What the course covers
About this course map
OSEP is the evasion exam. Where OSCP proves you can break in, OSEP proves you can break in *where someone is watching* — past antivirus, past application whitelisting, past the EDR that is supposed to catch exactly what you are doing. It is the penetration-testing half of OffSec's OSCE³ certification, and it is aimed squarely at the gap between "I got a shell in the lab" and "I got a shell in a hardened enterprise and nobody's console lit up."
The course behind it, PEN-300 (Evasion Techniques and Breaching Defenses), assumes you can already do everything OSCP covers. This preparation programme is built for people who have passed OSCP, or who work as penetration testers already, and now need the tradecraft that keeps an operation quiet. The teaching is lab-heavy and Windows-heavy, because that is where the defences you are evading actually live.
The exam is a 48-hour practical against a hardened Active Directory environment, followed by 24 hours to write the report. There is no multiple choice. You either reached the objective without tripping the defences, or you did not.
Module 01 — Operating inside a mature defence
The mindset shift before any technique. What a modern enterprise actually deploys, and how each control decides whether to flag you.
monitoring, and how they share signal
Module 02 — Client-side code execution
Getting the first execution when the easy paths are closed, using the formats users open without thinking.
Module 03 — Antivirus evasion
Understanding how AV actually inspects a binary, then defeating each mechanism deliberately rather than by trial and error.
Module 04 — Application whitelisting
Executing code on a host that only allows approved binaries to run.
Module 05 — Bypassing network filtering
Getting your traffic out of an environment that inspects and restricts what leaves it.
Module 06 — Process injection and migration
Running your code inside a process that is already trusted, and moving between them without being obvious.
Module 07 — Antimalware Scan Interface and PowerShell
The specific, recurring fight with PowerShell in a defended environment.
Module 08 — Kiosk and application breakouts
Escaping the restricted environment a user is handed, into the operating system underneath.
Module 09 — Microsoft SQL attacks
Turning database access into host and domain compromise.
Module 10 — Active Directory exploitation and lateral movement
The heart of the exam: moving through a hardened domain quietly and reaching the objective.
Module 11 — Combining the tradecraft under exam conditions
The chained operation, start to finish, which is what the exam actually tests.
Sitting the official exam
Exam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date. This course is Hacky Security's own preparation training; the certification itself is awarded by the certification body, not by us.
Similar courses
Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
