Prove You Can Bypass Modern Defenses
The ODPC exam is a hands-on, performance-based offensive development challenge designed to validate real world capability against modern defensive controls.
This is not a course completion exam. It is a practical assessment that requires students to bypass EDR and AV protections, develop custom tooling, and demonstrate operational success across multiple target systems.
Exam Overview
The ODPC exam is structured as a multi-phase challenge.
- 48 hour hands-on technical assessment
- 10+ flags and required objectives
- Additional 48 hours to submit a professional report
The report is mandatory and must document:
- Exploitation methodology
- Payload development and execution
- C2 configuration and usage
- EDR/AV bypass techniques
- Code and supporting artifacts
Exam Only Option
White Knight Labs offers an Exam-Only option for $250.
This option is designed for experienced practitioners who want to attempt the certification without purchasing the full course content.
- One attempt at the ODPC exam
- No course content included
- Full access to the exam environment
- Same certification requirements and standards
This option is intended for operators who already have experience in offensive development and EDR evasion.
Starting the Exam
Students have full control over when they begin the exam.
- The exam can be started at any time
- No scheduled start time is required
- On-demand students unlock the exam after completing all ODPC modules
- Exam-only students receive immediate access after purchase
Once the exam is started:
- The process is fully automated
- The 48 hour timer begins immediately
- There are no pauses, resets, or extensions
- The exam cannot be restarted once initiated
Students should ensure they are fully prepared before starting.
Exam Objectives
The primary goal of the ODPC exam is to demonstrate the ability to operate against modern defenses.
Students are expected to:
- Bypass EDR and AV protections
- Develop or modify payloads to achieve execution
- Establish a working C2 beacon on each target machine
- Complete additional challenge objectives
- Adapt techniques when defenses block execution
- Students may use their own tools, scripts, and frameworks
- Custom development is expected and encouraged
- Public tools are allowed unless explicitly restricted
- Internet access for research is allowed
- Sharing solutions or collaborating with others is prohibited
Prebuilt tools alone are unlikely to succeed without modification.
Students may use:
- Cobalt Strike (provided in the environment)
- Open source C2 frameworks (such as Havoc)
- Their own custom or external C2 frameworks
All C2 frameworks must:
- Use TCP or HTTPS communication
- Maintain a working beacon/heartbeat
Students must demonstrate functional command and control on each target system.
All exam environments are hosted and managed by White Knight Labs and delivered through the student portal.
The live exam environment includes:
- Development Machine: Preconfigured system for payload development and testing
- Cobalt Strike Server: Configured with a custom profile
- Open Source C2 Server (Havoc or similar): Full root access provided
- Guacamole Access: Web-based access to all systems
- RDP Access: Backup access for redundancy
- Four Target Machines: Simulating enterprise environments with EDR and AV protections
The ODPC exam environment reflects real world defensive conditions.
- Multiple EDR and AV technologies
- Windows security controls
- Application control and monitoring
- Behavior-based detection mechanisms
Behavior-based detection mechanisms
Targets are intentionally challenging and modeled after real client environments.
To pass the ODPC exam, students must:
- Establish a working C2 beacon on each target system
- Successfully bypass defensive controls
- Complete required objectives and flags
- Demonstrate functional execution, not just attempted techniques
- Submit a professional report detailing all actions
What You Must Submit
Students are required to submit a professional report that includes:
- Step-by-step methodology
- Code or tooling used
- C2 configuration and communication details
- Screenshots showing successful execution
- Clear explanation of how defenses were bypassed
Incomplete or unclear reports will not pass.
After Submission
- Submissions are manually reviewed by experienced operators
- Reviews typically take 5 to 10 business days
- Students are notified via email once results are finalized
Environment Stability
- The exam environment is monitored by White Knight Labs
- If a platform issue occurs, support will investigate
- A free retest will be provided if a verified platform issue impacts the exam
- No resets or extensions are granted for user error
Retakes
Students may retake the exam if needed.
- Retakes are available immediately
- No cooldown period between attempts
- Each attempt requires a new exam purchase
Recommended Experience
Students attempting the ODPC exam should have:
- Strong understanding of Windows internals
- Experience with process injection and payload development
- Familiarity with C2 frameworks
- Prior penetration testing or red team experience
Exam-only candidates are expected to already possess this knowledge.
Not an Entry-Level Exam
This exam is not beginner friendly.
Students without prior offensive development or red team experience are unlikely to pass.
