OSCP Standalone Machines are three independent targets in the OffSec OSCP+ practical examination, collectively worth 60 of the 100 available points. Each standalone machine evaluates a candidate’s ability to enumerate services, identify security weaknesses, obtain initial access, escalate privileges, and document the assessment process.
For candidates preparing in 2026, standalone practice remains essential. Unlike the Active Directory portion of the exam, independent targets are assessed separately, allowing candidates to earn partial credit for successful initial access even when privilege escalation remains incomplete.
This guide covers OSCP standalone machine scoring, common Windows and Linux attack surfaces, laboratory examples, enumeration methodology, privilege escalation, time management, and the latest examination changes.
What Are OSCP Standalone Machines?
OSCP Standalone Machines are independent Windows or Linux systems designed to assess practical penetration testing skills.
The current OSCP+ examination includes three standalone targets, each worth 20 points.
A candidate can earn 10 points for obtaining the required low-privilege access and another 10 points for completing the privilege escalation objective.
| Exam component | Machines | Available points |
|---|---|---|
| Standalone machine 1 | 1 | 20 |
| Standalone machine 2 | 1 | 20 |
| Standalone machine 3 | 1 | 20 |
| Active Directory set | 3 | 40 |
| Total | 6 | 100 |
Each independent machine can have a different operating system, service configuration, application stack, and vulnerability profile.
The key is not to memorize a specific exploit. It is to develop a methodology that works across unfamiliar environments.
According to the official OSCP+ Exam Guide, standalone targets award separate points for initial access and privilege escalation.
OSCP Standalone Machines: 2026 Scoring Update
Candidates preparing for OSCP Standalone Machines should understand the scoring change announced by OffSec on October 6, 2026.
For examinations taken through November 30, 2026, candidates must earn at least 70 out of 100 points to pass.
Beginning December 1, 2026, OffSec will introduce equated scaled scoring. Under this system, raw points will be converted to a scaled result based on the assigned examination set.
This means 70 raw points will no longer be a universal passing threshold after the transition.
The technical examination structure will remain unchanged: three standalone machines and one Active Directory chain.
| Exam date | Passing method |
|---|---|
| Through November 30, 2026 | Fixed 70/100 passing score |
| December 1, 2026 onward | Equated scaled scoring |
| Standalone structure | Three independent machines |
| Standalone raw points | 60 total |
| Active Directory raw points | 40 total |
The same technical competencies remain relevant regardless of the scoring model.
Read the official OffSec OSCP+ Scoring Update for the full announcement.
OSCP Standalone Machines List: Practice Scenarios and Learning Areas
Candidates often search for an OSCP Standalone Machines list to identify useful practice targets and understand common service configurations.
CyberServices.Store’s existing standalone article mentions several machine labels in third-party study discussions.
These names should not be interpreted as a verified list of current official examination targets.
They are useful as references for organizing independent study, but their exact configurations, availability, and association with any official exam set are not independently established here.
Standalone Machine Names Referenced in Study Material
| Referenced machine | Recommended study focus |
|---|---|
| Shoppr | Web application assessment and authentication |
| Skull | Linux enumeration and privilege boundaries |
| RiteCMS | CMS security and application configuration |
| Beatbox | Service discovery and application analysis |
| BarracudaServer | Network services and configuration review |
| Launch6 | Windows service enumeration |
| FMS | Web and service interaction |
| Library Education | Multi-service investigation |
| Inbit Messenger | Application functionality and authorization |
| Argus | Windows application and service security |
| WBCE | Web application and file-handling controls |
| TSW | General standalone methodology |
| Coaching Center | Web application assessment |
| Job Application Portal | Input handling and access control |
These learning focuses are suggested practice categories, not verified vulnerability descriptions for each named machine.
The purpose of reviewing a machine is to understand its attack surface and develop a reproducible assessment methodology.
A hostname or machine label does not establish that a specific vulnerability, credential, or exploit is present.
