What the course covers
About this course map
OSED is the exploit-development exam — the module where you stop using other people's exploits and start writing your own. It is the "-300" course EXP-301 (Windows User Mode Exploit Development) and one of the three certifications that make up OffSec's OSCE³. It answers a question penetration testing never quite reaches: when there is no public exploit for the vulnerability in front of you, can you build one?
This is the most low-level course in the OffSec catalogue. It lives in the debugger, in assembly, and in the details of how Windows lays out memory and defends it. The preparation programme assumes you are comfortable in C and can read x86 assembly, or are willing to get there fast, because everything after the first week depends on it.
The exam is 48 hours. You are given vulnerable applications and you write working exploits for them, defeating the mitigations Windows puts in the way. Then 24 hours to document exactly how each exploit works.
Module 01 — Tools of the trade
The environment exploit development actually happens in, and getting fluent before the hard part.
Module 02 — Stack buffer overflows, properly
The overflow OSCP treats as a checkbox, taken apart to its foundations.
Module 03 — Shellcode and payload construction
Getting from "I control execution" to "my code runs."
Module 04 — Structured Exception Handler overflows
An older but exam-relevant technique, and the reasoning behind it.
Module 05 — Defeating DEP with ROP
Data Execution Prevention stops your shellcode running on the stack. Return-Oriented Programming is how you get around it — and it is the intellectual core of the course.
Module 06 — Bypassing ASLR
Address Space Layout Randomisation moves everything so you cannot predict where anything is. This module is how you find it anyway.
Module 07 — Format string and other memory-corruption bugs
Vulnerability classes beyond the stack overflow.
Module 08 — Reverse engineering for the bug
Finding the vulnerability yourself, which the exam requires — the applications are not pre-marked.
Module 09 — Building the full exploit under exam conditions
Chaining every technique into a reliable, working exploit — which is what is graded.
Sitting the official exam
Exam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date. This course is Hacky Security's own preparation training; the certification itself is awarded by the certification body, not by us.
Similar courses
Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
