OSCP study guide
OSCP · Work through your exam, one topic at a time.
The OffSec Certified Professional (OSCP) is a hands-on penetration testing credential awarded by OffSec and associated with the PEN-200 course, "Penetration Testing with Kali Linux." OffSec publicly describes itself as the creator of Kali Linux and describes OSCP as "the gold standard in penetration testing certifications" - a marketing claim made by the vendor, not an independent ranking. Unlike multiple-choice certifications, the OSCP assessment is practical: candidates attack machines in a live lab environment and must submit a professional report documenting their findings, so both technical execution and written communication are evaluated. The OSCP study guide has 9 sections and about 2,538 words.
01Information Gathering and Enumeration
Reconnaissance splits into passive (WHOIS, DNS records, certificate transparency, search engines, job postings) and active (packets sent at the target). Exam labs reward breadth: run a full TCP sweep first ( nmap -p- -T4 --min-rate 1000 ), then targeted service detection ( -sC -sV -p<found ), then UDP against the usual suspects (53, 69, 111, 123, 137-139, 161, 500).
264 words, about 1 min02Vulnerability Scanning and Analysis
Vulnerability scanning automates matching a fingerprint (banner, version string, patch level, plugin output) against a database of known issues. Typical tools are Nessus or OpenVAS for infrastructure, Nikto for web sanity checks, nmap --script vuln for quick wins, and searchsploit to locate public exploit code.
291 words, about 1 min03Web Application Attacks
Web is usually the widest attack surface. Core families: injection (SQLi, command injection, LDAP/NoSQL injection), file inclusion and path traversal, file upload flaws, authentication and session problems (default credentials, IDOR, missing function-level access control, weak JWT handling), XSS (reflected, stored, DOM), SSRF, XXE, and deserialization.
289 words, about 1 min04Client-Side Attacks
Client-side attacks aim at code execution on a workstation (through user action) or at capturing credentials on the wire. Delivery routes include phishing attachments or links, watering-hole pages, and removable media.
302 words, about 2 min05Exploitation and Password Attacks
Metasploit workflow: search , use , show options , set RHOSTS / LHOST / LPORT , check where supported, then exploit . Payload naming tells you the delivery style: staged payloads use a slash ( windows/x64/meterpreter/reverse tcp ) and fetch the second stage, stageless payloads use an underscore ( windows/x64/meterpreter reverse tcp ) and are self-contained.
272 words, about 1 min06Linux Privilege Escalation
Enumeration first and always: id , sudo -l , kernel and distribution version, SUID/SGID files ( find / -perm -4000 -type f 2 /dev/null ), file capabilities ( getcap -r / 2 /dev/null ), cron entries ( /etc/crontab , /etc/cron. , crontab -l , and pspy to watch for hidden jobs), writable files and directories, mounted shares, running services, and finally linpeas.sh for a broad sweep.
286 words, about 1 min07Windows Privilege Escalation
Begin with whoami /all (privileges and group membership), systeminfo , net user , net localgroup administrators , installed software, and patch level. Then examine services and their permissions, scheduled tasks, unquoted service paths, weak folder or service ACLs, AlwaysInstallElevated , stored credentials ( cmdkey /list , runas /savecred ), registry autologon values, unattended install files, Group Policy Preferences cpassword values, and DLL search-order hijacking.
248 words, about 1 min08Port Redirection and Pivoting
A pivot host has two interfaces; your goal is to reach a subnet you cannot route to directly. SSH is the standard tool: local forwarding ( -L 8080:internal:80 ) exposes one service locally, remote forwarding ( -R ) pushes a port back out through the pivot, and dynamic forwarding ( -D 1080 ) creates a SOCKS proxy for arbitrary destinations.
308 words, about 2 min09Active Directory Attacks and Post-Exploitation
AD compromise is mostly misconfiguration. Enumerate with netexec (SMB, LDAP, WinRM), ldapsearch , PowerView, and BloodHound with SharpHound collection that includes sessions and ACLs.
278 words, about 1 min