r/oscp

Hey everyone, wanted to make a thank you post for this OSCP subreddit, I had a lot of doubts before my exam and naturally as do some of you. So I wanted to make a post of things I wish I knew before I started.

How to prepare ?

1. I started with HTB CPTS path, I covered these following modules as they were the most relevant. Nmap, Footprinting, Password Attacks, File transfer, Shells & Payloads, Attacking Common Applications (Only tomcat,joomla, wordpress, drupal, jenkins), Attacking Common Services, SQLi, Command Injection, File inclusion, Ffuf, File upload attacks, Linux priv esc, windows priv esc, AD attack and enum. I highly recommend HTB over offsec course materials.
2. If you feel your priv esc content is abit shaky, I reccomend ti3brius udemy course.
3. If your AD content is abit shaky, feel free to watch hackerblueprint on youtube, his content is very good.

How to study ?

1. Study within your means, i.e if you can study 3 hours a day, then do so, dont try and cramp some crazy "How i got 100 points in 3 months" ahh routine
2. I did CPTS path then I did boxes before leaving challenge labs ABC to the last

Best part, which boxes do i do ?

As someone who did (almost) everything, heres what I reccomend

1. Proving grounds -> you MUST do them, theyre made by offsec, so theyre the most similar to what youll see in the exams, though AD is abit older, the priv esc portions are still applicable. I did both Lains and TJNull list. Feel free to use hints and walkthrough. I did like maybe 60% (?) with hints/walkthrough.

My exam boxes difficulty was around medium,

AD -> Medium
Standalone #1 foothold medium, priv esc medium
Standalone #2 foothold easy, priv esc hard
Standalone #3 foothold medium, priv esc easy

1. Hackerblueprint -> the GOAT i dare say for AD (Im not sponsored) i bought AD labs from 1-9 and did all of them. They are in my opinion well made, and really reinforced my methodology for AD. I love this place, do check it out. He also give free access to the labs when they first come out so keep your eyes peeled on his discord/reddit/twitter (I was always slow so I did not get any lol). He also replies your DMs to help, what a chad.
2. Hacksmarter -> Pretty well made, shoutout to them for making the subscription so cheap though love yall. Community is also very friendly and the king tyler will reply whenever he can <3. However their AD machines only have the DC meaning you wont get to experience much pivoting but they make up for it by making you practice lateral movement. CORRECTION: a user pointed out there are some machines that have 2-3 machines, but ive not tried those.
3. Virtual Hacking labs -> It is alright I guess, its not THE best but not THE worst either. You could honestly live without it. Mainly used it for standalone practice. Its pretty pricey too, so thats a downside.
4. HTB -> I did like maybe 5 machines or so ? Pretty hard hahahaha more CTF-ish in my opinion. Could just watch ippsec and take notes. S1ren for OSCP walkthrough is also very good, she explains stuff pretty well and intuitive.
5. Challenge labs -> I did 1 a day to test if I was ready, if I passed them, I knew I was ready. No stress if you cant do them though, I struggled on OSCP A. But if youre interested, I passed all of them without hints or walkthrough.

Exam Tips

1. Follow the methodology you built
2. Keep it simple, I read somewhere here that the path to a foothold/priv esc is always 3-5 commands away, and its pretty true, less AD
3. Use sysreptor for making your exam report
4. Take frequent breaks, I was stuck for a good 10 hours and then I showered, contemplated life, then suddenly hit my flow state and reached 90 points.

Methodology I used

Well this can be very long and detailed

AD -> use nxc to find shares, winrm, rdp rights. Get a foothold and set up ligolo. Run bloodhound, check for any outgoing rights, kerberoast, asrep roast, look for sus files that may contain credentials. If nothing, try windows priv esc, if nothing look at other services, maybe a FTP, MSSQL, MySQL or something and see if theres any low hanging fruits. Rinse and repeat till youre DC.

Standalone -> Foothold is usually easy to find, enumerate the services very hard. Once in throw everything including the kitchen sink, winpeas, linpeas, pspy, PrivescCheck

Tools in my GOAT list

1. Ligolo-ng for pivoting and port forwarding, super good
2. nxc >>> crackmapexec. The wiki is super good, I reckon you could do 90% of boxes if you use nxc well.
3. PrivescCheck -> More concise than winpeas, no choice then run winpeas and slowly look for clues
4. bloodhound -> so useful for AD, cant do anything without it

Do feel free to DM me or drop a qn here if possible so everyone can see the answer to it. (And no dont ask me for the exam qns, ill ask for your OSID and report you to offsec)

Hello everyone,
I scheduled my OSCP exam for next week. I’ve been studying for months, and I wanted to share my background before asking a few questions.
So far, I’ve completed:

+ eJPT
+ PNPT
+ CNPEN
+ 93 boxes on Proving Grounds Practice
+ 50 boxes on Proving Grounds Play
+ All of the OSCP A/B/C labs
+ Around 85% of TJ Null’s OSCP-like machine list
+ Around 85% of the CPTS path

For this last week, I’m still solving a few boxes, reviewing my notes, and mostly focusing on the reporting part of the exam.
I’m hoping to pass on my first attempt. Even if I don’t, I’ll definitely give it my best shot.
I have a couple of questions for those who have already passed the exam:

+ How close is the real exam to the OSCP A/B/C labs?

