You cannot read your way to an OSCP. The exam is twenty-four hours in front of live machines you have to break into, and there is no study guide for it, because there is nothing to memorize and hand back. No multiple choice, no blueprint to recite. You get a VPN, a set of targets, and a report to write, and the certification exists to check one thing: can you actually do it. So the most expensive mistake here is not picking the wrong book. It is buying a stack of them and expecting the reading to be the work.
Understand that before you spend anything on OSCP prep. Offensive Security’s own PEN-200 courseware, the material, the videos, and the labs, is the study guide. The books on Amazon do a different job: each one teaches a surface the exam attacks you across. And the classic OSCP reading lists that still circulate are wrong for the current exam in two specific ways. They still push a buffer overflow foundation, which was removed from the course and the exam machines in the last major update. And they are thin on Active Directory, which was added in the January overhaul and is now forty percent of your score. The modern OSCP shelf is Active Directory first and buffer overflow free.
This guide sorts that shelf. Five books, each mapped to a surface the exam actually tests, chosen against the exam as it is now, not as it was five years ago. Then the section on what to leave on the shelf, and the honest part at the end about the things no book on this list can give you.
Checked against Offensive Security’s current PEN-200 exam structure and live Amazon listings in September 2026. None of it is hands-on work, because these are books, and the only lab that counts is the exam.
Why there is no OSCP study guide, and what the books are for
The OSCP exam is a twenty-four hour proctored practical over a private VPN. You identify, exploit, and report real vulnerabilities on live lab systems, then you write the report in a second window. Nothing on it is a question you answer in words. It is scored out of one hundred points, and you pass at seventy. The points come from two places, and the split tells you exactly where to spend your preparation.
| Exam component | Share | What it tests |
|---|---|---|
| 3 standalone machines | 60% | Initial access then privilege escalation, one box at a time |
| 1 Active Directory set | 40% | A full breach chain across a domain, from a foothold to the controller |
That is the whole exam. Three standalone targets worth twenty points each, and one Active Directory set worth forty. There is no lecture to sit and no theory paper. The courseware teaches the method and gives you the labs to practice it in, and it is the thing OffSec sells you as the guide. What it cannot do inside its own page count is go deep on every surface, and that is the gap the books fill. You buy them to get good faster at the specific things the targets will demand: breaking web applications to get a foothold, escalating privilege on a box you have landed on, and chaining a domain from one user to the controller. A book that does not sharpen one of those is not an OSCP book, however good it is on its own terms.
What the old OSCP reading lists get wrong now
Search for an OSCP reading list and most of what you find was written for an exam that no longer exists. Two changes broke those lists, and both matter to what you buy.
The first is buffer overflow. For years it was the reliable twenty-five points, the one machine you drilled until you could do it in your sleep, and every list handed you a book to learn it from. It was removed from the course and the exam machines in the last major revision. It is gone. If a reading list leads with an exploitation classic because of its buffer overflow chapters, that list has not been updated since the change, and neither has the advice around it.
The second is Active Directory. The January overhaul added a dedicated domain set and made it forty percent of the exam, the single largest block on the paper. A candidate who cannot move through a Windows domain now fails almost half the exam before touching a standalone box. The old lists predate this and barely mention it. So the correction is blunt: demote the buffer overflow reading, and put an Active Directory book at the front. That is why the list below starts where it does.
The five OSCP books at a glance
None of these carries an exam code on the cover, because OSCP does not brand books the way a multiple choice certification does. Each one owns a surface. Prices move week to week, so treat every figure as a band to check against the live listing, and check stock too on the two that are running thin.
| Book | Publisher | Surface it teaches | Pages | Price band |
|---|---|---|---|---|
| Pentesting Active Directory and Windows-based Infrastructure | Packt | The Active Directory set (the 40%) | 360 | about $27 |
| The Web Application Hacker’s Handbook, 2nd ed | Wiley | Web, the deep reference | 912 | about $30 |
| Bug Bounty Bootcamp | No Starch | Web, modern and hands on | 416 | about $41 |
| Metasploit, 2nd Edition | No Starch | The exploitation framework | 288 | about $43 |
| Black Hat Python, 2nd Edition | No Starch | Writing your own tools | 216 | about $30 |
The cheapest book on the list is the one that covers the largest block of the exam, which tells you how badly the market lagged the Active Directory change. Start there.
