OSEP and OSWE Certification Guide: Exams Compared

After the OSCP, testers often have to choose between two advanced OffSec tracks that lead to very different jobs: OSEP for breaching defended internal networks, and OSWE for finding and chaining flaws in web application source code. This guide sets out what OffSec publishes about both: the PEN-300 and WEB-300 courses, the proctored 47 hour 45 minute exams, how each is scored, the report and file rules, purchase routes, retakes and how each relates to OSCP+ renewal. It is for penetration testers, red teamers, application security engineers and the managers who fund their training. It describes the certifications, not attack techniques. Facts were checked on help.offsec.com on 24 October 2026; confirm details with OffSec before you book. For the entry-level exam, see the OSCP Certification Guide.

Key takeaways

Different targets, same exam length. Both exams give you 47 hours and 45 minutes, then 24 hours to upload a report, and both are proctored.
OSEP is about defended networks. PEN-300 covers client-side attacks, antivirus evasion, application allow-listing bypass and advanced Active Directory attack chains; OffSec recommends PEN-200 and the OSCP, or equivalent knowledge, first.
OSWE is white-box web testing. WEB-300 teaches source code led web application testing, and the exam requires one working, non-interactive script per target that chains the vulnerabilities you found.
Pass marks differ. OSWE needs at least 85 of 100 points; OSEP needs at least 100 points or access to the objective named in your exam email.
OSEP renews an OSCP+. OffSec lists OSEP, but not OSWE, among the exams that keep the OSCP+ "+" active; neither OSEP nor OSWE is on OffSec's list of expiring certifications.

Who the certification is for

Question	OSEP (PEN-300)	OSWE (WEB-300)
Full course name	Evasion Techniques and Breaching Defenses	Advanced Web Attacks and Exploitation
Credential name	OffSec Experienced Penetration Tester	OSWE
Typical roles	Internal and infrastructure penetration testers, red team operators, purple team engineers	Web application testers, application security engineers, secure code reviewers, bug bounty researchers
Testing style	Network and Active Directory compromise against defended systems	White-box testing with access to application source code
What a pass shows	You can gain and extend access across a defended environment and document it	You can find vulnerabilities in code, chain them and automate the result reliably

Choose OSEP if your work is internal network tests, assumed-breach engagements or red team operations where endpoint protection and allow-listing are in place. Defenders who build detections for these environments also benefit. See the Red Teaming Guide.
Choose OSWE if your work is web or API testing, code review or building a secure development programme, and you can read code comfortably. See the API Penetration Testing Guide.
Do both only if your role genuinely spans infrastructure and application testing. Learn Unlimited includes attempts at both, which changes the economics for consultancies.
Identity angle: much of an OSEP-style engagement turns on credentials, service accounts and Active Directory trust, the same weaknesses identity teams work to remove. Testers who understand those paths write better remediation advice.

Exam format and domains

The two exams side by side

Item	OSEP	OSWE
Exam time	47 hours 45 minutes	47 hours 45 minutes
Report deadline	Within 24 hours after the exam ends	Within 24 hours after the exam ends
Supervision	All exams proctored	All exams proctored
Targets	Machines with defined objectives; point values shown in the Exam Control Panel	Several target machines (number not stated)
Scoring	Points for partial and full administrative control of each target	Points for partial and full completion of objectives, 100 maximum
To pass	Access to the objective in your exam email, or at least 100 points	At least 85 points
Proof	local.txt, proof.txt and, on the final machine, secret.txt, shown in the control panel and a screenshot	Proof values, extracted automatically by your script if no shell is obtained
Code deliverable	Scripts and proof-of-concept code included as text in the PDF	One functional script per machine chaining the vulnerabilities, run without user interaction
Report file	PDF in an unprotected .7z archive, at most 200MB, named OSEP-OS-XXXXX-Exam-Report (your OSID)	PDF in an unprotected .7z archive, at most 200MB, named OSWE-OS-XXXXX-Exam-Report, uploaded with an MD5 check
Guide last updated	20 April 2026	1 July 2026

Restrictions

OSEP: commercial software, spoofing attacks, AI chatbots and LLMs, and downloading applications or source code out of the exam environment are restricted. Targets compromised with a restricted tool, or without the required proof in both the control panel and a screenshot, score nothing.
OSWE: source code analysers, automatic exploitation tools, mass vulnerability scanners, AI chatbots, features of other tools that use restricted methods, and remote mounting of application source code are restricted. The exam is otherwise open book: notes, online resources and the OffSec Learning Platform are allowed, from the proctored machine.

Course content

PEN-300: OffSec's FAQ describes breaching internal defences through client-side attacks, evading antivirus, defeating application allow-listing, and chaining attacks, with advanced Active Directory exploitation as an example.
WEB-300: OffSec describes it as an advanced course that teaches the skills needed for white-box web application penetration tests. Its help pages read for this guide do not list the modules or programming languages; check the WEB-300 syllabus on offsec.com.

Prerequisites and experience

Neither credential has an application or experience check. The barrier is skill.

OSEP: OffSec recommends completing PEN-200 and passing the OSCP, or equivalent knowledge; solid enumeration ability; and basic Bash, Python and PowerShell scripting. Familiarity with C# is described as a plus.
OSWE: the prerequisites are on the WEB-300 course page, which could not be read for this guide. Because the exam needs a working automation script and source-level analysis, plan on being able to read code in common web languages and write reliable scripts.
Age: OffSec's minimum age is 18; 16 and 17 year olds can apply with a guardian's form.

