What Tools Are Allowed in the OSCP Exam? Complete Guide to Compliance and Restrictions for 2025

Table of Contents

• Why Are Tool Restrictions Important in the OSCP Exam?
• What Tools Are Allowed in the OSCP Exam?
• What Tools or Actions Are Restricted or Prohibited?
• How to Ensure Compliance with OSCP Exam Tool Policies
• Recommended Tools Table for OSCP Exam
• How Ethical Hacking Training Institute Helps You Prepare Within These Guidelines
• Conclusion
• Frequently Asked Questions (FAQs)

The Offensive Security Certified Professional (OSCP) exam is one of the most challenging and respected certifications in the cybersecurity world. It tests your ability to perform real-world penetration testing within a controlled environment. Knowing which tools are allowed during the OSCP exam and understanding the compliance and restrictions is crucial for exam success and maintaining the integrity of your certification.

In this detailed blog, we will cover the tools permitted in the OSCP exam, the reasoning behind tool restrictions, and how to prepare within these guidelines effectively.

Why Are Tool Restrictions Important in the OSCP Exam?

The OSCP exam is designed to test practical skills, not just knowledge of automated tools. Offensive Security wants candidates to demonstrate their:

• Technical expertise

• Manual penetration testing skills

• Problem-solving ability

Allowing all tools without restriction would reduce the challenge, so they enforce strict tool compliance to ensure fairness and rigor.

What Tools Are Allowed in the OSCP Exam?

1. Pre-installed Tools on Kali Linux

The exam environment provides a standard Kali Linux virtual machine with many pre-installed tools. These include:

• Nmap: For network scanning and port enumeration.

• Netcat: For network communication and reverse shells.

• Metasploit Framework: Allowed but only for limited use (like certain exploit payloads).

• Burp Suite: For web application testing and intercepting requests.

• Nikto: Web server scanner.

• Gobuster / Dirb: Directory and file brute forcing.

• Python, Bash, Perl scripting: For custom exploit development or automation.

• Wireshark / tcpdump: For network traffic analysis.

2. Custom Scripts and Tools

Candidates are allowed to use their own custom scripts or tools written in languages like Python, Bash, or Perl — provided these do not violate exam policies (e.g., no automated full exploit scripts). This tests your ability to understand and customize exploits.

3. Basic Operating System Utilities

• Ping

• Traceroute

• SSH clients

• Telnet

• Curl / Wget

These tools assist in network exploration and interaction and are considered essential.

What Tools or Actions Are Restricted or Prohibited?

1. Automated Vulnerability Scanners

Automated scanners like Nessus, OpenVAS, Nexpose, or any tool that automatically identifies and exploits vulnerabilities are strictly prohibited. The exam expects you to perform manual analysis and exploitation.

2. Full Exploit Scripts or Frameworks That Bypass Manual Work

Tools that completely automate exploitation without user input, such as some Metasploit modules or publicly available exploit scripts without modification, are discouraged or disallowed if they bypass the learning process.

3. Network Attacks Outside the Exam Environment

Any attacks outside the designated lab or exam machines are strictly forbidden. This includes port scanning or exploiting targets not assigned during the exam.

4. Collaboration or External Help

Using outside help, forums, or collaborating with others during the exam is a violation of the honor code and results in disqualification.

How to Ensure Compliance with OSCP Exam Tool Policies

• Use the official Kali Linux machine provided by Offensive Security for the exam.

• Stick to tools and scripts that you have learned or developed during your PWK course.

• Avoid unauthorized tools or full exploit automation.

• Follow the exam rules and honor code strictly.

• Familiarize yourself with manual exploitation techniques for buffer overflows, privilege escalation, and web vulnerabilities.

Recommended Tools Table for OSCP Exam

How Ethical Hacking Training Institute Helps You Prepare Within These Guidelines

At Ethical Hacking Training Institute, our OSCP training emphasizes hands-on, manual penetration testing skills and adherence to OSCP tool compliance policies. Our curriculum ensures you:

• Master manual techniques for enumeration and exploitation.

• Develop and customize your own scripts for unique challenges.

• Get expert mentorship on the appropriate use of allowed tools.

• Practice with simulated OSCP-compliant labs mimicking the exam environment.

Conclusion: Master Tools While Respecting Compliance

Understanding what tools are allowed and restricted in the OSCP exam is vital to your preparation strategy. Using the right tools the right way showcases your true penetration testing ability, which is what OSCP values most.

