Free and low-cost OSCP preparation resources can help you practise enumeration, Linux fundamentals, web testing, and clear reporting before paying for a course. Start with the skill you need to improve and an environment you are authorized to use.
Use your available hours to build a repeatable practice routine. A total such as 150–300 hours is an example allocation, not a measured requirement or evidence that a learner will pass.
This guide maps Kioptrix, VulnHub, PG Play, and other practice resources to specific learning goals. Choose additional Windows, Active Directory, and pivoting practice where the free Linux machines do not cover your needs.
If you’re balancing a job, a life, and a half-functioning laptop—and you still want that red team dream? You’re in the right place. We’ll even throw in a quick 60-second budget calculator so you can see where you stand. No fluff, no “just grind harder” nonsense. Just a smart, scrappy blueprint for passing the OSCP like a pro—without lighting your wallet on fire.
- Official PEN-200 + OSCP bundle: around $1,749 for 90 days + 1 attempt (Source, 2025-09).
- PG Play: 3 hours/day of free labs on VulnHub machines (Source, 2024-01).
- Self-hosted VulnHub/Kioptrix: downloadable practice images; account separately for hardware, electricity, and any software licensing.
Use this guide to decide: grind free labs first, then pay once you’re truly exam-ready.
What Paid Training Adds to Free Practice
Let’s name the dragon first. In 2025, a standard PEN-200 bundle with 90 days of labs plus one OSCP attempt starts around $1,749 in many regions (Source, 2025-09). Throw in a retake, a few months of extra labs, maybe a TryHackMe or Hack The Box subscription, and you’re suddenly staring at a $2,000–$3,000 project. That’s not “impulse-buy a Udemy course” money.
Use free practice to identify gaps before buying more access. A useful checkpoint is whether you can explain an unfamiliar task and document it independently, not whether a familiar box now feels easy.
To pass OSCP, you do not need twelve subscriptions and five bootcamps. You need:
- Solid Linux and Windows enumeration habits.
- Privilege escalation muscle memory (both OSes).
- Comfort with web basics: auth issues, file upload, simple SQLi, SSRF-ish patterns.
- One reliable workflow for documentation and reporting.
Free and low-cost labs shine here because they let you repeat those fundamentals until you’re bored. Familiarity alone does not establish readiness; test unfamiliar tasks, Windows/AD skills, and reporting.
- Assume the official bundle is your final step, not your first.
- Choose practice hours from your own skill gaps; there is no universal minimum here.
- Only pay once you can consistently root medium-difficulty boxes.
Apply in 60 seconds: Write down how much you’re willing to spend in total; everything in this article will work backward from that cap.
Money Block #1 – Eligibility checklist: should you stay free-first for now?
Before you drop money, run this quick yes/no pass:
- Yes/No: Can you already use
nmap,ffuf/gobuster, and basicsshwithout Googling the flags every time? - Yes/No: Have you rooted at least three beginner VulnHub boxes (e.g., Kioptrix Level 1, Basic Pentesting 1) on your own network?
- Yes/No: Have you written a short report (2–3 pages) for any lab you’ve done?
If you answered “no” to two or more, you’re in the free-first zone. Spend the next 60–90 days grinding Kioptrix, VulnHub, and PG Play. If you answered “yes” to most, you can start planning when to buy PEN-200, not whether.
Save this checklist and revisit it every month; your answers should move from “no” to “yes” before you swipe your card.
The core OSCP skills you can build on free labs
Free resources are not “discount OSCP.” They’re the gym where you build the muscle that makes the exam survivable. The trick is mapping each lab family to specific OSCP-ish skills.
Roughly, you need to train:
- Enumeration discipline: ports, services, versions, and web content discovery.
- Exploit workflow: research → proof of concept → adapt → stabilize.
- Privilege escalation: kernel, misconfig, cron, SUID, weak credentials.
- Pivoting mindset: even if your home lab is single-host, think in graphs.
Kioptrix, VulnHub, and PG Play can build enumeration, exploitation, and reporting fundamentals. They do not replace the current PEN-200 syllabus or modern Windows, Active Directory, and pivoting practice; identify those gaps before deciding you are ready.
