OffSec Proving Grounds for Beginners: Play vs Practice 2026

What Is OffSec Proving Grounds?

OffSec Proving Grounds (often shortened to PG) is a hosted lab platform from OffSec, the company that runs the OSCP certification. Each lab is a single vulnerable machine that you start privately, attack from a Kali Linux box, and "own" by submitting a user-level flag and a root-level flag.

OffSec opened the platform to individuals in September 2020. Help Net Security's launch coverage describes the two tiers that still exist today: PG Play with "up to three hours of daily private access to VulnHub community-generated Linux machines," and PG Practice as a $19 monthly subscription with unlimited access to OffSec-created Linux and Windows machines, including some previously used in OSCP exams. Six years later, the price has not moved.

Three things make it different from most beginner platforms:

• Dedicated machines. The Proving Grounds product page says you start one lab at a time and no other user can touch your environment. Nobody resets the box while you are halfway through an exploit, which happens a lot on shared machines elsewhere.
• An in-browser Kali. You can attack from a Kali Linux instance that runs in your browser, so a Chromebook or a locked-down work laptop is enough to play. OffSec's help center also documents a VPN option if you prefer your own Kali.
• Exam DNA. Practice includes retired OSCP+ exam labs, built by the same people who write the exam. That is the main reason people pay for it.

The flag names give that DNA away too. OffSec's exam documentation calls them local.txt (the user flag) and proof.txt (the root or SYSTEM flag), and Proving Grounds machines follow the same convention. Getting used to hunting for those two files is quiet OSCP practice.

PG Play vs PG Practice: What You Get for Free

PG Play is free with registration. PG Practice is a subscription. Here is what OffSec's product page listed for each tier when we checked in November 2026:

The yearly plan works out to about $16.58 a month, a $29 saving over twelve monthly payments. OffSec notes that the subscription auto-renews unless you cancel it, so set a reminder if you only want a month or two.

One detail that trips people up: PG Practice is bundled with some OffSec plans and not others. On OffSec's pricing page, the Learn One subscription ($2,749 a year) includes Proving Grounds Practice. The one-off Course + Cert Bundle ($1,749) and CyberCore ($899) do not. If you are already paying for Learn One, do not buy Practice twice.

Our take on the free tier: three hours a day sounds tight, and for a beginner it is. A first box often takes longer than that. But the limit is daily, not per machine, so you can pick up the same target tomorrow with your notes. Treat it as a training rhythm rather than a wall.

Is Proving Grounds Good for Beginners?

Yes, as long as it is not your very first platform. OffSec's own FAQ says Play "is ideal for those starting in penetration testing." That is true in the sense that the easiest Play machines are genuinely approachable. It is less true in the sense that nothing on the platform teaches you how to approach them.

There are no lessons, no guided questions and no "task 3 of 7" breadcrumbs. You get an IP address and a blank terminal. That is great practice for an exam and harsh on day one. Before your first PG Play box, make sure you can do these without looking them up:

• Scan a host with Nmap and read which services and versions are running
• Enumerate a website: browse it, read the source, and brute-force directories with Gobuster or ffuf
• Search for a public exploit with searchsploit and adapt it to your target
• Catch a reverse shell with Netcat and upgrade it to a usable TTY
• Check a Linux box for SUID binaries, sudo rights and cron jobs

If two or more of those are new, you will burn your daily three hours learning tools instead of hacking. Spend a week on a guided platform first. In practice, the learners who enjoy Proving Grounds most are the ones who already rooted a handful of guided boxes and want to find out whether they can do it without hints.

How to Get Started on PG Play

Setup takes about ten minutes. Most of that is waiting for the Kali instance to boot.

1. Create a free OffSec account. PG Play needs a registration but no payment details.
2. Open the lab list. OffSec's help center puts it under Explore > Labs > Proving Grounds, then Play.
3. Pick your attack box. Choose the in-browser Kali if you have no Kali VM. Choose the VPN if you already have a tuned Kali with your own wordlists and notes. The browser option is simpler, the VPN option is faster to work in.
4. Start one machine. You can only run one at a time. The machine card shows its IP address once it is up.
5. Find and submit two flags. Submit the contents of local.txt and proof.txt on the machine page. That is the only proof the platform accepts.

Before you start the clock, read OffSec's "Rules of the Game" help article. It is short and covers what is in and out of scope, including that the lab infrastructure itself is not a target.

Your First Machine: A Realistic Three-Hour Session

Here is how a good first session is structured. The machine and IP are illustrative, but the steps are the same on almost every Linux box in Play.

Minutes 0-20: scan everything

Start with a full TCP port scan, then run version detection and default scripts only on what came back open. Scanning all 65,535 ports matters on Proving Grounds, where a service on a high, odd port is a common trick.

nmap -p- --min-rate 2000 -oN all-ports.txt 192.168.120.15
nmap -sC -sV -p 22,80,8080 -oN services.txt 192.168.120.15

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
8080/tcp open  http    Jetty

Save every scan to a file with -oN. When your three hours run out, tomorrow's session starts from that file instead of from scratch.

