# Offensive Security Wireless Professional (OSWP) - (PEN-210) - Notes ## Context: As you might already know, I cleared my **OSCP exam in August 2025.** As part of the **Learn One subscription**, OffSec was kind enough (thank you, OffSec Team) to include an **OSWP exam voucher** as a complimentary bonus. After surviving the OSCP journey, I decided to take a short break. That “short break”… turned into *months*. Initially, I planned to attempt the **OSWP exam around mid-November 2025**. However, between a busy work schedule and some personal commitments, studying kept getting postponed. You know how it goes *“I’ll start tomorrow”* is the most dangerous sentence in cybersecurity. Meanwhile, my **Learn One subscription was set to expire on 15th December 2025**, which meant one thing: *Attempt the OSWP exam before the deadline… or forever regret it.* So, like any responsible professional under pressure, I activated **panic mode**. I took **one dedicated week**, focused completely on preparation, and got help from a friend who had already cleared the OSWP exam (shout-out to friends who save careers). With his guidance and some disciplined last-minute prep, I felt confident enough to schedule the exam. **Exam Attempt Date:** 10th December 2025 and **Result:** PASSED !!! (And yes, if I’m writing this blog post, you already know how it ended) I want to be very honest here.... I **did not take extensive notes** during my preparation. Instead, I created a **small, simple cheat sheet** to quickly refer back to commands during the exam. The attacks felt **straightforward and easy to understand**, largely thanks to the **amazing resources shared by the author(s)** I followed during my prep. Credit where credit is due. Good learning material makes all the difference. ## About the OSWP Exam The **Offensive Security Wireless Professional (OSWP)** certification is designed for anyone who wants to specialize in **wireless penetration testing**, with a strong focus on **Wi-Fi security in enterprise environments**. If OSCP teaches you how to break *everything*, OSWP zooms in and asks, *“Cool, but what about the air?”* The course material walks you through: * Wireless fundamentals (how Wi-Fi actually works beyond “it connects”) * Tools required to attack wireless networks * End-to-end attack methodologies * Important parameters and configurations, explained mostly in theory By the end of the course, you’ll understand **why certain Wi-Fi attacks work**, not just how to run commands and hope for the best. #### How It Feels Coming from OSCP If you’re coming from **OSCP**, OSWP feels more **focused and calm**. There’s no pivoting through ten machines or chaining exploits at 3 a.m. Instead, it’s about understanding the wireless environment, identifying weak points, and exploiting them methodically. #### The One Real Drawback One thing I personally felt was missing: **official hands-on labs**. The OSWP course provides strong theoretical coverage, but it doesn’t include dedicated lab environments for learners to practice attacks. For a topic as practical as wireless testing, this can feel a bit limiting. Reading about attacks is helpful but actually capturing handshakes and validating your approach is where confidence really builds. #### Bridging the Gap with WiFiChallenge Labs To solve this, I turned to an external resource called [**WiFiChallenge Labs**](https://lab.wifichallenge.com/), and honestly, it made a huge difference. WiFiChallenge Labs offers **realistic, hands-on wireless attack scenarios** and covers nearly all the attacks discussed in the OSWP theory material. It’s especially useful for: * Practicing attacks end to end * Translating theory into muscle memory * Preparing for exam-style problem solving Think of it as the practical lab environment that OSWP never officially shipped. #### Final Thoughts The **OSWP exam** is a solid choice for anyone aiming to build or deepen their expertise in **wireless security**. While the absence of official hands-on labs can initially feel like a limitation, combining the course material with the right external practice resources easily fills that gap and makes the learning experience much more effective. If Wi-Fi has ever felt like invisible magic that works one day and breaks the next for no obvious reason, OSWP helps you understand what’s really happening behind the scenes and then teaches you how attackers take advantage of it. ## OSWP Exam Format The **OSWP exam** is a practical, time-bound exam that focuses