“Eligibility first, quotes second—you’ll save 20–30 minutes.”
In OSCP land, that means: validate your baseline on free labs before shopping for more platforms.
Show me the nerdy details
A simple way to map free labs to OSCP domains is to tag each machine when you finish it: [web], [AD], [linux-privesc], [windows-privesc], [buffer-overflow-light]. Track these tags in a spreadsheet. After 30–40 boxes, you’ll see clear gaps (often Windows or AD). PG Play contains Linux machines, so fill Windows and AD gaps with a purpose-built local Windows/AD lab or a platform that explicitly includes those targets. OffSec’s PG comparison confirms three daily hours for Play and Windows/Linux targets in paid Practice.
Kioptrix as your first “mini OSCP” lab
The Kioptrix series is old, but that’s exactly why it’s perfect as a starting point. These VMs were designed to be “vulnerable by design” Linux servers where your job is simple: get root. That’s also the core emotion of OSCP: “I am trapped on this network until something gives.”
A basic Kioptrix flow on your laptop looks like this:
- Spin up a small host-only network with Kali and one Kioptrix VM.
- Use
netdiscoverorarp-scanto find the target IP. - Run an Nmap scan (
-sV -sC -p-) and build a small service table. - Probe web services, SMB, or anything interesting the scan reveals.
- Exploit, stabilize your shell, escalate to root, and grab proof.
That rhythm is exactly what you want for OSCP prep, and Kioptrix is a forgiving playground to build it in.
- Limit yourself to hints, not full write-ups.
- Time each run and try to shave 15–20% off with better notes, not more tools.
- Practice clean reporting for each machine.
Apply in 60 seconds: Schedule a two-hour block this week titled “Kioptrix 1 with reporting,” and treat it like a mini mock exam.
Show me the nerdy details
Create a simple template for every Kioptrix/VulnHub machine: Scope → Recon → Exploitation → PrivEsc → Lessons. Use the same headings and even the same table format you’ll use for your OSCP report. When exam day comes, you’re not inventing a structure under pressure—you’re just filling in the blanks like you always do.
Designing a VulnHub path from easy boxes to OSCP-style practice
VulnHub is where free OSCP prep gets serious. It’s a huge archive of intentionally vulnerable machines, many tagged “easy,” “medium,” or themed around web, AD, or Linux privilege escalation. In 2025, you can still find 200+ free VMs there, many with walkthroughs if you really get stuck (Source, 2025-03).
The trap is to wander aimlessly: download something random, flail for three hours, then jump to another box. Instead, treat VulnHub like a structured training plan:
- Phase 1 (Weeks 1–3): “Easy” single-host Linux boxes (Kioptrix, Basic Pentesting 1, Holynix, etc.).
- Phase 2 (Weeks 4–6): Slightly harder Linux boxes or those with trickier web components.
- Phase 3 (Weeks 7–9): Linux boxes with multi-step privilege escalation and chained misconfigurations; schedule Windows and Active Directory separately.
Write down the exact privilege-escalation primitive and why it worked; that explanation is more useful than a copied command.
- Batch machines by theme (web, Linux privesc, AD-like).
- Measure progress using time-to-root and number of new techniques.
- Use write-ups only as a last resort and always re-do the box without them.
Apply in 60 seconds: Pick 5 “easy” and 5 “medium” VulnHub boxes and list them in a simple spreadsheet with scheduled dates.
Smart strategy for OffSec Proving Grounds Play (free tier)
OffSec’s Proving Grounds Play is, quietly, one of the most valuable free OSCP prep tools on the internet right now. You get 3 hours per day of access to a rotating pool of community-generated Linux machines—many of them originally from VulnHub, wired into a modern VPN environment with flags and scoring (Source, 2024-01).
Used badly, PG Play is just three hours of random poking at boxes while Discord scrolls in the background. Used well, it’s your daily OSCP gym session:
- Block a fixed time (e.g., 21:00–22:30) where you treat PG like a real engagement.
- Pick one target per session; no tab-hopping between machines.
- Stick to your enumeration → exploitation → privesc routine.
