Enumerate and exploit
Gather information, scan for vulnerabilities and exploit web, client-side and host weaknesses on live systems.
Partners and press
Overview
Reading about exploits is easy. OSCP gives you 24 hours to land them.
OSCP is OffSec’s level 200 hands-on penetration testing certification, earned through PEN-200 with no formal prerequisites. The 24-hour proctored exam has three standalone machines plus an Active Directory set of three, graded on access and escalation. Passing earns OSCP and OSCP+: OSCP never expires, while OSCP+ lasts three years.
8Topics
1440Minutes
8Skills
8Roles
What it tests
Learn all the way down.
Learn all the way down.
Perform when it matters.
Escalate and pivot
Raise privileges on Windows and Linux, tunnel through compromised hosts, and reach deeper networks.
Break Active Directory
Attack an AD environment and move laterally through a simulated breach across several machines.
Report what you did
Document each finding with the evidence that proves it, because the exam asks you to report, not just exploit.
Course outline
What this course will cover.
What this course will cover.
The full outline is on its way.
We design this course ourselves. OffSec runs the exam and issues the credential, and LUNARTECH is independent of OffSec.
An introduction to cybersecurity and study strategy, plus encryption and cryptography.
- Study strategy
- Cryptography
Information gathering, enumeration, and vulnerability scanning and assessment with tools such as Nmap and Nessus.
- Nmap
- Nessus
- Information gathering
Cross-site scripting, command injection, directory traversal, file uploads and SQL injection, with tools such as Burp Suite and sqlmap.
- XSS
- SQL injection
- File uploads
- Burp Suite
Attack passwords with tools such as Hydra, and evade antivirus software in the payloads you deliver.
- Hydra
- Shellter
- Antivirus evasion
Raise privileges on both Windows and Linux hosts after initial access.
- Windows
- Linux
Move between machines, tunnel traffic through compromised hosts, and reach networks you could not see from outside.
- Tunneling
- Lateral movement
- Pivoting
Attack Active Directory environments and move laterally through them, as the exam’s simulated breach requires.
- Active Directory
- Lateral movement
Enumerate and exploit Amazon Web Services environments.
- AWS
- Enumeration
- Exploitation
Issued by
Certifying body · Independent of LUNARTECH
OffSec
OffSec builds the courses and runs the hands-on exams that go with them. Exams are proctored by OffSec staff over a private VPN, and some credentials, such as OSCP+, expire after three years unless renewed. LUNARTECH is independent of OffSec.
How you get there
Top-tier roles go to people who can do the work.
Top-tier roles go to people who can do the work.
Here’s how you get there.
Know where you start.
No formal prerequisites. OffSec recommends solid TCP/IP networking, reasonable Windows and Linux administration experience, and basic Bash or Python scripting.
Work through the course.
Eight topics, with the full outline on its way.
Sit it with OffSec.
OffSec runs the exam and issues the credential, so you register and book directly with them.
Support
Support at every stage.
Support at every stage.
You won’t be working through this alone.
Before you start
Try it first.
A 3-day free trial opens a selection of the content. Your card is only charged once it ends.
While you learn
Mentors within reach.
Stuck on a concept? Reach out to a mentor whenever you need help.
While you learn
One-on-one sessions.
On the yearly plan, one-on-one sessions give you dedicated support.
Any time
A team behind you.
Write to info@lunartech.ai at any point, from your trial onwards. If your employer is funding you, we’ll set it up with them directly.
All the way through
A schedule that fits around your life.
Your own paceFrom anywhereAt any hour
After the last lesson
Stay in the network.
Your alumni network stays with you: ongoing support, opportunities and industry insight.
Career support
Career support, past the last lesson. Coaching, a sharper resume, real interview preparation and the people to know.
Career direction
Tailored coaching helps you decide where to aim and how to get there.
Strong portfolio
Hands-on projects become work you can show, not just claim.
Resume and profile
Personalized refinement, so what you send says what you can actually do.
Interview preparation
Preparation for the questions that decide it, so you walk in ready.
Network and search
Connections with industry leaders, and an alumni network that stays with you.
Reviews
Real stories from the community.
LUNARTECH Academy has been the most empowering learning experience of my life, giving me a clear, structured path from the absolute basics to building real-world AI systems with confidence.
Your page is fantastic. As a bachelor’s student in Data Science now accepted for a master’s at UConn, your work has been a real source of motivation.
The programme’s clear, bite-sized content and practical projects dramatically improved my speed from fuzzy idea to MVP and my ability to communicate AI value. I followed the system, and it works.
I really appreciate your teaching style and the way you break down complex topics. It has been incredibly helpful.
After years working mainly with R for econometrics, I found your Python machine learning course a refreshing and engaging way to learn Python.
As a Data Science graduate, I want to thank you for the effort you put into making videos to support growing data scientists.
I’ve been following your work since taking your machine learning course, and I’m impressed by your practical approach to applying AI.
Why choose us
Built around how you actually learn.
One standard behind every course, from the first lesson to long after the last.
Hands-on practice
Apply every idea to real problems, so it becomes something you have used, not only seen.
Industry-aligned curriculum
We keep courses current with the tools, techniques and skills the field asks for.
Flexible learning
Study at your own pace, from anywhere, at any hour.
Certificate of completion
Finish the course and earn a certificate that shows what you have learned.
Focus on your success
Personalized learning plans and support structures carry you through the hard parts.
Lifetime alumni network
Stay connected after you finish, with ongoing support, opportunities and industry insight.
Your certificate
It doesn’t raise its voice. Neither will you.
Finish a LUNARTECH course and its certificate is issued in your name, under our signature. OffSec’s credential comes from OffSec, when you pass its exam.