Stay disciplined, practice manual techniques, and leverage Ethical Hacking Training Institute’s guidance to confidently pass your OSCP exam on the first try.

FAQs

What tools are pre-installed and allowed in the OSCP exam?

Pre-installed tools like Nmap, Netcat, Burp Suite, Gobuster, and scripting languages (Python, Bash) on Kali Linux are allowed for manual penetration testing during the OSCP exam.

Are automated vulnerability scanners allowed in the OSCP exam?

No, automated vulnerability scanners such as Nessus, OpenVAS, or Nexpose are strictly prohibited in the OSCP exam to maintain manual testing standards.

Can I use Metasploit during the OSCP exam?

Metasploit is allowed but only for limited use, mainly payload delivery. Fully automated exploitation modules that bypass manual work are discouraged.

Is it allowed to bring custom scripts to the OSCP exam?

Yes, candidates can use custom scripts or tools they developed themselves, provided these follow the exam’s honor code and don’t automate full exploits.

Can I use exploit scripts from Exploit-db during the OSCP exam?

Only if you understand, modify, and use them manually. Copy-pasting without comprehension is against exam rules.

Are network attacks outside the exam lab environment permitted?

No, attacking or scanning machines outside your assigned exam environment is strictly forbidden.

Can I collaborate or get help during the OSCP exam?

No, the OSCP exam requires individual effort, and collaboration or external assistance violates the honor code.

What basic operating system utilities are allowed in the OSCP exam?

Utilities like ping, traceroute, SSH clients, telnet, curl, and wget are allowed for network analysis and communication.

How does Ethical Hacking Training Institute prepare me for OSCP tool compliance?

The institute focuses on manual exploitation techniques, tool usage within exam guidelines, and custom scripting to align with OSCP’s policies.

Why is manual testing emphasized over automated tools in the OSCP exam?

Manual testing proves a candidate’s deep understanding and skill in penetration testing rather than relying on automated scans.

Is Wireshark allowed in the OSCP exam?

Yes, Wireshark and tcpdump are allowed for network traffic analysis during the exam.

Can I bring external tools to the OSCP exam?

No, you must use the Kali Linux VM provided by Offensive Security with only approved tools.

What scripting languages can I use to develop custom tools for OSCP?

Python, Bash, Perl, and other scripting languages supported by Kali Linux are allowed for writing custom tools.

Are full exploit scripts that automate penetration allowed?

No, fully automated exploit scripts that bypass manual effort are prohibited.

What should I do if I am unsure whether a tool is allowed in the OSCP exam?

Stick to the official Kali Linux tools and your learned manual techniques, and avoid any questionable automation.

Does the OSCP exam environment include the Metasploit Framework?

Yes, but with restrictions on its use mainly for payload generation.

Can I use brute forcing tools like Hydra or Medusa in the OSCP exam?

Yes, these tools are generally allowed for password attacks within exam scope.

What is the penalty for using disallowed tools in the OSCP exam?

Using prohibited tools can lead to exam disqualification and certification revocation.

How important is understanding the tools for OSCP success?

Very important, as OSCP tests your ability to use tools effectively, manually, and ethically.

Can I practice OSCP tools at Ethical Hacking Training Institute before the exam?

Yes, the institute offers labs and practice environments compliant with OSCP standards.

What role do tools like Gobuster or Dirb play in the OSCP exam?

They are used for directory and file brute forcing on web servers during the exam.

Is Burp Suite’s free edition sufficient for OSCP exam needs?

Yes, the free edition is sufficient for manual web application testing during the exam.

Are packet sniffers allowed in the OSCP exam?

Yes, tools like Wireshark and tcpdump for traffic analysis are permitted.

Can I use tools that automate privilege escalation?

No, privilege escalation must be done manually to demonstrate skill.

Does OSCP allow GUI tools during the exam?

Yes, graphical tools included in Kali Linux like Burp Suite and Wireshark are allowed.

Is the use of Kali Linux mandatory in the OSCP exam?

Yes, Offensive Security provides a Kali Linux VM that candidates must use during the exam.

What should I avoid to maintain compliance during the OSCP exam?

Avoid automated scanners, unauthorized external tools, collaboration, and attacking out-of-scope machines.

How to develop compliant custom tools for OSCP?

Learn scripting and coding basics, focus on manual exploits, and test your scripts extensively.

Can using unauthorized tools affect my OSCP certification?

Yes, violating exam policies can lead to failure or revocation of your certification.

Where can I find official OSCP exam tool guidelines?

On Offensive Security’s official website and exam policy documents.