The OSWP exam is the shortest practical certification OffSec offers, and the one where preparation material is most easily wasted. Four hours, three wireless scenarios, one proof file. There is no report to write and no partial credit for a nearly-working attack.
That structure explains why candidates search for the latest consolidated notes every few months: the exam is small enough that people assume a compact answer set exists. It does not, because the scenarios depend on radio conditions, adapter behaviour, and access point configuration that differ per attempt.
The exam, precisely
- Duration: four hours, proctored by an OffSec employee over a private VPN.
- Scenarios: three wireless networks. You must obtain the wireless key for each.
- Constraint: only one scenario is active at a time.
- Objective: connect to the target access point and retrieve the proof file from
http://192.168.1.1/proof.txt. - Certification validity: does not expire.
- Course: PEN-210, sixteen content modules covering 802.11 fundamentals, reconnaissance, WPS, and rogue access points.
No formal prerequisites are listed, but the practical baseline is Linux comfort, TCP/IP fluency, and a working understanding of 802.11 frames and encryption. The exam assumes you can already operate a wireless adapter in monitor mode without a tutorial.
Why chasing the newest collection does not work
Wireless attacks are unusually sensitive to the environment. The same technique succeeds or fails depending on:
- Adapter and chipset. Monitor mode and packet injection support vary by driver. A walkthrough written on an Atheros card may not reproduce on a Realtek one.
- Signal and distance. Capture quality changes with radio conditions, and a weak handshake produces a crack that never completes.
- Access point configuration. WPA2 versus WPA3, WPS state, client behaviour, and whether the network uses enterprise authentication all change the path.
Notes from another candidate describe their hardware and their radio environment. What transfers is the decision tree: what to check first, what a failed capture tells you, and when to abandon a path. That is what good preparation material should contain, and it is rarely what a labelled collection does contain.
A four-hour plan
The clock is short enough that improvisation costs the exam. Work in fixed blocks.
| Block | Time | Task |
|---|---|---|
| Setup | 15 min | Adapter in monitor mode, interface check, channel plan |
| Recon | 20 min | Identify all visible networks, encryption types, clients |
| Scenario 1 | 60 min | Capture, crack, connect, proof |
| Scenario 2 | 60 min | Repeat with the technique that fits the configuration |
| Scenario 3 | 60 min | Final network, hardest by design |
| Buffer | 25 min | Recovery from a failed capture or a driver reset |
Fifteen minutes of setup is not padding. Most failed attempts start with an adapter that was never fully in monitor mode, or a channel plan that missed the target network.
The technique map
Three scenarios usually map to three families of attack. Recognising which family applies is most of the work.
WPA/WPA2 personal
Capture a four-way handshake and crack it offline. The failure modes are well known: no client to deauthenticate, a capture that contains only part of the handshake, or a passphrase outside your wordlist. Check the capture before you start cracking — quality first, compute second.
WPS-enabled networks
Where WPS is enabled and not locked out, the PIN path can be faster than a handshake attack. Confirm the state first: a router with WPS locked after failed attempts will not cooperate, and retrying resets the timer rather than progressing.
Rogue access point and client behaviour
Some scenarios test whether you can create a rogue AP and observe clients connecting to a network with the same name. This is a different skill from cracking: it depends on beacon configuration, channel selection, and understanding why a client chooses one AP over another.
What to practise before booking
- Adapter fluency. Bring your interface up in monitor mode, switch channels, and capture on a network you own, without looking at notes.
- Capture quality checks. Learn to tell a complete handshake from a partial one before running a cracker.
- Wordlist discipline. Know which list you will use and why. A generic list wastes the clock when the passphrase is a phone number or a company name.
- Rogue AP setup. Build one against your own device and confirm a client connects. The exam version is the same operation under time pressure.
- Failure recovery. Deliberately break your setup — wrong channel, interface down, driver reload — and time how long recovery takes.
If you cannot do all five in under thirty minutes total, the exam will be a race you are not ready for.
The hardware question
OffSec does not require specific hardware, but the exam does require an adapter that supports monitor mode and injection. Test yours before exam day: bring the interface up, capture traffic, and inject a deauthentication frame against your own access point. If injection fails, the exam is over before it starts.
Have a second adapter if you own one. Driver failures during a four-hour window are not recoverable by reinstalling packages.
Is OSWP worth it?
It is a specialist certification, and it is honest about that. It does not expire, it takes four hours rather than a week, and it demonstrates a skill most penetration testers claim but few can show. For network security roles, wireless assessments, or physical engagements that include Wi-Fi, it is a credible differentiator.
It is not a substitute for OSCP or CPTS. It covers one attack surface well, and the exam reflects that narrow focus. Candidates who treat it as a smaller OSCP tend to underestimate how unforgiving a four-hour practical can be.
Where to go next
For the certification overview, pricing, and available study material, see the OSWP certification hub. If you are building a broader offensive skill set, the OSCP hub covers the generalist path, and the Linux privilege escalation checklist covers the post-exploitation step that follows a wireless foothold.
Certification names belong to OffSec. This is independent study material, not official course content.
Web application security specialist and bug bounty hunter. OSWA and OSWE certified, focused on web exploitation, API security and source-code review. Writes our web exploitation walkthroughs and reviews report structure for web-focused certifications.