1. Pentesting Active Directory and Windows-based Infrastructure by Denis Isakov
Buy this one first, and do not let the low price fool you into thinking it is the small pick. It covers the forty percent of the exam the old lists skip, and it is the reason the shelf leads with Active Directory instead of exploitation.
Denis Isakov walks the domain attack chain in the order you meet it: enumerate the domain, abuse Kerberos, hunt delegation and certificate template weaknesses, move laterally, and take the controller. That is the exact shape of the exam’s breach set, a foothold on one machine turned into full domain control across three. The techniques are current, which matters more here than anywhere else on this list, because Active Directory tradecraft moves fast and the certificate attacks in particular are recent. Work it alongside the courseware’s own Active Directory module so the vocabulary lines up, and use it to turn the module’s overview into something your hands have done.
Who it is for: every OSCP candidate, because losing the domain set is losing almost half the exam. Skip it if you do not yet know what a domain controller is or how a domain trusts a user, because it assumes that baseline and moves quickly past it. Learn the fundamentals in the courseware first, then let this take you deep. Around $27, the cheapest pick here, check the live price.
2. The Web Application Hacker’s Handbook, Second Edition by Dafydd Stuttard and Marcus Pinto
Web is how you get onto most of the standalone boxes, and this is the reference that teaches the attack classes cold. Read the caveat first though: the second edition is from over a decade ago, and the tooling screenshots show it.
Written by the creator of Burp Suite and his co-author, it is the deepest treatment of web attack classes you can buy: how authentication breaks, how access control is bypassed, how injection and logic flaws actually work under the hood. The specific tool interfaces have aged, so treat the walkthroughs as the shape of the technique rather than a script to follow key for key. What has not aged is the taxonomy. When a standalone box hands you a login form or a file upload, the way you reason about it comes from a book like this, and no shorter treatment covers the ground as completely. It is the longest book on the list by a wide margin, and it is a reference you return to, not a weekend read.
Who it is for: anyone who wants the web attack surface understood properly, not just a list of payloads. Skip it if you want current tool walkthroughs you can run as printed, because that is the next pick, and reach for this as the reference behind it. Around $30, check the live price.
3. Bug Bounty Bootcamp by Vickie Li
This is the modern web book, the one to work through where the handbook shows its age. Vickie Li wrote it around current tooling and current bug classes, and it is built to be done, not just read.
It takes you from recon through the web vulnerabilities you meet today, each set up and then exploited against a real target, with the current tools rather than screenshots from a decade back. The framing is bug bounty, so it is oriented toward finding and reporting rather than toward an exam, but the skills transfer straight onto a standalone box, because a foothold through a web app is a web bug you found and used. Pair it with the handbook and you get both halves: the reference that explains why an attack works, and the walkthrough that shows you doing it with the tools on your Kali box right now.
Who it is for: the reader who wants current, worked web attacks to practice against real targets. Skip it if you want exam-shaped structure, because this is shaped like a bounty program, and the mapping to the exam is yours to make. Around $41, check the live price.
4. Metasploit, Second Edition: The Penetration Tester’s Guide
Learn the framework you will lean on, from the current edition, co-authored by the person who founded Offensive Security. This is the canonical Metasploit book brought up to date, and the authorship is the reason to trust the tone.
