OSED
OffSec Exploit Developer · OffSec
The OSED validates Windows user-mode exploit development: reverse engineering binaries, writing stack overflow and format string exploits, building custom shellcode and bypassing protections such as DEP and ASLR. It is the third pillar of the OSCE³. Its strength is a skill that few certifications test seriously; its limit is a narrow specialism, valued mainly by vulnerability research teams and some red teams.
- Exam
- Proctored practical exam of 47 h 45: three exploit development tasks, pass mark 60/100 (points only for fully completed tasks), then 24 h to submit the report.
- Exam price
- Sold with the trainingExam not sold alone: Course + Cert Bundle (90 days of EXP-301, one attempt) US$1,749, or Learn One subscription US$2,749 a year (two attempts). Retake: US$249.
- Required experience
- None formally. In practice: comfortable with C, x86 assembly, a debugger and Python scripting.
- Validity and maintenance
- Valid for life: no expiry date and no maintenance fee. Counts towards the OSCE³ and can renew an OSCP+.
- Format
- Hands-on
Who is it for?
Penetration testers and researchers who want to move into vulnerability research and exploit writing, with solid C and assembly knowledge.
Domains covered
- Stack buffer overflows
- Reverse engineering with IDA Pro and a debugger
- Writing custom shellcode
- Bypassing DEP and ASLR
- Format string vulnerabilities and read primitives
Nestor’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