- Spend the last 10 minutes updating your notes and “lessons learned” log.
Money Block #2 – 60-second lab-hours calculator
Use this tiny calculator to estimate how many free lab hours you can realistically earn each week before paying for anything.
sessions × 2 hours
Approx. 19 free lab hours/week.
This is a scheduling calculation only. It does not estimate the hours required to pass or prove exam readiness.
Open-source and community labs that cost almost nothing
Free OSCP prep isn’t just Kioptrix + VulnHub + PG Play. You can round out your skill set with:
- Web Security Dojo-style images: pre-built VMs that bundle vulnerable web apps plus tools.
- PortSwigger Web Security Academy: browser-based labs that sharpen your web exploitation instincts.
- Small AD home labs: a Windows evaluation VM, a domain controller, and a couple of client machines, if your hardware can handle it.
You don’t need that much infrastructure to win. But you do need at least one environment where you’re allowed to break everything repeatedly. That’s what these open-source labs are for.
- Browser labs sharpen specific techniques fast.
- Self-hosted labs teach you setup, troubleshooting, and patience.
- That combination looks a lot like real-world pentesting.
Apply in 60 seconds: List one browser-based lab and one VM-based lab you’ll commit to using this month.
Show me the nerdy details
When you build your own lab, keep a simple “fee schedule” for yourself: note any recurring cloud or VPS cost, and cap it. For example: “Home lab budget: $15/month; if usage exceeds that, tear down idle boxes.” Treat this like a mini engagement budget—you’ll train yourself to think about cost-to-value the way clients do.
Money Block: Free vs low-cost OSCP prep options
Let’s zoom out and compare the main options you’re likely juggling. These numbers are ballpark 2025 figures; always confirm current pricing.
| Path | Typical 2025 cost | What you get | Best for |
|---|---|---|---|
| Kioptrix + VulnHub (self-hosted) | $0 (assuming existing hardware) | Unlimited Linux boxes, classic vulns, privesc drills. | Beginners building fundamentals. |
| PG Play (free tier) | $0 (3 hours/day) | VPN-based lab, VulnHub machines, flags and scoring. | Daily OSCP-like practice. |
| PG Practice | ≈$19/month (Source, 2023-12) | Unlimited time, OffSec-designed boxes. | Pre-PEN-200 sharpening. |
| PEN-200 + OSCP bundle | ≈$1,749 (90 days + 1 exam) | Official courseware, premium labs, exam voucher. | Final push and actual certification. |
Save this table and confirm the current fee on each provider’s official page before you finalise your budget.
Visual roadmap: free labs → low-cost labs → OSCP exam
- Kioptrix series
- Easy VulnHub boxes
- Browser web labs
- 3h/day PG Play
- Medium VulnHub
- Start AD/home lab
- 1–3 months PG Practice
- Optional THM/HTB
- Refine reporting
- Book bundle
- Focus on OffSec labs
- Sit exam with confidence
Money Block #4 – Decision card: when to stay free vs when to pay
Use this as a sanity check before you purchase anything big.
- Stay free-heavy (Kioptrix/VulnHub/PG Play) if: you’ve rooted fewer than 15 boxes, or you still need Google for most Linux privesc moves.
- Add low-cost PG Practice / THM / HTB if: you’ve done 15–30 boxes and want fresher OSCP-like content, but your budget is tight.
- Buy PEN-200 when: you can consistently root medium boxes in under 4–5 hours and write a report without crying.
Save this decision card and revisit it before every major purchase; your answers should drift from left to right as your skills grow.
A 90-day free/cheap OSCP prep plan
Let’s turn all of this into a concrete 90-day plan you can execute alongside a full-time job or study schedule. Think of this as a “minimum effective dose” for free and low-cost OSCP prep.
Phase 1 (Days 1–30) – Fundamentals and Kioptrix
- Root 3–5 Kioptrix boxes and 3 “easy” VulnHub machines.
- Write a short report for at least 3 of them.
- Spend 2 evenings/week on PG Play, one box at a time.
Phase 2 (Days 31–60) – Medium VulnHub + regular PG Play
- Root 5–8 “medium” VulnHub boxes.