David Kennedy, Mati Aharoni, Devon Kearns, Jim O’Gorman and Daniel Graham take you through the framework properly: discovery, the module system, exploitation, payloads, and post exploitation, with the second edition refreshed for how the tool works now. Aharoni founded Offensive Security and built Kali, which is worth remembering when the book tells you how a professional actually drives the framework. There is one thing to hold in mind for the exam though. OSCP restricts Metasploit use to a single target, so the framework will not carry you through the paper. Learn it here until you are fluent, then spend equal effort learning to do the same work by hand, because that is what the other targets demand.
Who it is for: everyone sitting the exam, because you need the framework cold even though you cannot rely on it. Skip it if you are hoping it does the heavy lifting on exam day, because the single-target limit is there precisely to stop that. Around $43, the priciest pick here, and stock is thin at the moment, so check availability as well as the price.
5. Black Hat Python, Second Edition by Justin Seitz and Tim Arnold
The last pick is for the moments a stock tool does not fit and there is no framework to reach for. When the target needs something you have to write, this is where you learn to write it.
Justin Seitz and Tim Arnold show you how to build the small offensive tools that fill the gaps between the big ones: scanners, proxies, credential grabbers, and the post-exploitation glue that turns a foothold into movement. The second edition is written for Python 3, which the first was not, so it runs as printed on a current box. It is the shortest book on the list and the highest leverage per page, because the habit it builds, reaching for a few lines of your own code instead of hunting for a tool that almost fits, is exactly the habit a timed practical rewards.
Who it is for: candidates who can already read and write basic Python and want the offensive patterns. Skip it if you have never scripted, because this teaches offensive technique in Python, not the language itself, and you need the language first. Around $30, and like the Metasploit guide it is running low in stock, so check availability before you count on it.
The books to leave on the shelf
The most recommended OSCP book on the internet is the one to be most careful with. Jon Erickson’s exploitation classic is a genuinely great book, and its exploitation core is buffer overflow, the topic the exam dropped in its last revision. Every stale reading list still puts it near the top on reputation. For this exam it is off syllabus, and building your plan around it means drilling points that are no longer on the paper. Read it later, for the understanding, not now, for the exam.
Walk past anything sold as the official OSCP study guide, because there is no such thing. Offensive Security sells the PEN-200 courseware, and that material is the study guide. A paperback marketed with the exam’s name and no connection to OffSec is not official, whatever the cover implies. Below that sits the usual flood of self published exam prep and cheat sheet titles, no established imprint, no author you can look up, priced to ride the search traffic. Self published does not mean bad, the field manuals practitioners actually carry are self published, but a generically titled OSCP guide from an author with no track record is not the place to spend money that should go on lab time.
A few strong books are missing on purpose. Georgia Weidman’s introduction, the Red Team Field Manual, and The Hacker Playbook are all fine OSCP-adjacent reading, but they are the picks in our guide to CompTIA PenTest+ books, and repeating them here would make two guides into one. If you are choosing a path across the wider security stack, the CySA+ book guide covers the defensive analyst side, the Security+ book guide covers the foundation most people should hold before attempting OSCP, and the broader cybersecurity reading list applies the same publisher and edition checks used here.
What none of these books can give you
The three things that decide the exam are not in any book on this list. The first is enumeration, and it is a habit, not a chapter: the discipline to keep looking after you think you have found everything, because the foothold is almost always in the thing you skipped. The second is privilege escalation instinct, which lives in references that change too fast to print, the living command collections and technique sites you keep open in a browser tab, plus the notes you build from your own boxes. The third is lab reps, the hours of breaking machines that turn all of the above from things you have read into things you do without thinking. If you are still assembling that practice environment, our walkthrough on getting started with penetration testing is a practical place to build the first few boxes.
So use the books for what they are good at. Buy the Active Directory book to stop bleeding forty percent of your score, the web books to get onto the standalone targets, and the framework and scripting books to widen what you can do once you are in. Read them to shortcut the learning, then close them and spend the months in the labs, because that is where enumeration becomes a reflex and privilege escalation stops being a lookup. The books tell you what to try. The lab is where you learn to do it under a clock, which is the only thing the exam is really testing.
