Get ODPC Certified
Offensive Development Practitioner Certification – Live Instructor Led Training
- Level > Advanced
- Offensive tooling, evasion, and payload development executed live
Build, weaponize, and deploy offensive tooling with live guidance from experienced red team operators. The live ODPC training teaches students how to design, develop, and operationalize custom payloads and loaders to bypass modern defensive technologies. Students learn to build real world offensive tooling, evade EDR and Windows defenses, integrate with command and control frameworks, and adapt techniques when detections occur, all while following along with instructors in real time.
Prefer to train at your own pace?
View the On-Demand Offensive Development Practitioner Certification:
Certification Outcomes
- Become an officially certified Offensive Development Practitioner, recognized by red teams, consultants, and security teams responsible for bypassing modern defensive controls.
- All training, labs, and certification workflows are delivered through the White Knight Labs student portal. Live training students deploy, manage, reset, and destroy lab environments directly through the portal, with instructors walking through tooling design, evasion techniques, and debugging workflows during each training day.
Used by consultants, operators, and security teams that build and deploy real offensive tooling.
Student Portal and Lab Experience
Live training students use the same student portal as on-demand students.
The portal provides:
- Centralized access to all course content
- Guided lab deployment and teardown
- Build, reset, and destroy lab controls
- Environment visibility and tracking
- Private isolated lab environments
- Full control over testing workflows
Students operate in environments designed to simulate real defensive products.
Offensive Development Lab Environment
ODPC labs are designed to mirror real world defensive maturity.
Includes:
- Multiple live EDR products that rotate over time
- Windows security controls and application control
- AMSI, ETW, and behavioral detection
- Protected endpoints designed to frustrate attackers
Targets are derived from real client environments that challenged White Knight Labs red teams.
Command and Control Integration
Students integrate custom tooling with real command and control frameworks.
Includes:
- Cobalt Strike
- Havoc C2
- Bring your own C2 framework support
Students learn how offensive tooling behaves when used operationally, not just in isolation.
Immediate Access After Purchase
Students who purchase the live training receive immediate access to the full ODPC course content and student portal.
- Begin reviewing content and preparing development environments right away
- Deploy and explore lab environments before the live training begins
- Arrive prepared with questions and context
- Use live sessions to refine tooling and evasion techniques
Live training students receive the same content and labs as on-demand students, with the added benefit of live instruction and real time feedback.
To view the full self paced version of this course, see the on-demand ODPC certification:
Why Live ODPC Exists
The on-demand course teaches offensive development techniques.
The live training teaches how experienced operators debug, adapt, and rebuild tooling when defenses respond.
Live ODPC exists for students who want:
- Real time explanations when payloads fail
- Instructor insight into development tradeoffs and OPSEC considerations
- Accountability while working through complex tooling challenges
- Exposure to how professional red teams build and test payloads under pressure
This mirrors how offensive tooling is developed during real red team engagements.
Live Training Format
The live ODPC training is intentionally demanding.
- Four consecutive training days
- Six hours of live instruction per day
- One hour break per day
- Delivered live over Zoom
- Development and execution focused
This format reflects real world offensive development workflows.
What Makes the Live Training Different
Live training students receive everything included in the on-demand course, plus:
- Four days of live instructor led training
- Step by step walkthroughs of tooling development
- Real time explanations of evasion techniques
- Live debugging when payloads are blocked
- A private Discord channel for the live cohort
- Direct access to instructors during and after sessions
- Recorded live sessions provided after training
Students learn not just what works, but why payloads fail and how to fix them.
Private Discord Access
Live training students receive access to a private Discord channel limited to the training cohort.
- Ask questions during and between sessions
- Share blockers and receive instructor guidance
- Learn from peers building tooling alongside
- Continue discussions after live sessions end
This access is exclusive to live training students.
Here’s a Sneak Peek of Your Training Experience
A sample video is available to provide a sneak peek into the certification course structure and execution style.
Table of Contents Preview Download
All course material is delivered through the student portal. For transparency, students may download the Table of Contents to review the scope of topics covered prior to enrollment.
What You Will Be Able To Do After Live ODPC
By the end of the live training, students will be able to:
- Design and build custom offensive payloads
- Bypass modern EDR and Windows defenses
- Debug and adapt tooling when detections occur
- Integrate payloads with C2 frameworks
- Develop OPSEC aware tooling for real engagements
- Confidently lead offensive development efforts
Live Training Schedule
Upcoming live ODPC training sessions are listed on the White Knight Labs events calendar.
View upcoming live training dates:
Not ready for scheduled dates?
The on-demand ODPC certification is always available:
Certification Exam
Live training includes the same ODPC certification and exam as the on-demand course.
- Performance based certification exam
- Conducted against live defensive targets
- 48 hours for hands on exploitation
- 48 hours to submit a professional report
- One exam voucher included
- Exam voucher does not expire
Certification standards are identical regardless of training format.
Enrollment Information
Live instructor led certification training.
Four days of structured, hands on offensive development execution.
