OSC study plan
OSC · Give each week a clear focus.
8 weeks · About 7 hours per week
Information Gathering and Enumeration
Set up an isolated lab (hypervisor + 2-3 target VMs + attacker box) and verify network segmentation so scans never leave the lab
Enumerate a target host end-to-end with Nmap: host discovery, full TCP port sweep, service/version detection, and default NSE scripts, then record exact flags used
Perform DNS and subdomain enumeration against a lab domain using zone transfer attempts, brute force wordlists, and certificate transparency lookups
Enumerate web content with directory/vhost brute forcing and fingerprint the stack (server, framework, CMS) from headers and error pages
Map every open port and service found to a probable attack surface and note which service each maps to for later weeks
Your checkpoint
A host enumeration report for one lab target listing every discovered port, service, version, DNS name, and web path, with the command line that produced each finding
Vulnerability Discovery and Analysis
Run authenticated and unauthenticated vulnerability scans against the week-1 target and triage results into true positives vs false positives
Manually verify at least three scanner findings by reproducing the condition (banner, config, default credential, or version check) rather than trusting the scanner
Identify and exploit a deliberately vulnerable web application in the lab, documenting the request/response evidence
Practice reading public vulnerability disclosures and mapping a CVE to an affected version range and a safe lab reproduction step
Write a finding in a standard format: title, affected asset, evidence, severity rationale, and remediation
Your checkpoint
A triaged vulnerability register with at least five findings, each with reproduction evidence and a severity justification
Exploitation and Initial Access
Exploit a network service vulnerability in the lab and obtain a shell, capturing the exact payload and listener setup
Exploit a web application flaw (file upload, command injection, or deserialization) to achieve code execution
Obtain and use captured credentials (hash or cleartext) to authenticate to a lab service, explaining the protocol behavior
Generate a reverse shell and stabilize it with a PTY, then demonstrate file transfer both directions
Document a full kill chain from recon to initial access for one target, noting what detection would have caught each step
Your checkpoint
A kill-chain writeup for one lab target: initial access vector, payload, shell stabilization, and a timeline of commands
Privilege Escalation (Linux and Windows)
Enumerate Linux privilege escalation vectors: SUID/SGID binaries, sudo rights, cron jobs, writable service files, capabilities, and kernel version
Escalate to root on a Linux lab target using at least two distinct techniques and explain why each works
Enumerate Windows escalation vectors: service permissions, unquoted paths, token privileges, scheduled tasks, and missing patches
Escalate to SYSTEM on a Windows lab target using at least two distinct techniques
Compare Linux and Windows escalation primitives and note which enumeration tool surfaces each
Your checkpoint
A privilege escalation matrix listing each technique attempted, the target OS, the enumeration command that found it, and whether it succeeded
Active Directory Attack Paths
Build a small AD lab (domain controller plus two members) and enumerate users, groups, computers, and trusts with native and third-party tooling
Execute a Kerberoasting attack, extract the ticket, and crack it offline, documenting the request and the crack result
Perform an AS-REP roasting attack against an account without pre-authentication and recover the credential
Map an attack path from a low-privilege domain user to Domain Admin using group membership, ACLs, and delegation, and draw it as a graph
Demonstrate one credential-reuse or ACL-abuse step that advances the mapped path
Your checkpoint
An AD attack-path diagram from a standard user to Domain Admin with the specific technique, tool, and evidence labeled on each edge
Active Directory Attack Paths & Post-Exploitation, Pivoting, and Lateral Movement
Escalate from a compromised member server to domain compromise using the path mapped in week 5, capturing credentials along the way
Set up a pivot through a dual-homed host and reach a previously unreachable network segment
Perform lateral movement between hosts using at least two methods (remote service, remote execution, or credential-based session) and record the artifacts each leaves
Collect and organize credentials and hashes from compromised hosts into a working inventory
Identify which logs and events on the target would record each lateral movement action
Your checkpoint
A pivot-and-lateral-movement log showing the network path taken, each host compromised, the technique used per hop, and the log artifact each hop would generate
Post-Exploitation, Pivoting, and Lateral Movement & Reporting and Documentation
Perform post-exploitation collection on one host: local enumeration, sensitive file discovery, and persistence assessment, staying within lab scope
Clean up artifacts and demonstrate a defensible exit from the lab environment
Draft an executive summary of the engagement in plain language covering risk, business impact, and top remediation priorities
Write technical findings for the three highest-severity issues with reproduction steps, evidence, and specific remediation guidance
Review the draft against a peer or checklist for accuracy, missing evidence, and unclear remediation
Your checkpoint
A complete draft penetration test report with executive summary, methodology, at least six technical findings, and remediation recommendations
Reporting and Documentation & Information Gathering and Enumeration & Vulnerability Discovery and Analysis & Exploitation and Initial Access & Privilege Escalation (Linux and Windows) & Active Directory Attack Paths & Post-Exploitation, Pivoting, and Lateral Movement
Finalize the report: fix evidence gaps, tighten severity ratings, and confirm every finding is reproducible from the written steps
Re-run two weak areas identified in earlier weeks under a time limit to confirm improvement
Complete a full timed lab walkthrough from recon to domain compromise without notes, then review where you stalled
Build a one-page reference of the commands and techniques you used most, organized by phase
List the three domains where your accuracy is lowest and schedule targeted practice for each
Your checkpoint
A final report plus a personal weak-area remediation plan naming three domains, the specific gap in each, and the practice task to close it
Milestones
Week 2: You can enumerate a fresh lab host and produce a triaged vulnerability list without a scanner, explaining how you confirmed each finding
Week 4: You have escalated to root on Linux and SYSTEM on Windows at least twice each, and can explain the underlying misconfiguration for every technique used
Week 6: You have gone from a standard domain user to Domain Admin in the lab and crossed a network boundary through a pivot to reach a segmented host
Week 8: You have a complete, reproducible report and can complete a timed end-to-end lab walkthrough covering all seven domains