+ Are we given the target IP addresses during the exam like in the labs?, or are we given a subnet and
expected to scan the network to identify the targets?

+ What would be your biggest piece of advice for the final week before the exam?

Any advice or tips from people who have already passed would be greatly appreciated. Thanks in advance!

Hey everyone!

I’m currently preparing for the OSCP and I’m curious to hear from people who have already taken it.
Beyond the usual advice like enumeration, taking good notes, and managing time, what are some things you wish you had paid more attention to before/during the exam?
In particular:

Any topics or techniques that are easy to overlook?

Common mistakes that can cost a lot of time?

Anything about the exam methodology that surprised you?

Any specific areas that you think deserve extra attention?

Tips for approaching the AD portion?

Anything you wish someone had told you before your first attempt?

Thanks 🤓

I built Violin for Hermes can you use it during OSCP? It's the way the world's going, isn't it a little behind.

I'm currently putting a lot of effort into pursuing the OSCP. I plan to do an internship afterward. How quickly did you receive a job offer after passing the exam?

Hi everyone, I recently failed my exam with zero points. And I think I have exhausted all the enumeration methods.

Background: I have completed the PWK and challenge labs0-2, OSCP A,B,C. Only completed 2-3 proving grounds machine.

My failed attempt:

For AD. I stuck at the 1st box after getting initial access. Hunted all creds the course taught me, used winpeas. Bloodhound didn’t showing anything valuable.. I couldn’t find an obviously privilege escalation vector….

For standalone machines.

1st box, I think I got quite a lot creds after enumeration. Logged in with found creds, but could not find any else vectors. I googled everything showing in nmap, but no luck…

2nd box, and 3rd box. I couldn’t get enough useful information except the version, framework. But no public exploit…. The 3rd box doesn’t have many open ports. I tried brutforce for creds. No luck.

Can someone please tell me how should I improve?

• What boxes and machines I can practice to prepare for my next exam?
• What many proving grounds machine I need to finish. Are they of practical value to pass OSCP?
• Can I get some direction and genuine useful tips/resources?

I’ve seen people saying that everything is taught in this course. But I’m sure I have though notes, and completed everything single capstone lab in the course. I still have no idea when I encountered these boxes in exam…:(

I’m planning to take the exam in a month or two.

I’ve done the Proving Grounds machines from TJ Null’s list ( around 40-50 machines covers windows, linux, active directory )

I made a checklist for what to do when I find common services such as Web Services, SMB, LDAP, SNMP, SSH, FTP, and others where the case is without credentials, with only a username, and with valid credentials.

I also made pivoting notes covering things like opening target's local only ports with Chisel, making an internal subnet accessible with Ligolo-ng, and getting a reverse shell from an internal machine that isn’t directly accessible.

I made a checklist for Linux enumeration and privilege escalation, which, in my opinion, is relatively easy and straightforward.

I also made a checklist for Windows enumeration. I’m fairly confident with it, but not as confident as I am with Linux.

I also made a checklist for Active Directory

Tell me something that will humble me.

Is this a good sign ? or am I just overestimating how prepared I am?

If you could reply with the year you passed and how it impacted your career.

My manager gave me the greenlight for OSCP training, but I think its a waste of 400hrs of studying. Is the juice worth the squeeze?

My background, I have close 3 YoE/ BS/MS in Cyber make a little over 100K, BUT want to make the jump to 140K+ and Im not sure if OSCP is apart of that picture. I think DevOps is the path forward to 140K+, but the OSCP has been put in front of me.

I passed oscp back in 2016 and was trying oscp+ to get CRT and failed miserably. I really hate how much time you have to spend on stupid enumeration where you practically learn nothing out of it. Like I wasted 10 hours to find out the exploitation required a different tool and I was doubting my enumeration skills. What really I learned from this? Nothing!!

I was so confident I would easily get all 3 standalone and a shell on AD to pass but oh boy I was wrong. I got full AD, 1 standalone. Had write on 2nd standalone, read on 3rd but couldn’t convert it into shell.

I have heard the 1st attempt is always difficult so fingers crossed for the 2nd one now 🤞

Hi all. I am taking CRTP Sept 26, lab expired long ago, can't afford another lab rn. I'm thinking of setting up on GOAD + my own notes.

1. Did GOAD translate well to the exam? Any gaps to watch?

2. Best free/ economical AD labs besides GOAD (HTB/THM)?

Also keen to find a study buddy prepping around the same time.

Looking for opinions on which cert training to take on next. My employer will be paying for my training. I have ~3 years of exp, have basic certs like SC300, CySA+, ISACA CRISC.

I work as a Security Engineer, pentesting is not something I might pursue full time, however, I want the OSCP for resume filter along with developing the “attacker mindset”. (I know there are other ways to do this like HTB, but I’d rather do the OSCP)

For CISSP since I have 3 YOE, I still need a year for it to be valid. Does it make sense getting it out of the way earlier?

For OSAI, I would treat it as a structured research path, mainly to build a better understanding. Also it would be something new and interesting since the other certs/trainings overlap with things I’ve learned in the past.

What would y’all think makes the most sense