Four hours sounds generous until you are inside the first scenario and the handshake will not capture. The OSWP exam compresses everything into a window shorter than most people’s commute, and the constraint that only one scenario is active at a time removes the option of working on two problems in parallel.
What follows is what the day actually feels like, and the decisions that separate a finish from a scramble.
The shape of the four hours
Three wireless networks, each with a key to recover. Only one is active at a time, so the sequence is fixed: finish or abandon, then move on. The objective is not the key itself but what it unlocks — connect to the access point and retrieve the proof file from http://192.168.1.1/proof.txt.
That last step is where candidates who “got the key” still lose time. A recovered passphrase is not a result until you are associated with the AP and the proof file is in your notes.
The first fifteen minutes decide the day
Setup is the most common failure point, and it happens before any attack begins.
- Adapter in monitor mode. Confirm it with a capture, not with a command that returned no error.
- Injection test. Send a deauthentication frame against your own AP. If injection fails, nothing downstream will work.
- Channel plan. Know which channels your target networks use and switch deliberately rather than scanning everything continuously.
- Interface naming. Confirm the monitor interface is the one your tools are using. This sounds trivial until a capture returns zero packets.
Candidates who skip the injection test discover the problem at minute forty, when a handshake capture produces nothing and the cause is ambiguous.
Scenario one: the confidence trap
The first network is usually the most familiar. WPA2 personal, a client present, a handshake to capture, a wordlist to run. It feels like the labs, and that confidence is useful — but it also encourages an early mistake: cracking with a generic list before confirming the capture is complete.
Check the capture first. Four complete EAPOL frames, the right BSSID, the client’s MAC. A partial capture can run for twenty minutes and never produce a key.
Scenario two: the configuration changes
The second network often tests a different path: WPS enabled and not locked, or a configuration where the handshake route is blocked. Recognising the switch is the skill. If the network advertises WPS and the router is not rate-limiting, the PIN route is faster. If it is locked, retrying resets the timer and wastes the block.
Ask three questions before committing:
- What encryption is in use, and is there a client to deauthenticate?
- Is WPS visible, and does it respond to a probe?
- Is there a rogue-AP angle — a hidden SSID, a client probing for a network that is not there?
The answers determine the next twenty minutes. Guessing costs the block.
Scenario three: the one that does not behave
The final network is the hardest by design, and it usually arrives when you are tired. Two failure modes dominate: repeating the technique that worked in scenario one, and abandoning too early.
If the handshake will not come, check whether a client is actually associated and whether your deauth is reaching it. If it is a rogue-AP scenario, the work is in beacon configuration and watching client behaviour, not in cracking.
The decision rule: if a technique has produced no new information in fifteen minutes, switch approach. Not because the technique is wrong, but because the environment is telling you it does not apply.
What candidates underestimate
The exam is less about wireless theory than about operating a radio under time pressure. The candidates who pass are not the ones who know the most about 802.11 frames; they are the ones whose adapter works, whose capture habit is disciplined, and who can tell the difference between “no client” and “wrong channel”.
The other thing candidates underestimate is how much of the four hours is spent waiting. Cracking takes minutes; capture takes patience. A candidate who fills the wait with a second failed attempt loses focus. A candidate who uses it to verify the capture and prepare the connection step does not.
Preparation that actually helps
- Own hardware drills. Capture your own handshake twenty times until the sequence is automatic. Then break it deliberately — wrong channel, interface down, driver reload — and time the recovery.
- Wordlist discipline. Know which list you will run and why. Exam passphrases tend to be patterned, not random; a targeted list built from the SSID and common conventions beats a generic dump.
- Rogue AP practice. Build one and confirm a device connects. The exam version is the same operation with less time.
- Proof discipline. Practise the full chain: key, association, HTTP request, proof saved with a timestamp. The last step is part of the exam, not an afterthought.
- Four-hour simulations. Three networks, one at a time, timer visible. Twice before booking.
Mistakes that cost the attempt
- Skipping the injection test because monitor mode “looked fine”.
- Cracking a partial capture and assuming the passphrase is not in the list.
- Working across scenarios when only one is active, wasting time on a network that is not reachable.
- Forgetting the proof step after recovering the key.
- No recovery plan for a driver failure at hour three.
Is the experience worth it
Yes, for a specific reason: it is the only mainstream certification that forces you to operate wireless attacks end to end, with real radio conditions, inside a fixed window. The skill is narrow but genuinely practical, and the certification does not expire.
It is not a stepping stone to OSCP in any technical sense. It is a specialist credential, and the exam reflects that focus. Treat it as its own discipline and prepare for the clock, not the theory.
Where to go next
For the certification overview, pricing, and study material, see the OSWP certification hub. For a time-blocked breakdown of the exam itself, read OSWP exam: three wireless scenarios in four hours. If you are continuing to a generalist certification, the OSCP hub is the next step.
Certification names belong to OffSec. This is independent study material, not official course content.
Web application security specialist and bug bounty hunter. OSWA and OSWE certified, focused on web exploitation, API security and source-code review. Writes our web exploitation walkthroughs and reviews report structure for web-focused certifications.