OSCP study plan

Build a small Active Directory lab (domain controller plus two members) and enumerate it end to end using TCP/UDP scans, SMB, LDAP and Kerberos queries

Enumerate domain users, groups, computers, SPNs and delegation flags using at least five distinct techniques

Convert raw enumeration output into a written attack-path diagram linking misconfigurations to escalation steps

Record every command and its output into a reusable evidence file that follows a consistent template

Execute Kerberoasting, AS-REP roasting, password spraying and credential dumping against the lab domain

Crack every captured hash type with two wordlists and one rule set, then tabulate crack rates and time-to-crack

Move laterally with harvested credentials over at least two distinct protocols and confirm privilege level on each target

Document the artifacts each credential attack leaves behind so the technique can be defended as well as performed

Enumerate a Linux target manually (users, sudo rights, SUID/SGID binaries, cron jobs, capabilities, kernel level, writable paths) before reaching for any automation

Exploit at least three distinct Linux privilege-escalation misconfigurations across separate hosts

Write and run your own lightweight privilege-escalation check script and refine it after each new host

Capture each escalation as a reproducible step list another tester could follow blind

Enumerate Windows hosts for service permissions, unquoted service paths, weak ACLs, auto-logon secrets and missing patches

Abuse at least one token or impersonation privilege to move from a low-privileged shell to SYSTEM or administrator

Extract stored credentials from registry, memory and unattended-install files on the hosts you compromise

Compare manual enumeration against automated tooling and note where each one missed findings

Test three deliberately vulnerable web applications by hand for injection, file upload, path traversal, local and remote file inclusion, server-side request forgery and insecure deserialization

Run an unauthenticated scan and an authenticated scan of the same target and reconcile the differences in findings

Chain a web finding into a shell and then into a local privilege escalation on the same host

Write each finding with reproduction steps, impact and a concrete fix recommendation

Build two client-side delivery chains (for example a document-based payload and a shortcut or HTML-smuggling lure) and confirm a callback from a victim VM

Stand up and tear down listeners reliably, verifying that payload encoding and staged versus stageless choices match the listener

Take one publicly available proof-of-concept exploit, adapt it to your target, and explain in writing what you changed and why

Trace how a client-side compromise becomes a foothold suitable for the pivoting work in week seven

Set up local, remote and dynamic SSH port forwarding and confirm each path with a service check from the far side

Route traffic through a compromised host using a SOCKS proxy and at least one tunnelling tool, then reach a host that has no direct route from your attack machine

Configure host-level port forwarding on a Windows pivot and a Linux pivot to compare the two approaches

Draw the network from the attacker's perspective, marking every hop and the tunnel type used at each one

Complete a timed full-scope practice run against the lab, starting from a single exposed host and finishing at domain administrator

Re-test the three weakest domains from weeks one through seven and close every gap you can name

Write up every objective in report format with screenshot evidence, reproduction steps and remediation advice

Produce a personal gap list with a remediation plan for the month after the plan ends