Purchase route	Access	Exam attempts
Course and Cert Exam Bundle	90 days of PEN-300 or WEB-300, extendable in 30-day steps that add no attempts	One, valid until 120 days after the lab end date
Learn One	One year: one primary course (PEN-300 or WEB-300), PG Practice and more	Two at the primary course
Learn Unlimited	One year: all content at purchase except Cyber Range	Unlimited OSEP and OSWE attempts while valid (also OSCP and others)

OffSec's help pages do not state prices and its product pages could not be read for this guide, so check current pricing with OffSec. Retakes are valid for 120 days from purchase, with cooling-off periods of 4 weeks after the first failure, 8 after the second and 12 after the third and later failures.

Preparation plan

Confirm the fit: read the exam guide for your chosen track in full, including restrictions and report naming. Compare it with your current work so the effort maps to your job.
Close the gaps first: for OSEP, make sure your OSCP-level enumeration, privilege escalation and Active Directory fundamentals are sound, and refresh scripting and C#. For OSWE, practise reading unfamiliar web application code and writing scripts that handle sessions and errors cleanly.
Work the course in order: complete each module and its exercises, keeping notes as your own checklists. Choose a route with enough lab time; a 90-day bundle suits people who can study full time.
Practise full chains: OSEP rewards linking steps across machines toward an objective; OSWE rewards a single script that runs end to end. Practise both at full length, not just individual steps.
Rehearse a two-day exam: plan sleep, breaks and checkpoints across 47 hours 45 minutes. A rested second day usually beats a sleepless one.
Write as you go: capture proof, screenshots and code into your report draft during the exam, then use the 24-hour window to finish, name and archive it exactly as the guide requires.

The plan is NHI Mgmt Group guidance. OffSec does not publish a recommended study duration on the pages read for this guide.

Where they map in frameworks

Our study and justification aid, not an OffSec or NIST statement. IDs verified against NIST SP 800-53 Rev 5 and CSF 2.0.

Framework ID	Name	Most relevant to
CA-8	Penetration Testing	Both
CA-8(2)	Red Team Exercises	OSEP
SA-11	Developer Testing and Evaluation	OSWE
SA-11(8)	Dynamic Code Analysis	OSWE
ID.RA-01 (CSF 2.0)	Vulnerabilities in assets are identified, validated and recorded	Both
ID.IM-02 (CSF 2.0)	Improvements are identified from security tests and exercises	Both

Cost, renewal and continuing education

Expiry: OffSec says most of its certifications do not expire. Its list of expiring certifications (OSCP+, OSAI+, OSCC-SEC, OSCC-SJD, OSTH and OSIR) does not include OSEP or OSWE, so neither has an annual maintenance fee or CPE requirement of its own.
OSCP+ renewal: passing OSEP before an OSCP+ expires keeps the "+". OffSec's recertification page lists OSEP, OSWA, OSED and OSEE as qualifying exams; OSWE is not on that list, so an OSWE pass does not renew an OSCP+.
CPE for other bodies: OffSec's WEB-300 FAQ says passing the OSWE exam may qualify you for 40 CPE points, and that learners who skip the exam can submit completed module labs as a PDF to claim CPE. Check how your certifying body (for example ISC2 or ISACA) treats them.
Budget: plan for the purchase route, a possible retake, two days of exam time plus a report day, and several months of study. For a consultancy, compare per-person bundles with Learn Unlimited if staff will take several OffSec exams.

Where it fits on the career path

Before: the OSCP or equivalent practical experience. The Cybersecurity Certifications Guide places OffSec credentials among the wider market.
OSEP leads toward: senior internal testing, red team and adversary emulation roles. Compare it with other hands-on credentials in the Practical Red Team Certifications Guide.
OSWE leads toward: senior application security testing, secure code review and product security roles, where finding root causes in code matters more than network reach.
For buyers of testing: match the credential to the engagement. An OSWE fits a white-box application test; an OSEP fits an assumed-breach or internal network test. See the Penetration Testing Provider Buyer's Guide.

Common failure patterns

Wrong report file: both guides set exact, case-sensitive naming, archive format and size limits. A non-compliant upload risks the attempt.
Missing proof: OSEP gives no points for a target without proof in both the control panel and a screenshot.
Fragile OSWE scripts: a script that needs manual steps does not meet the requirement. Test it from a clean start.
Assuming OSWE renews OSCP+: it does not, on OffSec's current list.
Underestimating fatigue: two days of work plus a report day needs a plan, not adrenaline.

Practitioner checklist

Pick the track that matches your next role: OSEP for defended networks, OSWE for code-level web testing.
Read the current exam guide, restrictions and report naming rules for that track.
Confirm you meet OffSec's recommended skills before buying lab time.
Choose a purchase route with enough lab time and attempts; consider Learn Unlimited for several exams.
Practise full chains and, for OSWE, non-interactive scripts end to end.
Plan a 47 hour 45 minute exam with sleep and checkpoints, and a 24-hour report window.
If you hold an OSCP+, time an OSEP pass before your "+" expires to renew it.
Record the pass for CPE with ISC2, ISACA or other bodies if you hold their credentials.

OSEP and OSWE Certification Guide: Exam, Requirements and Preparation