- Enforce a 4-hour “mini exam” once every two weeks: one box, strict time box, full notes.
- Continue 3h/day PG Play where possible; prioritise machines that match OSCP-style tags (Linux, AD-ish, classic web vulns).
Phase 3 (Days 61–90) – Fill gaps and simulate the exam
- Identify your weak areas (maybe Windows privesc or AD) and pick 3–5 boxes specifically for those.
- Run two OSCP-style “mock exams”: 3 boxes in 12–16 hours, then a report the next day.
- Decide whether you’re ready to move into a paid PEN-200 window.
One of my favourite memories from a student I coached: he printed this 90-day plan, stuck it next to his monitor, and ticked off boxes with a red pen. “It felt like an RPG,” he told me. “Every box was XP. The day I booked my exam, I knew I’d earned the right to pay that fee.”
- Use 90 days as a focused season, not an endless grind.
- Measure by boxes rooted and reports written.
- Book PEN-200 only when your 90-day log says you’re ready, not your anxiety.
Apply in 60 seconds: Block three recurring slots in your calendar for the next four weeks: “VulnHub,” “PG Play,” and “Report writing.”
Regional notes for Korea and other non-US candidates
If you’re outside the US—say you’re preparing from Korea—you’re juggling a few extra constraints:
- Exchange rates: the PEN-200 bundle is priced in USD, so currency swings can add or remove ₩100,000+ from your bill.
- Time zones: OSCP exam slots and OffSec support often run on US/European time; plan your sleep and work schedule carefully.
- Local bootcamps: some Korean or APAC training partners resell PEN-200 with in-person classes; they can add structure but also markup.
Lock the year and currency before comparing rates; otherwise, you’ll drive yourself crazy chasing deals that don’t actually fit your budget.
- Use free labs as a hedge while you watch exchange rates.
- Check local training partners, but compare their fee schedule to buying direct.
- Schedule exam windows that respect your sleep cycle, not just your calendar.
Apply in 60 seconds: Convert the current PEN-200 bundle price into your local currency and write down the number; it’s easier to plan around a concrete figure.
Common pitfalls when using free labs (and how to avoid them)
Free and low-cost resources are powerful—but they come with traps:
- Write-up addiction: reading walkthroughs too early turns every box into a quiz, not an investigation.
- Random box syndrome: jumping between labs without a plan leaves you with shallow experience everywhere.
- Tool obsession: chasing every new script instead of mastering a small toolkit.
- Report neglect: skipping documentation “because it’s just practice.”
My personal low point was a weekend where I “did” three boxes and could barely explain any of them on Monday. I’d followed write-ups half-blind, copied commands, and called it learning. It wasn’t. Now, I use a simple rule: no write-up until I’ve spent at least 90 minutes thinking for myself, and I always redo the box from scratch within a week to see what stuck.
Money Block #5 – Prep list before buying any new platform
Before you buy another lab or subscription, gather:
- A list of boxes you’ve already rooted, with tags (Linux/Windows/web/AD).
- Your current weekly time budget (realistic, not fantasy).
- Your all-in budget cap for OSCP prep (courses + exam + retake buffer).
Save this list and confirm that a new platform actually fills a gap instead of just adding more things to feel guilty about.
- Delay write-ups; prioritise your own notes.
- Choose boxes on purpose, not by mood.
- Audit your tooling; depth beats novelty.
Apply in 60 seconds: Pick one habit to change this week—either “no write-ups for 90 minutes” or “one report per box.”
OSCP Investment Gap (2025)
Comparing “All-In” Purchase vs. “Smart Prep” Strategy
- Root 5 Kioptrix/Easy VulnHub boxes
- Establish “Note Taking” format
- 2x Weekly PG Play sessions
- Complete 8 Medium VulnHub boxes
- Enforce 4-hour time limit per box
- Focus on Linux PrivEsc patterns
- 2x Full Mock Exams (12-hour blocks)
- Target Windows/AD specific labs
- Final “Go/No-Go” decision for PEN-200
💰 Free Lab Savings Calculator
Calculate the value of practicing before you pay.
