An overview of OSWP and PEN-210

I passed the OSWP exam last year after about two months of training and I wanted to share some thoughts about the exam and about my experience with the PEN-210 course.

This blog was temporarily written by AI to test the visual radar. The handwritten blog will be available soon.

How to approach the PEN-210 course 📶

If you have a LearnOne subscription (the year-long access to OffSec’s platform), you get access to two “lighter” courses on top of your main course: PEN-100 (KLCP) and PEN-210 (OSWP). I’d suggest starting with PEN-210: the content is the same level as PEN-200, but the duration is much shorter (about 23 hours of content).

As for how long to wait before taking the exam, I recommend not going beyond two months. In other words, if you get your platform access on January 1st, aim for an OSWP exam date around March 1st. This course is completely optional: there’s no obligation to take it or to sit the exam. That said, it’s a nice introduction to get you used to OffSec’s more grueling certifications before tackling the OSCP.

The PEN-210 course content 📖

The course text is identical to the videos, so it’s easy to get through the content in a few days or a few weeks. It’s also a good opportunity to get familiar with taking notes in a tool like Obsidian.

You’ll quickly notice there are no hands-on exercises in the course. To apply the material and master it for the exam, you have two options:

1. Build your own lab at home; or
2. use the WiFiChallengeLabs VM to work through concrete exercises and train: https://lab.wifichallenge.com/.

WiFiChallengeLabs even offers a walkthrough so you can easily understand the commands to use across the different scenarios. It’s an excellent reference point: everything on the exam is covered in PEN-210, and you can apply the course material directly in these exercises.

Since WiFiChallengeLabs is free, you can even try it before you have access to OffSec training, just to see whether the Wi-Fi field interests you.

What to expect on the OSWP exam 📝

The OSWP exam uses an environment very similar to the OSCP’s, but it only lasts 4 hours instead of 24. During the exam, you can use the course material to help with certain technical steps, as needed. You still need to know in advance where the relevant information is in the curriculum, so you don’t waste too much time during your attempt. It’s also good practice for building a time-management strategy.

Your mindset is more important than you’d think: make sure you’re well rested and in a good mood before you start. Once you’re underway, I’d suggest first tackling the scenario you feel most comfortable with (whether it’s mandatory or not), to get yourself into a positive frame of mind before taking on the harder scenarios.

The report and what comes next 📄

Once the exam is complete (with or without the passing score), you have to write a pentest report, due within 24 hours of the end of your attempt. Good news: you can use OffSec’s default template, which is quite solid.

I strongly suggest writing the report even if you didn’t get the passing score. It’s much longer than it looks, and you’ll have to produce an even bigger one for the OSCP. So it’s excellent practice for that next challenge.

In short, the OSWP is a nice gateway into OffSec’s world: a short course, free exercises to train with, and an exam format that prepares you mentally (and logistically) for the OSCP. If you’re hesitant to dive into the more demanding certifications, it’s an excellent first step.

Thanks for taking the time to read all of this. I hope it helps you approach PEN-210 and the OSWP exam with a bit more confidence!