How I Passed OSCP as a High School Student

From CTFs to real-world penetration testing: what I learned from preparing for PEN-200, taking the 24-hour exam, and writing the report.

Photo by Markus Spiske on Unsplash

This post is a personal reflection on how I prepared for and passed OSCP while I was still in high school.

It is not an official exam guide. OffSec changes policies, exam structure, and course content over time, so always check the official documentation before making decisions. What I can offer is the part that is harder to find in official material: what the process felt like, how I planned my preparation, where I struggled, and what mindset helped me survive the exam.

I came from a CTF-heavy background. Before OSCP, I had spent most of my time on pwn, reverse engineering, web challenges, and local cybersecurity communities in Taiwan. OSCP became my first serious attempt to turn those skills into something closer to practical penetration testing.

Where the story began

Around the end of December, after participating in several CTF-related projects and competitions, I started wondering whether it was time to challenge myself with a formal cybersecurity certification.

One day, while hanging out with my friend Jackoha, I brought up OSCP almost casually:

*> Me: Getting OSCP sounds pretty cool. Should we try it?

Jackoha: …Sure.*

That night, I went home and convinced my mom to pay for the course. The next day, I told Jackoha, “I bought it. What about you?” His reaction was basically three question marks.

Checkout age confirmation

Looking back, it was more impulsive than I realized at the time. The checkout page included a confirmation that the user was over 18, which became relevant very quickly because I was not. At that stage, I was still mostly learning through CTFs, and OSCP felt like a way to understand what practical penetration testing looked like beyond challenge-based problems.

Buying OSCP as a minor

One part of my experience that may be useful to younger students: I was still a minor when I purchased the course.

If you are underage, the proper approach is to contact OffSec first and clarify the process. You may need guardian consent, identity documents, and additional verification. In some cases, OffSec may assign an account manager to confirm that your guardian understands and approves the purchase.

My process was less smooth. I purchased the course first, then OffSec noticed my age and temporarily suspended my account. After that, I had to provide documents and go through verification with my guardian.

That week was honestly stressful. The payment had already been made, but my account was paused until everything was confirmed. Eventually, the issue was resolved, but the lesson was clear: take a close look at every word on the contract and the confirmation checkbox.

From CTF thinking to penetration testing thinking

PEN-200 is very hands-on. It is not a certification you can pass by memorizing definitions. You need to enumerate, exploit, escalate privileges, pivot, document evidence, and repeat the whole process under time pressure.

My CTF background helped a lot. I was already comfortable reading unfamiliar output, digging into services, and thinking adversarially. But OSCP is not just a CTF with a longer timer.

In many CTF challenges, the vulnerability is intentionally shaped for the player. The path is hidden, but it often has a certain elegance. In OSCP-style labs, the path feels messier. You may spend hours on enumeration before realizing that the missing piece was a small misconfiguration, a forgotten credential, or a service you did not investigate carefully enough.

The topics that challenged me most were tunneling, Kerberos, and Windows privilege escalation. These were not just single techniques to memorize. They required understanding how networks, identity, permissions, and services interact in a real environment.

That was probably the biggest shift for me: OSCP rewards patience and process more than cleverness.

How I used the labs

The course material was useful, but the labs were where the real learning happened.

The capstone labs forced me to apply concepts from each chapter. The challenge labs felt more like integrated practice, where enumeration and decision-making mattered more than simply knowing one technique.

Some machines took me several days. A few took almost a week. During that period, my routine was simple: school during the day, OSCP at night.

If your main goal is to pass the exam, I would recommend completing Challenge Labs 0 to 2 and ABC, then spending focused time on PG Practice. Hack The Box and TryHackMe are both valuable, but PG Practice felt closer to the OffSec style, especially when time is limited.

I completed around 15 PG Practice machines before the exam. That number is not impressive compared with people who solve more than a hundred, but I cared more about reviewing each machine properly. After each box, I asked myself:

• What did I miss during enumeration?
• Which assumption led me in the wrong direction?
• What should be added to my checklist?
• Which privilege escalation path did I fail to consider early enough?

That review process mattered more than the raw number of boxes.

The exam day

My exam started on a Saturday morning at 10:00. I entered the proctoring system around 15 minutes early, and the actual work began after identity and environment checks.

The proctoring process was quieter than I expected. The VPN pack was provided after verification, and the proctor mostly stayed in the background unless screen sharing disconnected or something needed attention.

Because of the NDA, I will use placeholder names for the machines. Here was my timeline:

• 10:15–11:41: AD01 local, 10 points
• 11:41–12:30: Lunch
• 12:30–14:13: Stuck everywhere, no meaningful progress
• 14:30–15:30: One-hour nap
• 15:30–17:08: Standalone01 local, 20 points
• 17:08–23:23: AD02 local, 30 points
• 23:23–23:39: AD03, completed the AD set, 50 points
• 23:39–02:06: Standalone02 local, 60 points
• 02:06–02:10: Standalone02 privilege escalation, reached 70 points
• 02:10–07:00: Re-exploitation, screenshots, evidence, and report preparation

The hardest part was not a single exploit. It was the long, empty stretch where nothing worked. You start questioning your methodology. You wonder if you missed something obvious. You worry that the entire attempt is falling apart.

That is where OSCP becomes more than a technical exam. It tests whether you can keep thinking clearly when your confidence starts to degrade.

The report

After the exam ended, I slept for a while, then finished and submitted the report later that day.

My approach was to document during the exam instead of leaving everything for Day 2. Every command, screenshot, proof, and reproduction step was recorded as I went. It slowed me down slightly during exploitation, but it made the reporting phase much less painful.

I used noraj’s OSCP Exam Report Template Markdown as a base and modified it to better match the official Word template available at the time. One thing I would recommend: do not trust any community template blindly. Check the current official requirements yourself and make sure the structure, evidence, and table of contents are aligned.

I submitted the report on Sunday and received the passing email early Monday morning.

OSCP certificate

It felt unreal. OSCP was not just another badge to me. It was the first time I had proven, in a relatively formal way, that the skills I built through CTFs could survive a more practical and less predictable environment.

The mindset that helped me pass

One month before the exam, I was extremely anxious. I had only finished Challenge Labs 0 to 2, and seeing the remaining labs made me postpone the exam by a week.

Later, I realized that my anxiety was not only because I was unprepared. It was because I had no clear definition of “prepared enough.” OSCP does not give you that comfort. The exam is designed around uncertainty.

OffSec is famous for the phrase “Try Harder.” At first, it sounds like a slogan. But after spending hours stuck on a machine, I started to understand it differently.

Trying harder does not mean blindly repeating the same failed approach. It means being willing to question your assumptions, rebuild your enumeration, and test ideas even when they seem unlikely.

One quote stayed with me throughout the exam:

Channel your inner child and keep asking questions and experimenting with ideas, even if you think it won’t work. Most ideas will probably fail, but all you need is one success. — Ally Petitt

That sentence helped me reframe failure. I did not need every idea to work. I only needed one path to eventually work.

Final thoughts

Passing OSCP was an important milestone in my cybersecurity journey. It helped me understand the gap between CTF skills and practical penetration testing, and it taught me how to stay functional under pressure, fatigue, and uncertainty.

I am grateful to my parents for supporting me, to Jackoha for preparing with me, and to the cybersecurity community for all the shared knowledge that made this path possible.

If you are preparing for OSCP, my advice is simple: read the official rules, build a consistent practice routine, document everything, review every failure, and trust your process when the exam becomes uncomfortable.

Try harder, you must.