Based on standard $19/mo lab subscriptions + boot camp hourly rates.
That’s 0 hours of practice for $0.
FAQ
Q1. Can I pass OSCP using only free resources like Kioptrix, VulnHub, and PG Play?
The exam requires paid access through an eligible course bundle or the standalone OSCP exam; free practice does not include an exam attempt. Check the official purchase options. but you can get most of the technical skill you need from free and low-cost labs. The realistic path is: grind free labs until you can root medium-difficulty boxes consistently, then use PEN-200 and OffSec labs as your final refinement.
60-second action: List your last 10 boxes and honestly rate how many you’d be comfortable seeing on exam day.
Q2. How many free/cheap boxes should I complete before buying PEN-200?
There’s no magic number, but a solid target is 30–50 boxes across Kioptrix, VulnHub, PG Play, and similar platforms, including at least 10 you’d call “medium.” More important than count is diversity: Linux vs Windows, web vs infrastructure, simple vs chained privesc.
60-second action: Open your notes and count how many distinct boxes you’ve finished; set a concrete target for the next 90 days.
Q3. How should I handle exam retake costs on a tight budget?
In 2025, OSCP retakes typically run in the low-hundreds of dollars, which hurts if you’re already stretched. The safest move is to treat free labs as your “retake buffer”: assume you will only book the exam when you’d be comfortable paying a retake and not needing it. If money is tight, spend an extra 1–2 months in free/cheap labs before locking in a date.
60-second action: Decide right now how many retakes you can realistically afford (0, 1, or 2) and let that inform your exam timing.
Q4. Are platforms like TryHackMe and Hack The Box still worth it if I have Kioptrix/VulnHub and PG Play?
They can be, especially for structured learning paths and more modern AD-style content, but they’re optional. If your budget is tight, you’re better off fully exploiting the free side of VulnHub and PG Play first, then adding a month or two of a paid platform as a targeted boost.
60-second action: If you already have a subscription, choose one focused path (e.g., “offensive pentest track”) and commit to finishing it instead of dabbling.
Q5. How do I know if I’m “OSCP ready” and not just good at CTFs?
The difference is in methodology and reporting. You’re OSCP-ready when you can: approach a box with a repeatable recon plan, avoid rabbit holes most of the time, chain multiple findings into a clear path to root, and write a report that a non-CTF person can follow. If your notes look like a chat log with yourself, you’re not there yet.
60-second action: Take your last lab and rewrite its notes as if they were going to a paying client; notice where you struggle to explain your steps.
Wrap-up: what to do in the next 15 minutes
If you’ve read this far, you’re probably balancing anxiety, ambition, and a very real budget. That’s normal. The important thing is that you now have a map: start with Kioptrix and VulnHub, integrate PG Play into your weekly rhythm, sprinkle in open-source labs, then move to PG Practice and PEN-200 only when your logs—not your fears—say you’re ready.
Here’s your 15-minute next step:
- Open a blank doc called “OSCP Free Prep Plan – 2025.”
- Paste in the 90-day outline from this article and adjust the days to match your life.
- Add three concrete boxes to your “this month” list: one Kioptrix, one easy VulnHub, one PG Play machine.
That’s it. No huge purchase, no dramatic announcement. Just a calm, deliberate choice to turn free and low-cost OSCP prep resources into a system that respects your money and your time.
Editorial review: 2026-10-12. Exam purchase options and PG platform limits checked against the official links above. Dated subscription prices are historical examples; verify current checkout prices. Lab counts and training-value estimates are planning aids, not guarantees of exam readiness or cash savings.
free OSCP prep resources, OSCP lab practice, Kioptrix VulnHub labs, budget OSCP study plan, open-source penetration testing labs
🔗 OSCP Exam Cost (2025 Update) Posted 2025-11-17 13:35 UTC 🔗 Kioptrix Labs Beginner Roadmap Posted 2025-11-17 01:45 UTC 🔗 OSCP Prep Using Kioptrix Posted 2025-11-17 05:16 UTC 🔗 From Kioptrix to Hack The Box Posted 2025-11-17 UTC