OSC case studies
OSC · Put your knowledge to work in context.
The OSCP (OffSec Certified Professional) is a hands-on penetration testing certification earned by passing the PEN-200 exam. Unlike multiple-choice credentials, it asks you to actually break into live machines over VPN and then write a professional report. It suits security practitioners moving into offensive roles, sysadmins and developers pivoting toward red team work, and anyone who wants demonstrable proof they can enumerate, exploit, escalate, and document real targets rather than recite theory. The exam spans the full engagement lifecycle: information gathering, vulnerability discovery, exploitation and initial access, Linux and Windows privilege escalation, Active Directory attack paths, post-exploitation and pivoting, and reporting. The OSC case studies are 5 cases and about 3,122 words.
1Certificate Transparency Noise at a Four-Brand Retailer
Your external-only engagement is with a retailer operating four brands, 1,200 staff, and 11 apex domains. The signed scope says all brand domains are in scope but explicitly excludes any third-party SaaS.
649 words, about 3 min2The Image Upload That Must Not Break Production
You have low-privilege credentials to a .NET procurement portal used by 2,000 suppliers. The client allows exploitation during a four-hour window but forbids denial-of-service and any change to production data.
639 words, about 3 min3The Health Check That Runs as Root
On an Ubuntu 22.04 web server you have a www-data shell from a vulnerable plugin. Kernel is 5.15.0-91-generic; the host is a production node in a three-node pool behind a load balancer.
602 words, about 3 min4One Night to Domain Admin in a Two-Domain Forest
You have plaintext credentials for a helpdesk account, hdesk 07, in the child domain corp.local of a forest whose root is holding.local. The forest has 8 domain controllers, 4,200 users, and a 3-tier admin model.
632 words, about 3 min5PCI VLAN Proof Without Touching Data
You land on a DMZ web server (dmz-web01) as a low-privilege service account, app svc, after exploiting a deserialization flaw. The host is dual-homed: 172.16.5.10/24 (DMZ) and 10.20.30.15/24 (internal).
600 words, about 3 min