OSED – OffSec Exploit Developer

The OffSec Exploit Developer (OSED) is an intermediate-level, performance-based certification for security professionals seeking to master Windows user-mode exploit development. Earned by completing the EXP-301 course and passing a rigorous 48-hour practical exam, the OSED validates expertise in reverse engineering, custom exploit creation, and bypassing critical security defenses.

The EXP-301 course, 'Windows User Mode Exploit Development,' teaches learners how to write their own shellcode, create custom exploits, and adapt older exploitation techniques to modern Windows versions. Students gain hands-on experience with stack buffer overflows, SEH overflows, format string attacks, and advanced ROP chain construction to bypass protections like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).\n\nThe OSED exam is a 47-hour and 45-minute practical challenge where candidates must independently solve three exploitation tasks, earning points by fully completing each assignment. A minimum score of 60 out of 100 points is required to pass. The exam emphasizes reverse engineering to locate vulnerabilities and requires all exploit code to be written in Python3.

This certification is one of three that make up the OffSec Certified Expert (OSCE3) credential, alongside the OSWE and OSEP. It is ideal for penetration testers, exploit developers, security researchers, and malware analysts looking to specialize in low-level Windows exploitation.