable training time resolving setup issues.

Target audience

This course is aimed at cybersecurity professionals looking to build advanced ethical hacking skills and pursue the OSCP certification. It is particularly suitable for:

• Security analysts, penetration testers, and threat hunters
• IT professionals with prior experience in networking and system administration
• Learners seeking a career transition into offensive securit

OffSec PEN-200 (OSCP) Course Content

Introduction to cybersecurity

• Overview of key concepts, threats, and technologies
• Role of ethical hacking in modern cybersecurity

Report writing for penetration testers

• Structuring technical findings for business stakeholders
• Writing clear, concise, and impactful remediation advice

Information gathering

• Using tools like Nmap and Shodan for reconnaissance
• Network mapping and identifying potential targets

Vulnerability scanning

• Using common tools and more
• Interpreting scan results and prioritising vulnerabilities

Introduction to web applications

• Architecture of modern web applications
• Identifying structural weaknesses and exposure points

Common web application attacks

• Exploiting cross-site scripting (XSS)
• Injection flaws and session management weaknesses

SQL injection attacks

• Identifying injectable parameters
• Extracting data and escalating privileges via SQLi

Client-side attacks

• Analysing browser-based vulnerabilities
• Exploiting client-side flaws in JavaScript and plugins

Locating public exploits

• Finding and evaluating exploits from trusted sources
• Integration into the penetration testing workflow

Fixing exploits

• Customising existing payloads to bypass defences
• Developing reliable proof-of-concept attacks

Exams and assessments

Learners will have x2 exam vouchers, those who complete the course and successfully pass the 24-hour hands-on OSCP exam will earn the OffSec Certified Professional (OSCP) or OSCP+ certification. These certifications demonstrate the ability to compromise multiple machines in a controlled lab environment and are recognised for their rigorous practical requirements.

Hands-on learning

This course provides immersive practical experience through:

• Live lab environments simulating enterprise-grade infrastructure
• Real-world scenarios for each exploit covered
• A full 12-month OffSec LearnOne (PEN-200) subscription
• Continuous support and guidance through interactive learning modules