Certificate of completion
Your Name
OSCP course
LUNARTECH RISE Academy
Pricing
This course comes with the membership.
This course comes with the membership.
So does everything else.
One membership opens every course, certification, workshop and masterclass in the Academy. Every plan starts with a 3-day free trial. You register and book the exam directly with OffSec.
3 days free, then $29.97 a month. Your card is only charged once the trial ends.
Included in every plan
- Every course in the Academy
- Every certification course
- Workshops and masterclasses
- A certificate of completion
- A 3-day free trial
- Learning at your own pace
- The lifetime alumni network
- Upgrades at any time
In practice
Eight roles.
Eight roles.
One credential across them all.
No single job owns it. Here’s where each role leans hardest, and where its work ends up.
- 01Foundations
- 02Enumeration
- 03Web attacks
- 04Passwords, AV
- 05Escalation
- 06Pivoting
- 07Active Directory
- 08AWS
-
The job is finding the path in, then proving it. The exam is that job in 24 hours.
Enumeration, Web attacks, Escalation, Pivoting
Consulting firms, Financial services
-
Clients pay for findings they can act on. Reporting is part of the exam.
Enumeration, Web attacks, Active Directory
Consulting firms, Government
-
Red team work builds on this foundation. AD attacks and pivoting lead the way.
Passwords, AV, Pivoting, Active Directory
Internal security teams, Financial services
-
Defend what you have attacked yourself. Cloud and web exposure get tested.
Enumeration, Web attacks, AWS
Internal security teams, Cloud-first companies
-
Enumeration shows your network the way an outsider reads it. Pivoting shows how one weak host reaches the rest.
Enumeration, Pivoting
Internal security teams, Consulting firms
-
Privilege escalation is mostly misconfiguration you could fix. Knowing the paths tells you what to harden first.
Escalation, Passwords, AV, Active Directory
Internal security teams
-
A web flaw looks different once you have used it. Exploitation turns a bug report into a priority.
Web attacks, Foundations
Consulting firms, Internal security teams
-
A leaked key and an overbroad role can open a cloud account. The AWS section covers that path.
AWS, Escalation
Cloud-first companies, Financial services
- Consulting firms
- Internal security teams
- Financial services
- Government
- Cloud-first companies
Penetration Tester
The job is finding the path in, then proving it. The exam is that job in 24 hours.
Over 10,000 students trust LUNARTECH
LUNARTECH gives you the skills
to learn, build, create and lead.
Engineers
Understand systems all the way down. Build the ones others rely on.
Scientists
Understand what the data says. Build models that hold up.
Researchers
Understand the papers. Build on them, and take the work further.
The field
Anyone can use AI.
Anyone can use AI.
Few can engineer it. This is where that starts.
+340%growth in open roles requiring AI skills
Roles and pay
~35,000 open roles right now
Open roles: Built In, Greenhouse, LinkedIn.
Typical salaries: Glassdoor, Levels.fyi, Payscale, Indeed, Ravio, JobRise, U.S. BLS. Military: 2026 U.S. basic pay, drone officers with aviation incentive pay.
Updated November 2026.
FAQ
Frequently asked questions.
Need help? These answers cover most of what people ask before they start.
No. OffSec issues it. LUNARTECH is independent of OffSec, and its names and marks belong to it. When you finish a course of ours, you earn a LUNARTECH certificate of completion for that course.
No. We design this course ourselves, around what the exam covers. OffSec has no part in it, and you still register and book the exam directly with OffSec.
1440 minutes, remote, proctored.
No formal prerequisites. OffSec recommends solid TCP/IP networking, reasonable Windows and Linux administration experience, and basic Bash or Python scripting.
Does not expire. OSCP+ lasts 3 years: recertify, pass another OffSec exam, or complete CPEs.
We last reviewed it on 5 November 2026, from OffSec’s own pages. Details change, so check the official page before you book.
Our 3-day free trial gives you access to a selection of content in the bootcamps, courses and materials, so you can experience the value of our content first-hand. This includes comprehensive learning materials and interactive sessions. You won’t be charged during this period, though we require your credit card details at the start to ensure a seamless transition should you choose to continue.
Yes, entering your credit card details is a necessary step to begin your free trial. The process is entirely secure, and we ask for it to provide a seamless transition to a paid subscription if you decide to continue beyond the trial. You will only be charged after the trial period ends, with full access to our content based on the plan you choose.
After your 3-day free trial you gain access to the full breadth of our content, depending on the subscription plan you choose. We offer free trials for our monthly, bi-annual and annual plans, and each plan provides a different scope of access and benefits.
If your employer has agreed to fund your learning, in part or in full, please contact us at info@lunartech.ai. We’ll work with you and your employer to set up everything needed for your subscription.
Yes. Our support remains strong both during your free trial and after you subscribe. Reach the team at info@lunartech.ai with any question, whether you’re onboarding, navigating your trial, or need help as a member. Subscribers to the yearly plan also receive dedicated support in one-on-one sessions.
You can upgrade your plan at any time during your subscription. Downgrading is not available for bi-annual or annual plans, but you can cancel and then choose a new plan that suits you better. For bi-annual and annual plans we also offer payment in instalments; please reach out to learn more.
The course
Build the skills behind OSCP.
Prove you can break into a network and document how. Start with a free trial, or enroll in a plan and work through the course at your own pace. OffSec runs the exam and issues the credential.
LUNARTECH is independent of the vendors and certifying bodies listed here. Their names, exam titles and marks belong to them, exams are run by them, and credentials are issued by them. Reviewed 5 November 2026. Catalogues change often, so confirm the details on the official page before you book.
