OSCP+ exam documentation is the report that demonstrates how you achieved the exam objectives on each target. It must describe your exploitation process in enough detail for a technically competent reader to reproduce your steps. That means recording relevant commands, console output, attack results, and required proof screenshots—not just listing the tools you used.
A well-prepared OSCP+ exam report template can help you organize evidence during the exam and write the report afterward. Use it as a structure for your own work, and check the current OffSec exam guide and Exam Control Panel for the requirements that apply to your attempt. OffSec can update its instructions, so verify submission details before exam day.
OSCP+ exam report requirements
OffSec requires a professional penetration testing report that documents the attacks used against each target. The steps should be clear, complete, and reproducible. If you skip a command, omit relevant output, or fail to connect an action to its result, the reader may not be able to follow your reasoning.
The OSCP+ exam report documentation should explain what you observed, what you did next, and what result you obtained. For example, when a scan reveals a service that leads to further investigation, record the relevant finding and the next action. Include enough context to show how each step contributed to the objective.
Documentation affects scoring. OffSec warns that insufficient reporting can reduce or eliminate points for a target. It also states that report submission is final; missing screenshots or information cannot be added afterward. Plan time to review the report before you submit it.
OSCP+ exam report template and structure
OffSec provides report templates for Microsoft Word and OpenOffice/LibreOffice. Candidates are encouraged to use them, but the exam guide also allows a custom template if it presents the required information in a structured, professional way.
A practical OSCP+ report structure can include:
- A title page using the required filename and candidate identifier
- A contents page or clear navigation
- A separate section for each target
- A chronological account of the attack steps
- Relevant commands and console output
- Exploit source and modification details, when applicable
- Proof screenshots with short explanatory captions
- A final review checklist
These are organizational suggestions, not additional OffSec scoring rules. Use the current exam guide and Exam Control Panel to confirm which objectives and evidence apply to your exam. Your OSCP+ penetration test report sections should make it easy to find the proof for each objective and understand how you reached it.
How to document exploit steps and commands
Write the attack narrative in sequence. For each meaningful step, state what you did, what you observed, and how the result influenced your next action. This makes the report easier to review and helps you check whether the evidence supports the conclusion.
The OSCP+ exploit steps documentation should identify the exploit used and explain relevant changes. OffSec instructs candidates to provide the source URL for an unmodified exploit instead of copying the full code into the report. If you modified an exploit, include the modified code, the original source URL, the command used to generate shellcode when applicable, the changes made, and why you made them. Scripts and proof-of-concept code required for the submission must appear as text in the report PDF.
Keep notes while you work. A note that says “ran exploit” is too vague to rebuild the attack later. Record the command, relevant output, target, and result. This is the simplest way to make an OSCP+ exam report reproducible without relying on memory after the exam.
OSCP+ proof screenshot requirements
Each target has at least one proof file, such as local.txt or proof.txt. OffSec requires candidates to retrieve the proof, enter its contents in the Exam Control Panel before the exam ends, and include a screenshot in the report. The screenshot must show the proof file contents and the target’s IP address. The guide specifies retrieving proof from its original location through an interactive shell using type or cat.
For every required image, check the OSCP+ report screenshot checklist:
- The proof contents are readable.
- The target IP address is visible.
- The image shows an interactive shell.
- The screenshot is placed in the relevant target section.
- The caption explains what the evidence demonstrates.
The control panel does not confirm whether a submitted proof value is correct. Verify it before entry, and confirm that the report contains the required screenshot for each applicable target. OffSec lists missing proof in the control panel or screenshot among the reasons a target can receive no points.
Organize notes before the report-writing period
A template is most useful when you use it throughout the exam instead of reconstructing the attack later. Keep notes organized by target. Capture the important findings, commands, output, proof values, and screenshot references while the details are fresh.
OffSec recommends treating the exam network as a penetration test engagement: record important information as you work, then complete the final report. This workflow helps reduce gaps between your notes and the finished report.
