How to Write a Winning OSCP Exam Report

A pass-worthy OSCP report is the difference between compromising the machines and actually earning the certification, and it is where too many otherwise successful attempts fall apart. With clean exam notes in hand, expect one to two focused days to turn raw output into a polished PDF, on top of the exam fee and any prep already spent. This guide covers how to write oscp exam report submissions that satisfy OffSec’s formal requirements: complete per-target evidence, correct structure, and exact file and submission rules. Get this stage right and your technical work finally counts.

OffSec is explicit here. You must submit a penetration test report describing the exploitation process for each target, including steps, commands, and console output, in a single PDF, and the OSCP Exam Guide and PEN-200 Reporting Requirements define what “complete” means. Before you touch a template, it helps to understand exam mechanics in our OSCP exam format guide and to sanity-check budget with our OSCP exam cost breakdown.

Table of contents

What a winning report proves

A strong report is not flashy. It is complete, professional, and compliant. The grader is verifying that each claimed compromise is reproducible from your evidence, so the report has to walk from discovery to proof flag without gaps.

Four things separate a passing report from a rejected one:

• Every compromised target is documented end to end, from initial enumeration to the proof flag.
• All required proof elements appear in proper screenshots: flag contents, current user, hostname, and relevant network details.
• The structure matches a professional penetration test layout with an executive summary, methodology, per-target sections, a dedicated Active Directory chain, and recommendations.
• File format, naming, archiving, and submission rules are followed exactly.

Miss any of these and OffSec can zero out a machine you actually owned, or reject the submission outright.

Prerequisites checklist before you write

Do not open a template until these are true. Each missing item is a reason OffSec can reject or fail the attempt.

1. You have all required flags: local.txt and proof.txt from each target you compromised.
2. You saved console output, commands, and notes for every key step: recon, exploitation, privilege escalation, and cleanup.
3. You captured screenshots showing flag contents, current user, hostname, and relevant network info together in a single terminal view where required.
4. You have read OffSec’s reporting and submission rules in the OSCP Exam Guide and PEN-200 Reporting Requirements, not a paraphrase of them.
5. You have a template or outline covering cover page, executive summary, methodology, per-machine sections, the AD chain, and recommendations.
6. You can produce the PDF and archive it into an unencrypted .7z file under the size limit.
7. You know the submission window: the exam report is due within 24 hours of exam completion.

If any line fails, fix it before writing. Reporting is graded against completeness, and a missing screenshot cannot be recreated after the environment is gone.

Step-by-step: writing the report that passes

Step 1 – Read the official requirements first

Start with the source of truth. The OSCP Exam Guide states you must write a professional report describing your exploitation process for each target and document all attacks with steps, commands, and console output. The PEN-200 Reporting Requirements confirm the submission must be a PDF containing screenshots and descriptions of attacks and results. Reading both first prevents the majority of reporting-stage failures, because most rejections come from ignoring a rule that is written plainly in these two documents.

Step 2 – Lock your report structure

Use a professional penetration testing layout. A dependable structure runs: cover page (name, OSID, exam date), table of contents, executive summary, methodology, per-machine sections, a dedicated Active Directory section, maintaining access and house cleaning, recommendations, and appendices. Community-maintained OSCP templates converge on this shape because it mirrors what OffSec expects from a real assessment. Set this skeleton up before you start pasting evidence so nothing lands in the wrong place.

Step 3 – Collect and verify evidence per target

Evidence quality is where reports live or die. For each machine, show the chain, not just the win:

• How you discovered the vector, with the enumeration output that led to it.
• The key request, command, or exploit code that gave initial access.
• Output proving that access, such as a shell prompt, file read, or privileged action.
• The enumeration that revealed the privilege escalation path and the exact escalation steps.
• A screenshot reading the required flag (local.txt or proof.txt) from its original location.
• One terminal view showing flag contents, whoami, hostname, and network information together.

The grader should be able to trace a single unbroken line from vector identification through privilege escalation to the final proof, with commands and outputs present throughout.

Step 4 – Write the executive summary

This section is for a non-technical, management-level reader. Keep it short and clear. Cover scope (exam environment, number of targets, AD set if applicable), your methodology in one or two sentences, overall results (machines compromised, critical issues, general risk level), and high-level remediation priorities. Place it early. A tight summary signals professionalism; a dense, jargon-heavy one makes the whole report harder to grade.

Step 5 – Document each standalone machine

Use the same subsection order for every host so the grader never hunts for evidence:

1. Information gathering and service enumeration.
2. Initial foothold: attack vector and exploit.
3. Getting user (local.txt): commands and evidence.
4. Privilege escalation: methods, commands, and reasoning.
5. Getting root (proof.txt): commands and screenshot.
6. Vulnerability explanation and fix: a short note on what went wrong and how to remediate.
7. Proof-of-concept code: exploit snippets embedded as text inside the report, never as external files.

Consistency across machines is itself a scoring advantage, because reviewers can validate faster when every section behaves the same way.

