Skip to content
HackIndex.io

Free study path · OffSec PEN-210

OSWP (PEN-210) Study Path

An independent, structured study path aligned with the OSWP® (PEN-210) exam syllabus, covering wireless attacks: 802.11 fundamentals, WEP/WPA/WPA2 cracking, WPS exploitation, rogue access points, WPA Enterprise, and captive portals.

Modules
17
Resources
39
Study time
~22 h
Difficulty
Intermediate

Exam at a glance

Duration
3 hours 45 minutes + 24-hour report window
Scenarios
3 wireless network scenarios, only one active at a time (switch via control panel)
Objective
Recover the wireless key in each scenario, connect to the AP, read proof.txt from http://192.168.1.1/proof.txt
Passing
Complete proof.txt on 2 of 3 scenarios (one mandatory), pass/fail
Allowed tooling
aircrack-ng suite, airmon-ng, tmux, and similar manual tools
Restrictions
No automated wireless tools (wifite, wifiphisher, besside-ng), no AI chatbots
Environment
Provided Kali with wireless card via OpenVPN; SSH/RDP/screen for extra shells
Proctoring
Proctored (prerequisite check with proctor at start)
Certification
OSWP (OffSec Wireless Professional)

Prepare for the OSWP® Exam with Free, Hands-On Study Material

The OffSec Wireless Professional (OSWP®) is a hands-on certification focused on attacking 802.11 wireless networks. It is earned by passing OffSec®'s PEN-210 exam (Foundational Wireless Network Attacks), which validates that a candidate can evaluate the encryption and vulnerabilities of a wireless network, circumvent its security, recover the encryption keys or credentials in use, and gain access to the target access point.

The PEN-210 exam syllabus covers the IEEE 802.11 standard, wireless network architecture, and encryption schemes (WEP, WPA, WPA2, WPA Enterprise); the Linux wireless stack, drivers, and monitor mode; frame analysis with Wireshark and Kismet; and practical attacks with the Aircrack-ng suite, bettercap, reaver, and hashcat, including WPS attacks, rogue access points, and captive portals. This study path organizes free HackIndex content around those topics in its own structure.

HackIndex is independent study material and is not affiliated with, endorsed by, or sponsored by OffSec. All content here is original: it maps to the public exam topics with real commands and expected output, and links to OffSec's official pages as the authoritative source.

The OSWP® exam gives you 3 hours and 45 minutes against three wireless network scenarios, only one active at a time, followed by a 24-hour reporting window. For each scenario you recover the wireless key, connect to the access point, and read proof.txt. You pass by completing two of the three scenarios. Automated wireless tools like wifite and wifiphisher are banned, so manual command-line proficiency with the Aircrack-ng suite is what the exam rewards.

Syllabus modules

Work through the modules in order. Each one explains the topic and links the content worth your time.

  1. 1

    Getting Started: Wireless Assessment Workflow

    How the wireless assessment workflow maps to HackIndex content, and how to use this study path for the OSWP.

    No resources yet ~0.25 h

  2. 2

    IEEE 802.11

    Understand the 802.11 standard, its bands and channels, and the management, control, and data frame types that wireless attacks abuse.

    1 resource ~1 h

  3. 3

    Wireless Networks

    Understand wireless network architecture (infrastructure vs ad-hoc), the AP/station/BSSID/ESSID components, and enumerate and map them.

    2 resources ~1 h

  4. 4

    WiFi Encryption

    Understand WEP, WPA, WPA2, and WPA3, identify which a network uses, and recognize the weaknesses (including WPA3 Dragonblood) that make each attackable.

    4 resources ~1.5 h

  5. 5

    Linux Wireless Stack and Tools

    Configure the Linux wireless stack: pick a capable adapter, manage drivers, and enable monitor mode for capture and injection.

    3 resources ~1 h

  6. 6

    Wireshark Essentials

    Capture wireless traffic locally and remotely, filter 802.11 frames, and decrypt WPA traffic to extract credentials with Wireshark and tshark.

    3 resources ~1.5 h

  7. 7

    802.11 Frames and Client Interaction

    Read and manipulate 802.11 management frames to uncover hidden SSIDs and identify personal vs enterprise authentication.

    2 resources ~1 h

  8. 8

    Aircrack-ng Essentials

    Drive the Aircrack-ng suite by hand: scan with airodump-ng, capture WPA handshakes via deauth, and crack legacy WEP with IV injection.

    3 resources ~2 h

  9. 9

    Cracking Wireless Authentication Hashes

    Crack WPA/WPA2 PSKs from a handshake or PMKID and enterprise MSCHAPv2 hashes with aircrack-ng, hashcat, and asleap.

    3 resources ~2 h

  10. 10

    Attacking WPS Networks

    Discover WPS-enabled APs and recover the PIN (and WPA PSK) via Pixie Dust and online brute force, handling WPS lockouts.

    5 resources ~1.5 h

  11. 11

    Rogue Access Points

    Stand up evil twin and KARMA rogue APs with hostapd-mana, force clients to associate, and intercept their traffic.

    2 resources ~2 h

  12. 12

    Attacking WPA Enterprise

    Identify WPA Enterprise networks with weak certificate validation and harvest MSCHAPv2 credentials with rogue APs (hostapd-mana, EAPHammer).

    3 resources ~2 h

  13. 13

    Attacking Captive Portals

    Bypass captive portal restrictions via DNS/ICMP/MAC side channels, and harvest credentials with a cloned rogue portal.

    2 resources ~1.5 h

  14. 14

    bettercap Essentials

    Use bettercap for wireless recon, deauthentication, and handshake capture, then ARP spoofing and traffic interception after network access.

    2 resources ~1 h

  15. 15

    Kismet Essentials

    Use Kismet for long-running passive wireless monitoring across multiple interfaces, with a web UI, logging, and capture export.

    1 resource ~1 h

  16. 16

    Wireless Chipsets and Drivers

    Identify an adapter's chipset and active driver to confirm monitor mode and injection support and troubleshoot failures.

    1 resource ~0.75 h

  17. 17

    Connecting to Networks Manually

    Connect to WPA/WPA2 Personal and Enterprise networks manually with wpa_supplicant, then enumerate the network to reach the proof.

    2 resources ~1 h

  18. Complete the path

    17 modules to finish.