# OSWP (PEN-210) Study Path

> An independent, structured study path aligned with the OSWP® (PEN-210) exam syllabus, covering wireless attacks: 802.11 fundamentals, WEP/WPA/WPA2 cracking, WPS exploitation, rogue access points, WPA Enterprise, and captive portals.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path
- **Vendor:** OffSec
- **Code:** PEN-210
- **Difficulty:** Intermediate
- **Exam duration:** 3 hours 45 minutes + 24-hour report window
- **Exam scenarios:** 3 wireless network scenarios, only one active at a time (switch via control panel)
- **Exam objective:** Recover the wireless key in each scenario, connect to the AP, read proof.txt from http://192.168.1.1/proof.txt
- **Exam passing:** Complete proof.txt on 2 of 3 scenarios (one mandatory), pass/fail
- **Exam allowed tooling:** aircrack-ng suite, airmon-ng, tmux, and similar manual tools
- **Exam restrictions:** No automated wireless tools (wifite, wifiphisher, besside-ng), no AI chatbots
- **Exam environment:** Provided Kali with wireless card via OpenVPN; SSH/RDP/screen for extra shells
- **Exam proctoring:** Proctored (prerequisite check with proctor at start)
- **Exam certification:** OSWP (OffSec Wireless Professional)
- **Official syllabus:** https://cdn.sanity.io/files/t7y0tkf4/production/ad8fb30e15bd9cd6b1da19984640f2df3d633daf.pdf
- **Practice machines:** https://hackindex.io/learn/oswp-pen-210-study-path/machines.md
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

## Prepare for the OSWP® Exam with Free, Hands-On Study Material

The OffSec Wireless Professional (OSWP®) is a hands-on certification focused on attacking 802.11 wireless networks. It is earned by passing OffSec®'s PEN-210 exam (Foundational Wireless Network Attacks), which validates that a candidate can evaluate the encryption and vulnerabilities of a wireless network, circumvent its security, recover the encryption keys or credentials in use, and gain access to the target access point.

The PEN-210 exam syllabus covers the IEEE 802.11 standard, wireless network architecture, and encryption schemes (WEP, WPA, WPA2, WPA Enterprise); the Linux wireless stack, drivers, and monitor mode; frame analysis with Wireshark and Kismet; and practical attacks with the Aircrack-ng suite, bettercap, reaver, and hashcat, including WPS attacks, rogue access points, and captive portals. This study path organizes free HackIndex content around those topics in its own structure.

HackIndex is independent study material and is not affiliated with, endorsed by, or sponsored by OffSec. All content here is original: it maps to the public exam topics with real commands and expected output, and links to OffSec's official pages as the authoritative source.

The OSWP® exam gives you 3 hours and 45 minutes against three wireless network scenarios, only one active at a time, followed by a 24-hour reporting window. For each scenario you recover the wireless key, connect to the access point, and read proof.txt. You pass by completing two of the three scenarios. Automated wireless tools like wifite and wifiphisher are banned, so manual command-line proficiency with the Aircrack-ng suite is what the exam rewards.

> [!WARNING]
> This is still a work in progress. The modules still need to be set up and finished.

