OSCE3 study plan
OSCE3 · Give each week a clear focus.
8 weeks · About 7 hours per week
Web Application Testing & Active Directory Exploitation
Map the OWASP Top 10 and WSTG categories to concrete test actions you can execute from memory without notes
Set up a local lab with two intentionally vulnerable web apps and one Windows domain controller plus one member server
Enumerate and exploit at least five distinct web vulnerability classes (injection, broken access control, SSRF, deserialization, file upload) and document each request and payload
Build a reusable web testing checklist template covering recon, authentication, session, authorization, input handling, and business logic
Your checkpoint
A personal web-testing checklist plus a lab report with five exploited vulnerability classes, each with a raw HTTP request, payload, and one-line root cause
Web Application Testing & Active Directory Exploitation
Exploit authentication and session flaws: JWT confusion and none-algorithm, OAuth redirect abuse, and session fixation in the lab
Chain an information disclosure into an access-control bypass and then into remote code execution on one lab target
Write a short Python or Burp extension helper that automates one repetitive enumeration step
Practice writing findings in a client-ready format with impact, evidence, and remediation for three vulnerabilities
Your checkpoint
One documented exploit chain (three or more linked findings) with a client-style write-up of no more than two pages
Active Directory Exploitation
Enumerate Active Directory from an unauthenticated position: LDAP, SMB, Kerberos, and DNS, using both Windows and Linux tooling
Execute and explain Kerberoasting, AS-REP roasting, and password spraying while staying under lockout thresholds
Perform ACL-based attacks: GenericAll, WriteDACL, ForceChangePassword, and targeted Kerberoasting on a controlled object
Configure and validate detection-relevant logging (4624, 4625, 4768, 4769, 4662) so you can see your own attacks in the logs
Your checkpoint
An AD attack matrix listing at least eight techniques, with the exact command, the prerequisite permission, and the event ID each generates
Active Directory Exploitation
Execute a full domain compromise path from a low-privileged user to Domain Admin using at least three distinct techniques in sequence
Abuse AD CS: enumerate certificate templates, identify ESC1 and ESC8 misconfigurations, and request a certificate as a privileged user
Perform credential extraction from a compromised host and use the results for lateral movement with at least two protocols
Establish and document persistence in a way that survives a reboot, and then remove it cleanly
Your checkpoint
A timed lab run from initial low-privileged credentials to Domain Admin, with a timestamped command log and total elapsed time recorded
Evasion Techniques and Breaching Defenses
Evade at least three endpoint detection layers (AMSI, script-block logging, and Defender real-time) using documented, non-destructive techniques in your own lab
Build and test an application allowlist bypass using a signed binary proxy execution path
Obfuscate a payload and measure which AV engines still flag it, recording the detection delta before and after
Set up centralized logging with Sysmon and a SIEM so you can review your own activity and identify what stood out
Your checkpoint
An evasion test log with at least six techniques, each with detection result before and after, and a note on which log source caught it
Evasion Techniques and Breaching Defenses
Plan and execute a full intrusion chain (initial access, execution, privilege escalation, lateral movement, objective) against your lab while recording every artifact
Practice operational security: tool staging, timestamp awareness, log review, and cleanup of the artifacts you created
Compare at least three command-and-control channels and document the network signature each leaves
Write a detection engineering note mapping three of your techniques to concrete detection logic
Your checkpoint
A red-team operations report for one full lab intrusion, including an artifact inventory and three Sigma-style detection rules you wrote
Binary Exploitation and Reverse Engineering
Identify and exploit stack-based buffer overflows on both Linux and Windows targets, including offset discovery and control of the instruction pointer
Bypass ASLR and NX using at least one leak-based technique and one ROP chain you build yourself
Reverse a stripped binary with a disassembler and decompiler and recover its validation logic
Debug a crashing exploit with a debugger to determine the exact crash cause and correct the payload
Your checkpoint
Two working exploit scripts (one Linux, one Windows) with a written explanation of offset, bad characters, and control-flow hijack for each
Web Application Testing & Active Directory Exploitation & Evasion Techniques and Breaching Defenses & Binary Exploitation and Reverse Engineering
Complete two full-length practice assessments under exam conditions with a hard time limit and no notes
Review every missed objective and close each gap with a targeted lab exercise before moving on
Refine your personal methodology notes into one-page quick-reference sheets per domain
Rehearse reporting under time pressure: produce a complete findings report within 90 minutes of finishing a practice run
Your checkpoint
Two scored practice runs with a gap-closure log showing every missed objective retested and passed
Milestones
Week 2: You can complete a blind web assessment of a lab target and produce a client-ready report without referencing notes
Week 4: You can go from a low-privileged domain user to Domain Admin in under 90 minutes in a lab you have not pre-mapped
Week 6: You can execute a full intrusion chain while identifying your own activity in the logs and cleaning up every artifact you created
Week 8: Both practice runs score at or above your target pass margin, and every previously missed objective has been retested and passed