Exam Report [repack] | Oswe

In the real world, a penetration tester’s value is measured by the quality of their report. A client cannot patch a vulnerability if they do not understand how it works or how to reproduce it. OffSec mirrors this reality. The exam report is not a formality; it is the primary product being graded.

If your Python exploit scripts work but your report lacks a clear explanation of the vulnerability logic, you risk losing critical points. Conversely, flawless documentation cannot save a failing technical score, but it ensures you receive every single point you earned during the 48-hour hacking window. Essential Prerequisites and OffSec Guidelines

Visually intuitive, but formatting large code segments and screenshot alignments can become frustrating. Compilation Tools

Here is a proposed feature design for an OSWE exam report scenario. oswe exam report

Explain why the code is vulnerable and how your input manipulates it.

Visual evidence is mandatory. Your screenshots must be clear and unedited.

Hour one: reconnaissance. The target web app looked ordinary—forms, endpoints, a few JavaScript libraries. My notes became a map: parameters, cookies, user roles. I moved carefully, fingerprinting frameworks and tracing hidden inputs. A misconfigured template engine glinted like a seam in concrete. I smiled; that seam was a promise. In the real world, a penetration tester’s value

The most common failure reason for the OSWE exam report is .

Write step-by-step instructions for a human to follow manually (without the script).

The OSWE exam is a brutal test of your ability to read code like a security engineer and break it like an attacker. But the report is where you prove that you understand what you broke. The exam report is not a formality; it

Did you copy the code directly out of your report draft and run it one last time to ensure no formatting or indentation errors were introduced?

Read through your report and see if you could re-run the attacks based only on your documentation.

Add comments explaining what each function does (e.g., # Step 1: Extract CSRF Token , # Step 2: Authenticate as regular user , # Step 3: Trigger SQLi to extract admin hash ).