Windows vs. Linux OSCP Standalone Machines
OSCP Standalone Machines may involve Windows or Linux systems.
Both require systematic enumeration, but their operating system architecture, authentication mechanisms, service management, and privilege escalation opportunities differ.
| Assessment area | Windows standalone | Linux standalone |
|---|---|---|
| Operating system | Windows Server or desktop variants | Linux distributions |
| Common remote access | RDP, WinRM, SMB | SSH |
| Web services | IIS and third-party servers | Apache, Nginx and others |
| Identity context | Local and domain identities | Local users and groups |
| Permissions | ACLs, service rights, privileges | File permissions, sudo, capabilities |
| Process and service management | Windows services and scheduled tasks | systemd, cron and other mechanisms |
| Privilege objective | Administrator or SYSTEM context | Root context |
A candidate should be comfortable investigating both platforms without assuming that all targets follow the same pattern.
Windows Standalone Preparation
Windows assessment requires an understanding of local users, groups, services, scheduled tasks, access control lists, installed applications, and system configuration.
For authorized laboratory practice, candidates should learn to identify relevant services, interpret access rights, and validate potential misconfigurations.
It is important to distinguish ordinary user access from local administrator privileges.
Linux Standalone Preparation
Linux assessment emphasizes filesystem permissions, service configurations, user identities, software versions, scheduled tasks, and privilege delegation.
Candidates should understand how applications run under different user accounts and how permissions affect access to protected resources.
Linux privilege escalation should be approached as an evidence-based investigation rather than a collection of unrelated commands.
OSCP Standalone Enumeration Methodology
Enumeration is the foundation of every successful OSCP Standalone Machines assessment.
The goal is to identify exposed services, understand their purpose, and determine which observations justify further investigation.
A disciplined process reduces wasted time and prevents candidates from relying on unsupported assumptions.
Step 1: Establish the Attack Surface
Start by identifying the services exposed by the authorized target.
Record the relevant protocols, listening ports, application names, service versions, and visible functionality.
A common laboratory tool is Nmap.
For example, an authorized basic TCP service discovery scan may use:
nmap -sV -sC -oA standalone-initial <TARGET_IP>The results should be treated as observations requiring interpretation, not as proof of a vulnerability.
Service banners can be incomplete or misleading.
Step 2: Prioritize Relevant Services
Not every exposed port deserves equal investigation time.
Prioritize services based on accessibility, authentication requirements, observed functionality, and available evidence.
| Port or service | Typical investigation focus |
|---|---|
| 21 / FTP | Authentication and file access configuration |
| 22 / SSH | Remote access and account security |
| 80 / HTTP | Web application behavior |
| 443 / HTTPS | Web functionality and access control |
| 139 / 445 / SMB | File shares and Windows permissions |
| 3389 / RDP | Remote desktop exposure |
| 3306 / MySQL | Database access configuration |
| 6379 / Redis | Service authentication and network exposure |
| 8080 / HTTP alternative | Secondary applications and administrative interfaces |
| 5985 / WinRM | Windows remote management configuration |
A port number alone does not prove that the service is vulnerable.
The security significance depends on the application, its configuration, authentication controls, and the surrounding environment.
Step 3: Investigate Web Applications
Web applications are common subjects in OSCP-style laboratory practice.
Candidates should examine application functionality, authentication flows, session management, file handling, input validation, and access-control behavior.
Useful questions include whether users can access resources outside their intended scope, whether sensitive information is exposed, and whether application configuration creates unintended access.
Avoid assuming that a specific framework or content management system automatically has an exploitable weakness.
Step 4: Evaluate Findings
Every suspected vulnerability should be evaluated against the observed environment.
Consider whether the finding is reproducible, whether its prerequisites are satisfied, and whether it creates a meaningful security impact.
When an investigation does not support the original hypothesis, document the result and move to another relevant area.
This is more productive than repeatedly attempting an exploit that does not match the target.
Step 5: Document Continuously
Maintain a structured record of services, observations, validated findings, evidence, and unresolved questions.