## Modules

- [Getting Started: Wireless Assessment Workflow](https://hackindex.io/learn/oswp-pen-210-study-path/introduction-to-pen-210.md): How the wireless assessment workflow maps to HackIndex content, and how to use this study path for the OSWP.
- [IEEE 802.11](https://hackindex.io/learn/oswp-pen-210-study-path/ieee-802-11.md): Understand the 802.11 standard, its bands and channels, and the management, control, and data frame types that wireless attacks abuse.
- [Wireless Networks](https://hackindex.io/learn/oswp-pen-210-study-path/wireless-networks.md): Understand wireless network architecture (infrastructure vs ad-hoc), the AP/station/BSSID/ESSID components, and enumerate and map them.
- [WiFi Encryption](https://hackindex.io/learn/oswp-pen-210-study-path/wifi-encryption.md): Understand WEP, WPA, WPA2, and WPA3, identify which a network uses, and recognize the weaknesses (including WPA3 Dragonblood) that make each attackable.
- [Linux Wireless Stack and Tools](https://hackindex.io/learn/oswp-pen-210-study-path/linux-wireless-tools-drivers-and-stacks.md): Configure the Linux wireless stack: pick a capable adapter, manage drivers, and enable monitor mode for capture and injection.
- [Wireshark Essentials](https://hackindex.io/learn/oswp-pen-210-study-path/wireshark-essentials.md): Capture wireless traffic locally and remotely, filter 802.11 frames, and decrypt WPA traffic to extract credentials with Wireshark and tshark.
- [802.11 Frames and Client Interaction](https://hackindex.io/learn/oswp-pen-210-study-path/frames-and-network-interaction.md): Read and manipulate 802.11 management frames to uncover hidden SSIDs and identify personal vs enterprise authentication.
- [Aircrack-ng Essentials](https://hackindex.io/learn/oswp-pen-210-study-path/aircrack-ng-essentials.md): Drive the Aircrack-ng suite by hand: scan with airodump-ng, capture WPA handshakes via deauth, and crack legacy WEP with IV injection.
- [Cracking Wireless Authentication Hashes](https://hackindex.io/learn/oswp-pen-210-study-path/cracking-authentication-hashes.md): Crack WPA/WPA2 PSKs from a handshake or PMKID and enterprise MSCHAPv2 hashes with aircrack-ng, hashcat, and asleap.
- [Attacking WPS Networks](https://hackindex.io/learn/oswp-pen-210-study-path/attacking-wps-networks.md): Discover WPS-enabled APs and recover the PIN (and WPA PSK) via Pixie Dust and online brute force, handling WPS lockouts.
- [Rogue Access Points](https://hackindex.io/learn/oswp-pen-210-study-path/rogue-access-points.md): Stand up evil twin and KARMA rogue APs with hostapd-mana, force clients to associate, and intercept their traffic.
- [Attacking WPA Enterprise](https://hackindex.io/learn/oswp-pen-210-study-path/attacking-wpa-enterprise.md): Identify WPA Enterprise networks with weak certificate validation and harvest MSCHAPv2 credentials with rogue APs (hostapd-mana, EAPHammer).
- [Attacking Captive Portals](https://hackindex.io/learn/oswp-pen-210-study-path/attacking-captive-portals.md): Bypass captive portal restrictions via DNS/ICMP/MAC side channels, and harvest credentials with a cloned rogue portal.
- [bettercap Essentials](https://hackindex.io/learn/oswp-pen-210-study-path/bettercap-essentials.md): Use bettercap for wireless recon, deauthentication, and handshake capture, then ARP spoofing and traffic interception after network access.
- [Kismet Essentials](https://hackindex.io/learn/oswp-pen-210-study-path/kismet-essentials.md): Use Kismet for long-running passive wireless monitoring across multiple interfaces, with a web UI, logging, and capture export.
- [Wireless Chipsets and Drivers](https://hackindex.io/learn/oswp-pen-210-study-path/determining-chipsets-and-drivers.md): Identify an adapter's chipset and active driver to confirm monitor mode and injection support and troubleshoot failures.
- [Connecting to Networks Manually](https://hackindex.io/learn/oswp-pen-210-study-path/manual-network-connections.md): Connect to WPA/WPA2 Personal and Enterprise networks manually with wpa_supplicant, then enumerate the network to reach the proof.

> [!NOTE]
> HackIndex is independent study material, not affiliated with, endorsed by, or sponsored by OffSec. OSWP® and OffSec® are registered trademarks of OffSec Services Limited. PEN-210 is an OffSec course designation. This study path uses only original HackIndex content and links to OffSec's official pages as the authoritative source.