Immediate access to all course content through the student portal.
All labs deployed, managed, and reset through the portal just like the on-demand course.
Certified for Real World Offensive Development
- Validated Offensive Development Expertise
- Proves the ability to design, build, and deploy custom offensive tooling during guided, live execution
- Certification badge reflects hands on tooling and evasion, not attendance
- Demonstrates real world EDR bypass and payload development capability
- Industry Recognition & Trust
- Built and delivered by active red team operators
- Used by consultants and security teams building real offensive tooling
- Badge signals real world offensive development experience
- Independent Operator Mindset
- Performance based labs completed during and after live instruction
- Builds confidence debugging and adapting tooling under pressure
- All tooling and techniques documented in a professional certification report
Frequently Asked Questions (F.A.Q)
Is ODPC beginner friendly
- No. ODPC is an advanced offensive development certification. Students should already have experience with offensive security concepts, Windows internals, and basic red team tradecraft before enrolling.
What prior experience is recommended
- Students should be comfortable with C or C++, Windows internals, process injection concepts, and command line tooling. Prior exposure to red team operations, payload development, or EDR evasion is strongly recommended.
Is this course instructor led or self study
- ODPC live training is instructor led over scheduled training days. Students also receive full access to all course content through the student portal and may continue working through labs independently before and after the live sessions.
How is the live training delivered
- Live training is delivered remotely over Zoom. Instructors walk through tooling development, evasion techniques, and lab execution in real time while students follow along.
When will Zoom invites be sent
- Zoom invitations and session details are sent one to two weeks before the scheduled training start date.
Can live training dates change
- Yes. In rare cases, scheduled live training dates may change due to instructor availability, illness, or unforeseen circumstances. Students will be notified as early as possible if changes occur.
Does this course use real EDR targets
- Yes. ODPC includes multiple live EDR targets and defensive products modeled after real world client environments. These targets rotate over time to maintain realism.
What defensive technologies are included
- The course includes modern EDR platforms, Windows Defender components, AMSI, ETW, application control, and behavioral detection mechanisms commonly encountered during real engagements.
Are the lab systems isolated
- Yes. All lab environments are fully isolated and designed specifically for training and certification purposes.
How do students access the lab systems
- Students access lab systems through the White Knight Labs student portal using controlled access methods such as browser based access, Guacamole, and RDP, depending on the lab.
What Command and Control frameworks are used
- ODPC supports Cobalt Strike and Havoc C2 as primary command and control frameworks.
Do students receive access to Cobalt Strike
- Yes. Students receive controlled access to Cobalt Strike as part of the course.
Is Cobalt Strike locked down
- Yes. Cobalt Strike access is intentionally restricted. Students are given sufficient access to operate, test payloads, and gain experience, but administrative access to the team server is not permitted.
Can students modify profiles and create beacons
- Yes. Students can modify profiles, generate payloads, and establish working beacons during the course.
Which version of Cobalt Strike is used
- ODPC uses recent stable versions of Cobalt Strike. New versions are tested internally before being introduced into the course.
Is Havoc C2 supported
- Yes. Havoc C2 is fully supported and used throughout the course.
Can I bring my own Command and Control framework
- Yes. Students may bring and use their own C2 frameworks, provided they comply with lab rules and do not disrupt shared infrastructure.
Do I need my own AWS account
- Yes. Students are required to have their own AWS account with sufficient permissions to deploy lab infrastructure.
Does the portal track AWS cost
- The student portal provides visibility into lab usage. Students are responsible for monitoring AWS costs within their own account.
Can I set budgets and auto stop rules
- Yes. Students can configure AWS budgets and automatic stop rules to help control spending.
What happens if I break the environment
- Students can destroy and rebuild their lab environment at any time through the student portal.
Are all labs supported by video walkthroughs
- No. Not all labs include video walkthroughs. Some labs receive videos later as content is expanded. Every lab includes detailed written guidance and explanations in the student portal.
Where is support provided
- Support is provided through a private Discord channel for live training students, where instructors and peers can assist.
How often is ODPC updated
- ODPC is updated regularly to reflect changes in defensive technologies, EDR behavior, and offensive development techniques.
Will defensive targets change
- Yes. EDR platforms and defensive configurations rotate and evolve to maintain realism and prevent static solutions.
How long do I have access
- Course content and portal access do not expire at this time and remain available for the life of the certification.
Is there a certification exam
- Yes. ODPC includes a performance based certification exam.
How long is the exam
- Students are given 48 hours to complete the exam, followed by an additional 48 hours to submit a professional certification report.
Does the exam voucher expire
- No. One exam voucher is included with the course and does not expire.
What is required to pass
- Students must successfully bypass defensive controls, demonstrate functional payload execution, capture required flags, and submit a professional report detailing their tooling and techniques.
Is this course designed to be difficult
- Yes. ODPC is intentionally frustrating and demanding. Students are expected to fail, debug, adapt, and improve tooling as defenses respond.
What language is supported
- English is the only supported language at this time. Browser based translation tools may assist but are not officially supported.