Good documentation helps prevent repeated work and supports accurate reporting.
Initial Access and Privilege Escalation
The OSCP Standalone Machines scoring model separates initial access from privilege escalation.
This distinction should influence preparation.
Initial access demonstrates that the candidate has reached the required lower-privilege execution context.
Privilege escalation demonstrates the ability to reach the target’s required administrative context.
Initial Access
Initial access may involve identifying a vulnerable application, an insecure service configuration, or another authorized assessment finding.
The specific path varies by target.
Candidates should focus on understanding why the access was possible and what privileges were actually obtained.
Privilege Escalation
After initial access, the assessment shifts to local system security.
Relevant concepts include operating system permissions, service configurations, application privileges, credential protection, and administrative delegation.
A professional methodology evaluates the evidence and identifies the conditions that make a particular weakness significant.
Why Partial Credit Matters
A standalone machine can award 10 points for the initial access objective even if the privilege escalation objective is not completed.
This makes accurate documentation and proof collection essential.
Candidates should follow the exam control panel and official guide when determining which evidence is required for a particular target.
OSCP Standalone Machines and Exam Time Management
Time management is especially important when three independent targets and an Active Directory set must be assessed during one practical examination.
A candidate can lose substantial time pursuing a weak hypothesis while easier opportunities remain unexplored.
A Practical Time Management Framework
Use the following approach during authorized practice:
- Perform an initial review of the available targets.
- Record exposed services and prioritize promising observations.
- Investigate one hypothesis at a time.
- Set a review point when progress stalls.
- Preserve evidence immediately after reaching a meaningful objective.
- Revisit unresolved targets with fresh observations.
These steps are a flexible workflow rather than a mandatory exam schedule.
The best allocation of time depends on the candidate’s strengths, the assigned targets, and the available evidence.
Avoid Common Rabbit Holes
A rabbit hole is an investigation path that consumes time without producing useful evidence.
Examples include repeatedly testing a vulnerability that does not match the application version, relying on unverified credentials, or ignoring a simpler service configuration issue.
A disciplined candidate periodically asks whether the current hypothesis is still supported.
If the evidence is weak, reassess the attack surface.
How to Practice OSCP Standalone Machines
Preparation should combine official training, independent practice environments, and technical reporting.
A useful progression starts with basic service discovery and moves toward more complex Windows and Linux assessments.
Official PEN-200 Training
OffSec’s PEN-200 course provides the official learning foundation for OSCP+ preparation.
Candidates should complete the relevant exercises and challenge environments while building a consistent assessment methodology.
Official training remains the most authoritative source for examination objectives and permitted tools.
Proving Grounds Practice
OffSec Proving Grounds Practice offers vulnerable systems that can help learners develop independent enumeration, exploitation analysis, and privilege escalation skills.
The most useful targets are not necessarily those with the highest difficulty rating.
Choose machines that address specific weaknesses in your current methodology.
Additional Authorized Laboratories
Other legal practice platforms can provide exposure to unfamiliar applications, operating systems, and configurations.
The important factor is whether the exercise develops transferable skills.
Avoid memorizing walkthroughs without understanding the underlying weakness.
For a broader platform comparison, read our Best OSCP Practice Labs Guide.
OSCP Standalone Machines: Reporting and Evidence
A successful technical assessment is not complete until its findings are documented.
OffSec requires candidates to submit a professional report describing the assessment process, commands, evidence, and results.
The official guide also specifies how proof files must be obtained, submitted, and shown in screenshots.
Insufficient documentation can result in lost points.
Recommended Reporting Structure
| Report section | Purpose |
|---|---|
| Target overview | Identify the authorized system and scope |
| Enumeration | Document exposed services and observations |
| Vulnerability analysis | Explain the confirmed weakness |
| Initial access | Describe the validated access and evidence |
| Privilege escalation | Document the administrative objective |
| Proof evidence | Include the required screenshots and submissions |
| Remediation | Explain how the underlying weakness can be corrected |
| Conclusion | Summarize the verified result |
For the official examination, candidates must follow OffSec’s exact reporting rules rather than relying on a generic template.
