OffSec's OSCP Exam Guide gives you 23 hours and 45 minutes on the exam machines, then another 24 hours to upload your report. Your access to the machines ends before those 24 hours start, so a screenshot you missed stays missed, and OffSec won't ask for it. Its reporting page suggests you "document important information as you work" and names Dradis among the tools to do it with.
Last updated by Rachael Carder on 2026-11-06
Key takeaways
Read this if you're preparing for the OSCP+ exam and want your notes to come out in the shape of the report. Skip this if you write reports for clients: our pentest report templates cover PTES, OWASP and HIPAA work.
| Rule | What OffSec says |
|---|---|
| Points | Three standalone machines worth 20 points each: 10 for initial access and 10 for privilege escalation. One Active Directory (AD) set of three machines worth 40 points (10, 10 and 20), where you start with a username and password. |
| Pass mark | 70 of 100 points for exams taken through November 30, 2026, per OffSec's scoring update. Every pass scenario in the Exam FAQ includes AD points, so you need at least 10 from the AD set, but you don't have to finish the whole set. Exams taken on or after December 1, 2026 use scaled scoring, and OffSec says raw points alone will not decide whether you pass. |
| One report | The exam report is the only report you submit. The OSCP+ Exam FAQ says "bonus points are not available for the OSCP+ exam anymore", so no lab report counts. |
| Grading order | "The order in which the exam machines are documented in your exam report are the order in which the exam machines will be graded and valued." |
| Metasploit | You may use Metasploit modules (Auxiliary, Exploit and Post) or the Meterpreter payload against "one single target machine of your choice", and not for pivoting. The multi handler and msfvenom are allowed on every target. Use Metasploit on more than one machine and that target scores zero. |
| AI chatbots and LLMs | The FAQ says chatbots are "not allowed during the exam and the exam reporting phase". Dradis CE ships with Echo, an AI assistant: leave it alone until your report is in. |
OffSec publishes an exam report template in Word and LibreOffice format. Its Reporting Requirements page says "You are highly encouraged to use these report templates", and the Exam Guide accepts your own template "as long as the information is presented in a structured, professional manner and follows all other requirements".
OffSec's current Word template opens with an introduction, the objective and the requirements. Then come a high-level summary with recommendations and a methodology section: information gathering, service enumeration, penetration, maintaining access and house cleaning. Each standalone target and each AD machine then gets its own write-up, from initial access to post-exploitation. Each sample finding has an explanation, a fix, a severity and the steps to reproduce.
Our free kit is a Dradis CE project with those same sections, from the high-level summary through house cleaning. We based it on OffSec's sample report template.
In the project, each exam machine is a host node. The report's Penetration section prints one entry for each host that has Evidence, so give every machine, the three AD machines included, its own node and its own Evidence. Put your OSID and email in the Tester Details note for the report header.
If your notes live in Dradis, use the kit. If they live anywhere else, use OffSec's Word template. Either way, decide before the exam and rehearse the whole route on a practice machine, from first note to the finished .7z. Exam day is a bad day to design a report.
OffSec wants "all steps, commands issued, and console output", documented "thorough enough that your attacks can be replicated step-by-step by a technically competent reader". Thin documentation costs "reduced or zero points". Capture each item below straight into its place in the project. Our guide to writing a security report makes the same case for client work.
| What to capture | The rule behind it, and where it goes in the kit |
|---|---|
| Scan and enumeration commands, with their output |
A reader has to be able to follow your steps from the first scan to initial access. In the kit: the Information Gathering and Service Enumeration notes, and the machine's Evidence > Proof |
| Initial access: each command in order, with its output |
10 of a standalone machine's 20 points. In the kit: Evidence > Proof on the machine's host node, as your steps to reproduce. The vulnerability itself is an Issue: Title, Description, Fix and Severity. |
| Any exploit code you used |
For an unmodified public exploit, the URL only, not the code. For a modified one, your code, the original URL and any shellcode command, with your changes highlighted and explained. In the kit: Evidence > Proof |
| local.txt screenshot |
Read with In the kit: Evidence > Screenshot |
| Privilege escalation: each command in order, with its output |
The other 10 points. In the kit: Evidence > Proof, under the Issue that let you escalate |
| proof.txt screenshot |
Same rule as local.txt. Full points need a root shell on Linux, or a SYSTEM, Administrator or admin-privileged user shell on Windows. In the kit: Evidence > Screenshot |
| The contents of local.txt and proof.txt |
Submitted in the exam control panel before the exam ends. The panel doesn't tell you whether a proof is correct. Not in the kit or the report as text. |
OffSec won't take a late screenshot: "once your exam report is submitted, your submission is final. If any screenshots or other information is missing, you will not be allowed to send them and we will not request them." Work through this list before you click Submit File.
OSCP-OS-XXXXX-Exam-Report.pdf, with your OSID in place of OS-XXXXX. The name is case-sensitive.OSCP-OS-XXXXX-Exam-Report.7z, with no password. "No other file formats will be accepted within the .7z file other than PDF file format", so any script or proof-of-concept code goes inside the PDF as text.md5sum on your archive. If the hashes don't match, select a new file and upload again.| Methodology templates | ||
| Project templates | ||
| Sample project | ||
| HTML report template | ||
| Word report template | ||
| Issue, Evidence, and Note templates | ||
| Download now | Download now |
Install the kit from the command line in Dradis CE. It sets up the OSCP project template, report template and note templates. Our guide to Dradis kits has the details, including how to build your own.
Sign in as an Administrator.
Navigate to Templates > Kit Upload.
Use the Drop zone or the blue Add kit button to select your kit.zip file.
Click the green Start button to upload it.
The on-screen log will display all the changes that are being made. Wait until it displays Worker process completed before moving on.
SCP your kit (e.g. kit.zip) to your Dradis instance (e.g. to the /tmp folder).
Dradis Pro:
Run the following commands in the console as dradispro:
$ cd /opt/dradispro/dradispro/current/
$ RAILS_ENV=production bundle exec thor dradis:setup:kit --file=/tmp/kit.zip
Replace /tmp/kit.zip with your own path and filename.
Dradis CE:
$ cd /dradis-ce
$ thor dradis:setup:kit --file=kit.zip
Replace kit.zip with your own path.
Filename:
This project template is ready to be updated with the results from your exam. It includes the default Node structure, placeholder Notes for each report section, and two sample Issues with Evidence that you can replace with your findings.
dradis-template.xml as
Dradis::Plugins::Projects::Upload::Template.
See the Project templates page of the Working with Projects guide for more details on using project templates.
Filename:
This sample project is for Dradis Pro. Its report sections, from the High-Level Summary to the Appendix, are 8 Content Blocks, which Dradis CE doesn't have. In CE you can use Notes: that's what the project template above does. The project also has 2 sample vulnerabilities to copy as you document your findings during the exam.
See the Importing and Exporting Projects page of the Working with Projects guide.
HTML: dradis_template-oscp.v0.6.html.erb
Word (Pro package): dradis_template-oscp.v0.6.docm
This report template will generate a report with the following sections:
Place the HTML report template in the storage/templates/reports/html_export/ folder of your local install.
dradis_template-oscp.v0.6.html.erb template and click Export.See the Creating HTML Reports guide for more details.
Filenames:
Use these templates as a guide when you are creating your own projects. Add them as Note templates to your instance of Dradis. When you create a finding by hand, pick the template and the field names are already filled in.
Place the note template files in the storage/templates/notes/ folder of your local dradis-ce install
Loading form...
Your email is kept private. We don't do the spam thing.