Reporting
⏱ ~3-min readAceMark Guide
What this topic is really about
OSCP exam rules restrict heavy automated exploitation tools (e.g., Metasploit) to one target, so candidates must demonstrate manual exploitation across the rest. The tools are legal in the lab and do work, but the certification tests hands-on skill, not automation reliance.
local.txt (user-level) and proof.txt (root/admin-level) are flag files whose contents you submit as evidence that you gained the corresponding access. They are not hints, config files, or hash stores; they validate your level of compromise.
See the mechanism
The graders need to reproduce your steps. A diagram for this topic isn't available yet — the worked example below walks the same reasoning step by step.
An exam-style question, fully explained
In an OSCP exam report, which is the single MOST important element to include for each successful exploit?
- Identify what the question tests: In an OSCP exam report, which is the single MOST important element to include for each successful exploit.
- The graders need to reproduce your steps.
- Clear commands, screenshots, and the proof file content are mandatory.
- Risk ratings are nice but not the make-or-break element.
Traps the examiner sets
- Risk ratings are nice but not the make-or-break element.
Test your recall
Answer each from memory — you'll see instantly whether you're right and why.
Run a focused 10-question mini-mock on Reporting and see it stick.
Practice more of this topic →