The exam provides 23 hours and 45 minutes for the practical assessment and an additional 24 hours for report submission.
Common OSCP Standalone Machine Mistakes
Candidates often struggle with OSCP Standalone Machines because of inconsistent methodology rather than a complete lack of technical knowledge.
Common mistakes include incomplete service discovery, ignoring secondary web applications, assuming service versions establish vulnerabilities, and failing to document findings.
Another frequent problem is focusing entirely on initial access while neglecting privilege escalation practice.
Because both objectives contribute to the standalone score, preparation should cover the complete assessment lifecycle.
Candidates should also avoid relying on claims that specific named machines or credentials are guaranteed to appear in the current examination.
The strongest preparation is transferable across unfamiliar targets.
OSCP Standalone Machines Study Resources
CyberServices.Store provides supplementary OSCP technical reports and preparation resources covering standalone systems, Windows and Linux security, Active Directory, and penetration testing documentation.
These materials can help learners review assessment methodology and compare approaches across authorized training environments.
Before purchasing, review the individual product descriptions, supported topics, file formats, and intended educational use.
Third-party resources should complement official PEN-200 training and independent laboratory work.
Explore OSCP Standalone Machine Study Materials
For broader preparation guidance, see our OSCP Study Guide 2026 and OSCP Exam Strategy Guide.
OSCP Standalone Machines FAQ
How many OSCP Standalone Machines are in the exam?
The OSCP+ practical examination contains three independent standalone machines.
How many points are OSCP Standalone Machines worth?
The three machines are worth 60 raw points in total, with 20 points available per machine.
Can I earn partial points on a standalone machine?
Yes. The current scoring structure awards 10 points for the initial access objective and 10 points for privilege escalation.
Are OSCP Standalone Machines Windows or Linux?
Standalone targets may use Windows or Linux. Candidates should prepare for both operating systems and their different security models.
Are standalone machines connected to the Active Directory set?
The standalone machines are independent assessment targets. The Active Directory portion is a separate three-machine set.
Is the OSCP+ passing score still 70 points?
For exams taken through November 30, 2026, the passing requirement is 70 out of 100 points. From December 1, 2026, OffSec will use equated scaled scoring instead of a universal fixed raw-point cutoff.
Are Shoppr, Skull and RiteCMS official current exam machines?
These names appear in third-party study discussions. Their presence in such material does not verify that they are current official OSCP+ examination targets.
What skills are important for OSCP standalone preparation?
Service enumeration, web application assessment, Windows and Linux security, initial access analysis, privilege escalation, and professional reporting are essential.
Is privilege escalation required for full standalone points?
Yes. Each standalone machine has separate initial access and privilege escalation objectives, and both are required to earn its full 20 raw points.
Can I use automated exploitation tools during the OSCP exam?
OffSec restricts certain tools and automation. Candidates must consult the current official exam guide for permitted usage and limitations.
Are OSCP standalone walkthroughs useful?
Walkthroughs can help explain authorized laboratory methodology, but they should not replace independent problem-solving or be treated as guaranteed current exam solutions.
Where can I find OSCP standalone study materials?
Explore the CyberServices.Store OSCP resource collection and use official PEN-200 training as the foundation.
Final Thoughts
OSCP Standalone Machines remain a major component of the OSCP+ practical examination, accounting for 60 of the 100 available raw points.
Successful preparation requires more than memorizing exploits or machine names. Candidates need reliable enumeration habits, Windows and Linux security knowledge, evidence-based vulnerability analysis, privilege escalation skills, and accurate documentation.
The December 2026 scoring change does not alter the underlying technical skills or the three-machine standalone structure.
Focus on repeatable methodology, authorized practice, and professional reporting.
Browse OSCP Standalone Machines and Study Resources
