Need a professional OSCP report template? Start with OffSec’s Word template (.docx) or OpenOffice/LibreOffice template (.odt). These are external links listed in the official exam guide. If a file link changes, use that guide’s Suggested Documentation Templates section.
Keep actual exam reports private. Redacting flags, names or IPs does not turn an exam report into a public portfolio sample. For interviews, create an independent report from a lab you are allowed to document and share. OffSec’s confidentiality rules cover exam-report information, not just identifiers.
Use the copyable practice outline, then run the seven evidence checks. This is a preparation resource, not an account of an exam attempt, a grading guarantee or live exam assistance.
Table of Contents
Choose the right OSCP report template
An empty template is a structure for your own evidence. Read its example text before use, remove content that does not describe your work, and replace every placeholder. Do not carry a sample host, vulnerability or successful outcome into your report as if you observed it.
- Exam submission: use the current official template or a structured alternative that meets the current exam guide and control-panel instructions.
- Practice: use a reusable outline and deliberately record missing evidence. An incomplete result can still teach you what to capture next time.
- Public portfolio: use an independently created, shareable lab report. Keep it separate from OffSec exam and restricted course material.
The official FAQ supplies template links and says chatbots are not allowed during the exam or reporting phase. Practise your workflow beforehand; do not upload exam content to an AI service for drafting, checking or redaction.
Copy this independent practice-report outline
The outline below is newly written for an authorized practice lab. Copy it into your preferred editor. It contains no exam material and is not an official OffSec template. Use only the sections that help explain your actual work.
PRACTICE LAB REPORT
Lab name / report version:
Author / date / timezone:
Permission and sharing restrictions:
1. Summary
Objective:
Confirmed result:
Unresolved questions:
2. Scope and environment
Authorized targets and exclusions:
Lab versions / network boundary:
Start and end time:
3. Reproducible steps
Target and prerequisite:
Command or action:
Observed output / evidence ID:
Interpretation and next step:
4. Finding
Title / affected component:
Evidence and impact:
Limitations / confidence:
Suggested remediation:
5. Verification
Change tested and expected result:
Actual result / evidence ID:
Fixed, mitigated or inconclusive:
6. Evidence index
ID / filename / section / timestamp:Keep an untouched evidence folder and a separate report draft. Use stable identifiers such as LAB-A-03 in the text and filenames so a reader can connect a statement to its supporting capture. Save original output as well as a readable excerpt; do not make a screenshot carry an entire explanation.
Run these 7 evidence checks before export
- Target: does every sequence identify the correct lab host and relevant service? Remove ambiguous references such as “the server.”
- Prerequisites: record the starting state, required access and any configuration needed to reproduce the result.
- Actions: include the actual commands and meaningful options, in the order you used them. Explain non-obvious inputs.
- Results: pair each important action with the output you observed. Separate a tool’s claim from a manually confirmed fact.
- Evidence: make captures legible at normal PDF zoom. Check labels, timestamps and references against your evidence index.
- Limitations: state what you did not establish. A response code, version banner or failed retry alone may not prove the claimed impact.
- Completeness: search the final draft for placeholders, sample hostnames and broken references; reread it as someone who was not present.
For the exam, OffSec additionally requires reproducible attack documentation and specific proof evidence. The guide describes interactive-shell proof capture, the target IP in the screenshot, and submission of proof values in the control panel before the exam ends. Read those instructions directly; the practice checks above do not replace them.
Write a finding without inventing a result
Illustrative scenario, not a performed test: in a lab you control, a deliberately exposed directory might return a file listing. A careful report would distinguish what the HTTP response shows from what has not been inspected.
- Observation: “The authorized lab endpoint returned a directory listing at [recorded time]; see evidence LAB-A-03.” Fill this only after you have the evidence.
- Interpretation: “Directory listing is enabled for this location.” Do not claim credential theft or sensitive-data exposure unless your authorized observations support it.
- Remediation: remove unnecessary published files and disable listing where it is not intended. Have the system owner validate the appropriate configuration.
- Retest: repeat the permitted check after the change and record the response. A login wall, redirect or timeout needs interpretation before you call the issue fixed.
The vulnerability retesting checklist helps distinguish a fix, a mitigation and an inconclusive result in your own lab.
Check the final exam package against current rules
As checked on October 9, 2026 (Asia/Seoul), the official guide allows 23 hours 45 minutes for the exam and a further 24 hours for documentation upload. Follow your exam’s actual timestamps and instructions.
The guide specifies a PDF inside an unpassworded .7z archive, a maximum archive size of 200 MB, and exact case-sensitive names using your OSID:
OSCP-OS-XXXXX-Exam-Report.pdf
OSCP-OS-XXXXX-Exam-Report.7zUse the official upload service linked in the guide, compare its displayed MD5 with your local archive, complete the final submission step, and retain the receipt. The guide warns that missing documentation cannot simply be supplied after a final submission. Recheck current requirements before your attempt.
For any report, export early enough to inspect the actual PDF: page breaks, cropped screenshots, code wrapping, links and searchable text can differ from the editor. Open the archive too; a correctly named container can still hold the wrong draft. These are preparation checks you can rehearse on a practice report.
Keep exam material out of public portfolios
Do not publish, send to a hiring manager, or upload to an external review tool any actual exam report or exam-derived evidence. A private interview is still disclosure to another person. A confidentiality problem cannot be solved merely by blurring a flag.
For a portfolio, choose a separate lab with permission to publish, write a fresh report, and check the lab owner’s publication rules. Label any invented example as illustrative. Exclude real credentials, private addresses, client information and material you are not entitled to share. Do not copy restricted exam steps into a supposedly generic sample.
Questions before you use the template
Is this an official or guaranteed passing report?
Only the linked files are OffSec’s templates. The outline and practice advice on this page are independent. Formatting cannot guarantee a pass or replace the required technical evidence.
Do I need paid software or a long report?
Choose an editor that lets you produce and inspect a clear PDF. Use enough detail to reproduce your work; repeated screenshots, filler and an oversized executive summary do not repair missing evidence.
What is a useful first practice task?
Take one permitted observation from your own lab, write its prerequisites, action, result and limitation, then export that single section. Ask whether another authorized reader could follow it without your verbal explanation.
The existing videos are retained as optional background. They are not evidence of the author’s exam history or a substitute for the current written guidance and primary sources.
Sources and review scope
Reviewed October 9, 2026 (Asia/Seoul): OffSec exam guide, exam FAQ and template links, and confidentiality terms. This revision is based on documentation review; it makes no claim of an exam attempt, direct lab test or improved pass rate.