Should You Take the ODPC Exam
You should attempt this exam if:
- You can develop or modify payloads
- You understand process injection techniques
- You have experience with C2 frameworks
- You are comfortable debugging failed execution
You should not attempt this exam if:
- You are new to offensive security
- You rely entirely on public tooling
- You are not comfortable writing or modifying code
Student Portal Delivery
All exam access is provided through the White Knight Labs student portal.
The portal provides:
- Secure access to the exam environment
- Centralized system management
- Controlled access to targets
- Report submission workflow
Important Policies
- No extensions are granted once the exam has started
- The exam cannot be paused or restarted
- Exam vouchers are non-refundable
- All sales are final
Students should only start the exam when fully prepared.
Frequently Asked Questions (F.A.Q)
Is the ODPC exam beginner friendly
- No. This is not an entry-level exam. ODPC is designed for experienced practitioners with a background in offensive security, red teaming, or offensive development.
Do I need to take the course before the exam
- No. You may purchase the exam-only option if you already have the required knowledge and experience. However, the course is strongly recommended for most students.
When can I start the exam
- You can start the exam at any time.
- On-demand students unlock the exam after completing all ODPC modules
- Exam-only students receive access immediately after purchase
- There is no scheduled start time
What happens once I start the exam
- Once you start:
- The process is fully automated
- The 48 hour timer begins immediately
- The exam cannot be paused, restarted, or extended
- You must complete the technical portion within the allotted time
How long is the exam
- 48 hours for the technical challenge
- Additional 48 hours to complete and submit your report
What is required to pass
- To pass the exam, you must:
- Establish a working C2 beacon on each target system
- Complete required objectives and flags
- Successfully bypass defensive controls
- Submit a professional report documenting your work
What do I need to submit
- You must submit a professional report that includes:
- Step-by-step methodology
- Code or tooling used
- C2 configuration and communication details
- Screenshots showing successful execution
- Explanation of how defenses were bypassed
What Command and Control frameworks are allowed
- You may use:
- Cobalt Strike (provided)
- Havoc or other open source C2 frameworks
- Your own custom C2
- All C2 frameworks must use TCP or HTTPS and maintain a working beacon.
Can I bring my own tools
- Yes. You may use your own tools, scripts, and frameworks.
- Custom development is expected. Public tools may require modification to succeed.
Is internet access allowed during the exam
- Yes. You may use the internet for research and development purposes.
How many targets are in the exam
- The exam includes four target machines representing enterprise environments with EDR and AV protections.
What kind of defenses are in place
- The environment includes:
- EDR and AV protections
- Windows security controls
- Application control
- Behavior-based detection mechanisms
What if something breaks in the environment
- The environment is monitored by White Knight Labs
- If a verified platform issue occurs, it will be investigated
- A free retest will be provided if necessary
- No resets or extensions are granted for user mistakes
Can I reset the environment during the exam
- Yes, with limitations.
- Students may restart or rebuild individual machines if needed
- This can be used to recover from failed attempts or unstable states
- The exam timer continues running and will not reset under any circumstances
- Full environment resets and time extensions are not permitted
- Students are responsible for managing their time while rebuilding systems if necessary.
Can I extend my exam time
- No. There are no extensions under any circumstances once the exam has started.
Can I retake the exam
- Yes.
- Retakes are available immediately
- No cooldown period
- Each retake requires a new exam purchase
How long does it take to get results
- Reports are manually reviewed by experienced operators
- Reviews typically take 5 to 10 business days
- You will be notified by email once your results are finalized
Do I need to write code to pass
- Yes. This is an offensive development certification. You are expected to write or modify code to bypass defenses and achieve execution.
Can I reuse the same payload across targets
- You may reuse code, but it must be adapted to work against each target’s defensive controls.
What happens if I fail
- You may retake the exam at any time by purchasing another attempt. There is no cooldown period.
Are exam vouchers refundable
- No.
- Exam vouchers are non-refundable
- All sales are final
Can I collaborate with others during the exam
- No. Collaboration, sharing solutions, or receiving outside assistance from other individuals is strictly prohibited.
What language is the exam conducted in
- The exam and all materials are provided in English.
Is the exam environment shared with other students
- No. Each student receives an isolated exam environment.
Still Have Questions
If you have additional questions before attempting the exam, contact:
Ready to Attempt the ODPC Exam
The ODPC exam is built for practitioners who want to prove they can operate against modern defenses using real techniques and tooling.
Train with Confidence
White Knight Labs trains professionals who operate in production environments, mature defensive stacks, and regulated organizations.
If your goal is real offensive capability, not just a certificate, our training is built for you.
Quick Links
Contact
Services & Company Inquiries:
Student Support
(Billing, Labs, Content, Vouchers, Tickets):
Copyright © 2026 White Knight Labs – All rights reserved