Step 6 – Document the Active Directory chain

Modern OSCP exams include an AD set, and the chain must read as a coherent narrative. In your AD section, describe initial access to the first host, then show how credentials were obtained, stored, and reused across machines. Walk lateral movement host by host through to Domain Controller compromise. Include a credential table listing each credential, how it was obtained, and where it was used, and provide the same proofs (flags, screenshots, user and host info) you gave standalones. OffSec’s guidance on the current exam stresses showing the full AD chain from foothold to DC, and a fully exploited AD set is tied to lab bonus criteria where applicable.

Step 7 – Add recommendations, cleanup, and appendices

A professional report closes the loop. Add technical recommendations per major finding (patching, hardening, monitoring), house cleaning steps to remove tools, users, and artifacts where applicable, and appendices holding full command logs, a consolidated proof table of every local.txt and proof.txt value, and anything not captured in the main sections. These sections show you treated the exam like a real engagement rather than a flag hunt.

Step 8 – Technical QA: format, naming, size

Before exporting the final PDF, run a hard technical check:

• The report is a single PDF.
• All scripts and proof-of-concept code are embedded as text inside the PDF, not shipped as separate files.
• File naming is exact: PDF as OSCP-OS-XXXXX-Exam-Report.pdf where OS-XXXXX is your OSID, and the archive as OSCP-OS-XXXXX-Exam-Report.7z with the same base name.
• The .7z archive is not password-protected and is below the maximum allowed size (commonly 200MB).
• Every required target, flag, and piece of evidence is present; a missing element can mean zero points for that machine.

Incorrect file names, passworded archives, and missing evidence are recurring causes of a technically successful exam failing at the reporting stage.

Step 9 – Submit within the window

Upload the .7z archive to OffSec’s portal within the 24-hour window after exam completion, then confirm the upload succeeded and matches the OSCP Exam Guide instructions. No report, or a late one, means no pass even when your technical score would have been enough. Treat the clock as part of the exam.

If you would rather start from a compliant, exam-aligned framework than assemble one under time pressure, our OSCP exam support services provide mentor-backed report structures with instant delivery.

Common mistakes and how to fix them

Missing screenshot elements. A screenshot shows the flag but not whoami, hostname, or network info. That machine can score zero despite a clean compromise. Re-capture with all four elements in one terminal view.

Incomplete attack chain. You show the final exploit but not how you found the vector or escalated. The reviewer cannot verify your methodology and points drop. Document discovery, exploitation, privilege escalation, and proof for every target, with commands and outputs.

Wrong file name or archive format. An incorrect PDF or .7z name, or a password-protected archive, can get the submission rejected. Match OffSec’s naming exactly and keep the archive unencrypted.

External scripts instead of embedded code. Separate script files, or exploit code left out of the PDF, make the report look incomplete and hard to validate. Paste relevant snippets and command sequences directly into each machine section, clearly labeled.

Weak executive summary. An overly technical or muddled summary lowers perceived professionalism and slows review. Rewrite it as a short, non-technical overview of scope, results, and high-level risks.

DIY or mentor support: making the call

Many candidates write a strong report alone using the steps above, and that is the right path when you have time and clean notes. The calculus shifts if you already failed an attempt over reporting issues, you are short on time after a draining exam, or you struggle to convert raw notes into a professional deliverable. Under a 24-hour clock, a self-built structure is where subtle compliance mistakes creep in.

Where support earns its place is on the parts that cost people points: a pre-built, compliant template, guidance on structuring per-machine and AD sections, and a final checklist that catches missing screenshots, absent commands, or a bad file name before you upload. If that matches your situation, review current mentor options through our OSCP exam support services, built around instant delivery and mentor-backed assistance for OSCP candidates. The same approach carries into related credentials, so if you are stacking certifications you can also see how we handle the CPTS exam writeup and the BSCP exam writeup.

Frequently Asked Questions

How long should my OSCP exam report be?

There is no fixed page count. OffSec expects a comprehensive penetration test report that clearly demonstrates how you achieved the exam objectives. Templates and guidance weight completeness of methodology, evidence, and findings far above raw length.

Do I need both an exam report and a lab report?

OffSec expects an exam penetration test report for certification and may award lab bonus points when a qualifying lab report is submitted alongside it. OffSec notes that lab reports need not be long but must show exploitation steps for at least one fully exploited AD set to earn the full bonus where applicable.

Can I pass OSCP without a report?

No. No report means no pass, even with a sufficient technical score. You must submit a compliant exam report within the allowed time window to be awarded the certification.

Can I reuse a community template instead of building my own?

OffSec does not mandate a specific template, but the report must behave like a professional penetration test and include all required sections and evidence. Many candidates succeed with community templates that mirror OffSec’s expectations: high-level summary, methodology, per-machine details, proofs, and recommendations.

How important is documenting the AD chain?

Very. For modern exams, a clear AD narrative covering initial foothold, lateral movement, DC compromise, and credential usage is central, especially where AD-related scoring and lab bonus points apply. OffSec highlights full AD exploitation and documentation as a key part of assessment.