Sources, review date and section shortcuts
Key claims reviewed: October 19, 2026. Free preparation resources are separate from paid exam or training access. These routines are suggested schedules, not verified successful-candidate research, minimum study hours or evidence of exam readiness.
Official exam guide · Current training prices
Go straight to: Overview · Practical checks
You can practise many foundations with freely available resources, but free preparation is separate from an OSCP exam entitlement or paid PEN-200 training. This guide offers editorial routines rather than verified interviews with successful candidates or a personal pass story.
Define a free preparation scope
Start by listing what you already have: a compatible computer, storage, a controlled lab network and time. A free VM image does not make the host, electricity, backup storage or troubleshooting free. Confirm CPU architecture before downloading an old x86 target for an Arm host.
Check the current exam before mapping topics
The current OSCP+ exam guide describes 23 hours and 45 minutes of examination time and another 24 hours to upload documentation. Three standalone machines contribute 60 points; a three-machine Active Directory set contributes 40. Passing requires at least 70/100 and the specified evidence. Read the complete guide and your Exam Control Panel; this summary does not replace their conditions.
Do not infer a topic weighting from a third-party machine list. The guide’s current standalone and Active Directory structure should inform your gap review. Legacy debugging exercises are optional supplementary work and are not a separately listed component in that structure.
Separate resources from paid access
| Resource | Useful check |
|---|---|
| Kioptrix/VulnHub downloads | Release notes, guest architecture, import settings and permitted local scope. |
| Metasploitable and vulnerable web apps | Official project instructions; a web app is not the same unit as a complete VM. |
| PG Play | Registered free access has a daily time limit; consult the current rules. |
| Paid course or exam package | Actual product, access period, included attempts, scheduling conditions, tax and current quote. |
Use original Kioptrix release information and PG access rules rather than assuming every named exercise is available through every platform. Do not expose deliberately vulnerable services to unrelated networks.
Choose a routine you can sustain
| Routine | Proposed work | Review condition |
|---|---|---|
| Slow build | Two foundation sessions and one notes/review session per week. | Can you explain what you observed and repeat the task? |
| Focused block | Alternate investigation, Windows/AD gaps and reporting. | Does each session address a named gap? |
| Weekend schedule | Use smaller tasks during the week and one longer permitted exercise. | Can you preserve evidence and return to a paused task? |
These schedules do not establish three-month or six-month completion times. Track actual practice and adapt the workload. No universal number of hours, boxes or correct checklist answers determines readiness.
Seven checks that reduce avoidable rework
- Foundations: verify addresses, routes, files and commands before interpreting a failure.
- Paid time: practise basic environment setup before a purchased access window begins.
- Resource choice: select tasks by a learning gap rather than random difficulty labels.
- Reporting: record relevant evidence during the task, then test the exported document.
- Rehearsal: practise timing, evidence capture and recovery under your own constraints.
- Rest: plan a sustainable schedule; more logged hours do not prove more learning.
- Career use: keep claims tied to work you can demonstrate; certification does not guarantee hiring or income.
Build a quote-based budget
Record the exact current package, currency, date, access duration, taxes and included exam attempts. Add optional subscriptions only when they address a gap. Use a separately labelled contingency for a possible future purchase; retake costs and eligibility depend on the product and current rules. This page does not verify a universal total or compare representative bootcamp savings.
Common questions
Can free labs replace every part of PEN-200? No equivalence is established here. They can support selected skills, while course access, exam eligibility and exam conditions are separate decisions.
How many hours are enough? No reliable minimum is established. Use independent task performance, evidence quality and gaps against current requirements as review inputs; they still cannot guarantee a pass.
What should I do next? Select one permitted task, write its scope and expected evidence, and review what you actually learned before committing to a larger schedule.