Sources, review date and section shortcuts
Key claims reviewed: October 19, 2026. This platform sequence is optional. Legacy Kioptrix/VulnHub targets do not establish coverage of modern Windows or Active Directory tasks. A machine count, subscription purchase or timeline does not predict passing.
Official exam guide · Current training prices
Go straight to: Overview · Practical checks
Use this OSCP roadmap to choose the next practice task, not to collect platform subscriptions in a mandatory order. The proposed stages are editorial suggestions. No author-specific failure, retake or passing outcome is established here.
Check the destination and your starting point
The current OSCP+ exam guide describes 23 hours and 45 minutes of examination time and another 24 hours to upload documentation. Three standalone machines contribute 60 points; a three-machine Active Directory set contributes 40. Passing requires at least 70/100 and the specified evidence. Read the complete guide and your Exam Control Panel; this summary does not replace their conditions.
Write a baseline from a recent independent exercise: what you could investigate, what required hints, what evidence you kept and which skills were absent. That record is more useful for choosing the next task than a machine total.
Four optional stages
| Stage | Practice purpose | When to change focus |
|---|---|---|
| Kioptrix | Identify a target, investigate services and explain observed evidence. | You can repeat the workflow and name its limitations. |
| Other VulnHub releases | Work on a specific gap using release-specific setup notes. | You need content that the chosen legacy target does not provide. |
| Proving Grounds | Use the included hosted machines under the current access rules. | Review gaps rather than assuming exam equivalence. |
| Hack The Box | Choose the exact Labs or Academy product and content needed. | Continue only while tasks address the gaps in your plan. |
You may skip, repeat or combine stages. A third-party difficulty label does not establish exam readiness, and a paid platform does not guarantee success. Academy learning content and Labs machine access should not be treated as interchangeable subscriptions.
Stage 1: make a repeatable local baseline
Check the original Kioptrix releases for image details. Confirm host/guest compatibility and a bounded lab network before starting. Record your permitted target, useful observations, unsuccessful hypotheses and a reproducible finding. Preserve a recovery copy and distinguish a snapshot from an independent backup.
Stage 2: choose variety by a gap
Pick a release because it supports a task you need to practise. Read networking notes before import; author defaults may not match your desired boundary. Do not assume all images use the same virtual NIC, architecture or hypervisor settings. Keep the platform’s distribution role separate from the educational objective you assign to the exercise.
Stage 3: check hosted access and publication rules
The PG rules describe free Play access for three hours in a 24-hour window. Practice supports one running machine at a time; a session can close after disconnection or automatically after 12 hours. Check current catalogue access in your account. Do not publish Practice target information merely because you finished the exercise.
Stage 4: add only the content you need
Compare the exact current offering, included content and access duration before buying. Identify whether the task addresses Windows, AD, reporting or another specific gap. Do not turn a harder box label into a claim that it reproduces the current exam.
Review evidence at every stage
- Can a technically competent reader reproduce the observed task from your notes?
- Have you separated inference, attempted action and verified result?
- Do screenshots prove the claimed state and exist in the final export?
- Which parts required help, and what can you now repeat independently?
- What important current exam topics were not represented?
Budget access from actual terms
Use current official prices and the exact purchased product. Record access start/end, included attempts, booking conditions, taxes and any optional subscriptions. A planning spreadsheet is not a quote. Avoid starting a paid access window during a period when your actual schedule cannot use it.
Make the next week concrete
Choose one gap, one suitable authorized task and one report deliverable. Review the result before selecting another target. Neither a four-stage diagram nor a fixed machine count establishes a probability of passing. Keep actual exam material private and follow the current tool and assistance restrictions.