Minutes 20-90: enumerate before you exploit

Visit every web port in a browser. Read the page source, check robots.txt, and run a directory brute-force against each one. Write down every software name and version number you find, then search for them:

gobuster dir -u http://192.168.120.15 -w /usr/share/wordlists/dirb/common.txt
searchsploit jetty

The beginner mistake here is jumping on the first exploit that matches. When testing real machines, the right path is usually the boring one: default credentials on an admin panel, a backup file in a web directory, or a version with a well-known bug. If an exploit needs ten tweaks to work, it is probably the wrong one.

Minutes 90-150: foothold and local.txt

Once you have code execution, get a reverse shell, stabilize it, and grab local.txt. It usually sits in a user's home directory or the web server's directory. Submit it straight away so a crash does not cost you the points.

Minutes 150-180: privilege escalation and proof.txt

Check sudo -l, SUID binaries, cron jobs and writable files, then run LinPEAS if nothing jumps out. The root flag, proof.txt, lives in /root. If you need a structured checklist for this phase, HackerDNA's Linux privilege escalation course walks through each technique with a lab.

Did not finish? That is normal. Stop five minutes before the limit, write down where you are, and come back tomorrow.

Hints, Walkthroughs and Getting Unstuck

Proving Grounds gives you more help than its reputation suggests, but it comes at a price. OffSec's help center explains that once you open a machine's official walkthrough, you can no longer earn points on that machine, unless you had already submitted every flag. Points do not affect anything outside the platform, so this is a nudge, not a punishment.

Difficulty labels come from the community. Players rate each machine after they finish, and OffSec maps the weighted average to one of four labels: Fundamental, Intermediate, Advanced and Insane. Start with Fundamental and treat the label as a rough guide, since a "Fundamental" box can still hide a step you have never seen.

A few habits will save you more time than any hint:

• ⏱Set a 45-minute stuck timer. If you have made no progress for 45 minutes, go back to enumeration. Nine times out of ten, the missing piece is a port, a directory or a version you skipped.
• 📝Take notes as if you will write a report. Commands, output, credentials and dead ends. The OSCP exam requires a report, and the daily limit means you will need them tomorrow anyway.
• 🔑Read the walkthrough after you root. Comparing your path with the intended one is where most learning happens. Unintended paths are worth noting too.
• 🤖Use AI as a reference, not a driver. Asking what a SUID bit does is fine. Pasting your scan and following the answer step by step teaches you nothing, and AI help is restricted on OffSec exams.

When Is PG Practice Worth $19 a Month?

Upgrade when the three-hour cap or the Linux-only catalog starts to hold you back. For most people, that moment comes when they commit to the OSCP+.

Practice earns its price in three situations:

• You are preparing for the OSCP+. Retired exam labs are the closest thing to the real exam you can legally get. The style of the machines, the rabbit holes and the flag format all match.
• You need Windows practice. Play is Linux only. Windows privilege escalation and Active Directory are a large part of the OSCP+, and Practice is where Proving Grounds covers them.
• You want long sessions. Unlimited time lets you simulate a full exam day, which is useful practice for stamina and note-taking.

Many OSCP candidates also work through TJ Null's community list of exam-like machines on Hack The Box and Proving Grounds. Our OSCP preparation guide explains how to build a study plan around it. If you are not on the OSCP path, stay on Play longer. There is little point paying for retired exam labs you are not ready for.

Proving Grounds vs Hack The Box, VulnHub and HackerDNA

These four come up together whenever beginners ask where to practice on real machines. They suit different stages.

VulnHub is where most PG Play machines came from. If you have the hardware and want unlimited time on the same style of box for free, our VulnHub beginner's guide covers the VirtualBox setup. PG Play saves you the download and the network configuration, which on a slow laptop is worth the daily cap.

Hack The Box has a bigger community and more active releases, and it is the other half of TJ Null's list. We compare the wider field in our roundup of Hack The Box alternatives.

HackerDNA sits one step earlier. Courses teach each technique, and labs make you use it right away, in your browser with no VPN and no daily limit. Our honest advice: learn the method with guided labs, then go to Proving Grounds to prove you can do it alone.

Legal and Ethical Considerations

• Stay in scope. Your target is the machine's IP address. The in-browser Kali, the VPN servers and the OffSec portal are not part of the challenge, and attacking them breaks the platform rules.
• Keep flags private. Posting flag values or full step-by-step solutions for Practice machines spoils them for everyone and can break OffSec's terms. Write up your reasoning, not the answers.
• Do not reuse lab techniques on real systems. An exploit that works on a PG box works on a real server too. Using it there without written permission is illegal in most countries.
• Report real bugs. If you find a flaw in the platform itself, report it to OffSec through its official channels instead of exploiting it.

Frequently Asked Questions