on real-world wireless attacks. You are given **3 hours and 45 minutes** to complete the exam and **24 hours** after the exam to draft and submit your report to the OffSec team. Although OffSec usually shares the results within **7–10 business days**, in my case I received the result within **24 hours** of submitting the report. The exam environment consists of **three live wireless networks**. Out of these, **one network is mandatory**, and from the remaining two, you need to successfully compromise **any one**. In simple terms, you must solve **at least two wireless networks** to pass the exam. For each target wireless network, your objective is straightforward: identify the weakness, perform the required attack, and obtain the **access point key or credentials**. Once the network is compromised, you must connect to the access point and retrieve the **flag**. There is **no GUI-based login** provided for accessing the compromised access points. Instead, you are expected to use [**`wpa_supplicant`**](https://w1.fi/wpa_supplicant/) to connect to the wireless network and then extract the flag from the target system. This process might sound intimidating at first, but it is well explained in the cheat sheet and resources that I’ll be sharing later in this blog. For the reporting part, you can use the [**official report template provided by OffSec**](https://www.offsec.com/wifu/OSWP-Exam-Report.docx). The format is clean, structured, and very easy to follow. As long as you clearly document your methodology, commands used, and findings, writing the OSWP exam report is a smooth and straightforward process. This section should give you a clear, high-level overview of the **OSWP exam format**. In the next part of the blog, I’ll walk through the **resources and preparation strategy** that helped me clear the exam with limited preparation time. ***Note:** During the OSWP exam, you will be provided with OpenVPN access, along with SSH and RDP credentials for a Kali Linux machine. All attacks against the three target wireless access points must be performed from this Kali system.* ## My Exam Day I scheduled my **OSWP exam for the afternoon of 10th December 2025**. Like most exams, it didn’t start exactly the way I planned. I initially faced some **network issues on my Kali Linux VM**, caused by driver problems on my host machine. Because of this delay, the exam started a bit late, and OffSec kindly granted me a **30-minute extension**, which helped reduce the initial stress. Once everything was sorted, I received **OpenVPN access** along with **RDP and SSH credentials** for the Kali Linux machine. This Kali VM was used to perform all the wireless attacks against the target Wi-Fi access points in the exam environment. After settling in, the exam went smoothly. I was able to **successfully compromise all the required wireless access points** and retrieve **all the flags**. Overall, I completed the practical part of the exam in about **1.5 hours**, which gave me plenty of breathing room. With the technical part done, I immediately started working on the **exam report**. I focused on clearly documenting each attack, adding **detailed proof-of-concept screenshots**, explanations, and **step-by-step reproduction instructions** as required. The reporting process took me around **2 hours**, after which I submitted the report to the OffSec team using their prescribed format. About **24 hours after submitting the report**, I received the confirmation that I had **passed the OSWP exam**. And that, in short, is how my OSWP exam day unfolded—some initial hiccups, followed by a smooth and rewarding finish. ## OSWP Exam Related Resources: * [OSWP Exam Guide](https://help.offsec.com/hc/en-us/articles/360046904731-OSWP-Exam-Guide) * [OSWP Exam FAQ](https://help.offsec.com/hc/en-us/articles/360046904551-OSWP-Exam-FAQ) * [(PEN-210) Foundational Wireless Network Attacks FAQ](https://help.offsec.com/hc/en-us/articles/360046454712--PEN-210-Foundational-Wireless-Network-Attacks-FAQ) * [Linux WPA/WPA2/WPA3/IEEE 802.1X Supplicant](https://w1.fi/wpa_supplicant/) * [WiFiChallenge Lab](https://lab.wifichallenge.com/) *** *** *** **`Hacker's Mantra:`**` ``Privacy is not just about hiding things or keeping secret, it’s about controlling who has access to your life. - Timsux Wales` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://blog.rootkid.in/exam-prep-notes/offensive-security-wireless-professional-oswp-pen-210-notes.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.