For a broader preparation plan, read our guides on how to prepare for the OSCP+ 24-hour exam and OSCP vs. OSCP+: new updates for 2026. Use those articles for preparation context; rely on OffSec’s current exam instructions for reporting and submission rules.
OSCP+ exam report submission format
The OSCP+ exam report submission format requires a PDF report archived in a .7z file. The archive must not be password-protected and must contain the PDF in the format specified by OffSec. The guide also sets a maximum archive size of 200 MB.
| Submission item | Current guide requirement |
|---|---|
| Report file | |
| Archive | .7z, not password-protected |
| PDF filename | OSCP-OS-XXXXX-Exam-Report.pdf |
| Archive filename | OSCP-OS-XXXXX-Exam-Report.7z |
| Filename handling | Case-sensitive; replace OS-XXXXX with your OSID |
| Archive size | No more than 200 MB |
| Submission period | Within 24 hours after the exam ends |
| Upload verification | Compare the upload’s MD5 hash with your local archive |
These OSCP+ exam report PDF and 7z requirements should be checked against the current guide before submission. The archive must use the exact filename format, including capitalization. Review the PDF after export to confirm that screenshots, code, and page layout remain readable.
After uploading, compare the MD5 hash shown by OffSec with the hash of your local archive. If they do not match, the upload was not successful. Follow the upload page instructions, re-upload if needed, and complete the final submission step after verifying the hash.
OSCP+ exam documentation checklist
Use this OSCP+ exam documentation checklist for your final review:
- Each target has a clear, step-by-step attack narrative.
- Relevant commands and console output are included.
- Exploit modifications and required code details are documented.
- Proof is entered in the Exam Control Panel before the exam ends.
- Required proof screenshots show the contents and target IP address.
- The report is exported as a readable PDF.
- PDF and archive filenames follow the required case-sensitive format.
- The
.7zarchive is unencrypted and within the file size limit. - The archive contains the required PDF and no disallowed file formats.
- The local and uploaded MD5 hashes match.
- The upload is completed through OffSec’s designated process.
OSCP+ report documentation mistakes to avoid
Common OSCP+ report documentation mistakes include missing evidence, unclear attack steps, unreadable screenshots, and incorrect filenames. Candidates can also lose clarity by placing a screenshot far from the target narrative it supports or by pasting output without explaining what it demonstrates.
Do not leave the PDF export and upload until the final moments. Reserve time to proofread the report, check every target section, inspect screenshots, and verify the archive. Since the submission is final, a careful review is part of the reporting process.
Follow exam conduct rules during the exam and reporting phase. OffSec prohibits the use of AI chatbots during both phases. Prepare your template and reporting workflow in advance, then use your own authorized work and the official instructions when completing the report.
Frequently asked questions
Is there an official OSCP+ exam report template?
Yes. OffSec provides Microsoft Word and OpenOffice/LibreOffice templates. Candidates may use their own template if it presents the required information in a structured, professional manner.
What should an OSCP+ report include?
It should describe the exploitation process for each target, including relevant steps, commands, console output, and required proof screenshots. The report should be detailed enough for a technically competent reader to reproduce the documented steps.
What is the OSCP+ report upload deadline?
The current exam guide allows 24 hours after the exam ends to upload the report. Follow the stated submission process and verify the MD5 hash before completing the upload.
What is the OSCP+ exam report filename format?
The guide provides the filename patterns OSCP-OS-XXXXX-Exam-Report.pdf and OSCP-OS-XXXXX-Exam-Report.7z. Replace OS-XXXXX with your OSID and preserve the required capitalization.
How can I reduce the chance of missing report evidence?
Record steps and results as you work, organize evidence by target, and use a final checklist to review screenshots, proof submissions, filenames, archive size, and upload verification.
Ready to Start Your OSCP+ Certification Journey?
Contact our team for OSCP+ certification online training, study resources, practice questions, and exam preparation support.
Contact UsBefore your exam, review the latest OSCP+ Exam Guide and OffSec Reporting Requirements. For the current certification overview, visit OffSec’s OSCP+ page.