Zero to OSCP

Start with easy boxes to build the method and finish with the kind of machines and Active Directory you will meet in the exam. Tick each step when you finish it: your progress is stored in this browser.

Level
From scratch (you are comfortable with Linux and the terminal)
Rough duration
10-14 weeks at about 10 h a week
By the end you will
Solve a medium Linux or Windows box on your own and compromise a small AD domain in a day.
Your progress 0 of 69 steps

Continue with the next step →

  1. Stage 1 First steps: the method 0/11

    Learn a fixed recon workflow and land your first shells with simple flaws.

    1. Checklist Recon and enumeration

      Use it on every box in the path. At first, without skipping anything.

    2. Cheat sheet Nmap and service enumeration
    3. Cheat sheet Reverse shell generator
    4. Cheat sheet Upgrade your shell to a full TTY
    5. Guide Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster

      Directories, vhosts and exposed .git: the first thing on every website.

    6. Guide SMB and NFS enumeration: shares, null sessions and files full of passwords
    7. Guide Hash cracking with hashcat and John the Ripper: modes, rules, masks and protected files
    8. Machine Nibbles easy linux

      A blog with weak credentials, a file upload and a misconfigured sudo: the whole cycle in miniature.

    9. Machine Jerry easy windows

      Tomcat with default credentials and a malicious WAR. Your first Windows box.

    10. Machine Mirai easy linux

      A device's default credentials and a bit of forensics.

    11. Machine Cap easy linux

      An IDOR, credentials in a packet capture and a capability.

  2. Stage 2 Web for the OSCP 0/14

    Find and exploit the web flaws that come up the most: uploads, injections, LFI and vulnerable CMSs.

    1. Checklist Web application pentest
    2. Cheat sheet Web enumeration
    3. Guide SQL injection: from a single quote to dumping the database
    4. Cheat sheet SQL injection payloads
    5. Guide LFI: from reading /etc/passwd to running commands
    6. Guide Malicious file upload: bypassing upload filters to get a web shell
    7. Guide OS command injection: detection, blind injection and filter bypasses
    8. Guide Exploiting a public CVE: finding, reading and fixing exploits from searchsploit and GitHub

      How to find, read and adapt exploits: half the OSCP depends on it.

    9. Machine Networked easy linux

      Bypass a PHP upload filter and a command injection in a cron job.

    10. Machine Bank easy linux

      Hidden virtual host, leaked files and an upload with an odd extension.

    11. Machine Armageddon easy linux

      Public Drupal CVE: learn to find and adapt exploits.

    12. Machine OpenAdmin easy linux

      RCE in a panel, a reused password and pivoting between users.

    13. Guide SSTI: fingerprinting the template engine and getting RCE
    14. Machine Doctor easy linux

      SSTI in a Flask app.

  3. Stage 3 Linux privilege escalation 0/11

    Go from user to root by hand-checking sudo, SUID, capabilities, cron and local services.

    1. Checklist Post-exploitation and privesc
    2. Guide Linux privilege escalation: sudo, SUID and capabilities
    3. Guide Linux privilege escalation: cron jobs, PATH hijacking, wildcards and the docker or lxd groups
    4. Cheat sheet Linux privilege escalation
    5. Cheat sheet Exploitable Linux binaries
    6. Machine Irked easy linux

      A backdoored service and a custom SUID binary.

    7. Machine Traceback easy linux

      Follow another attacker's trail and abuse a script that root runs.

    8. Machine Tabby easy linux

      LFI to read credentials and the lxd group to become root.

    9. Machine Postman easy linux

      Unauthenticated Redis to write an SSH key.

    10. Machine Writeup easy linux

      PATH hijacking from a group with write permissions.

    11. Machine Valentine easy linux

  4. Stage 4 Windows and its privesc 0/12

    Find your way around Windows: transfer files, enumerate privileges and services and escalate to SYSTEM.

    1. Cheat sheet File transfer
    2. Cheat sheet Windows and Active Directory privilege escalation
    3. Guide SeImpersonatePrivilege and Potatoes: from service account to SYSTEM on Windows

      The most repeated Windows escalation: check it as soon as you have a service shell.

    4. Guide Windows privilege escalation: services, unquoted paths, DLL hijacking and AlwaysInstallElevated
    5. Machine Devel easy windows

      FTP with write access to the IIS web root.

    6. Machine Optimum easy windows
    7. Machine Bastion easy windows

      Backups on SMB and passwords saved in an application.

    8. Machine Access easy windows
    9. Machine Remote easy windows
    10. Machine Love easy windows

      SSRF, a file upload and AlwaysInstallElevated.

    11. Machine ServMon easy windows
    12. Machine Buff easy windows

      A simple buffer overflow through a port forward.

  5. Stage 5 Active Directory (40 exam points) 0/15

    From the first user to Domain Admin with Kerberos, BloodHound, ACLs and DCSync.

    1. Checklist Active Directory
    2. Guide Active Directory enumeration: users, LDAP, BloodHound and password spraying
    3. Guide Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory
    4. Guide Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync
    5. Cheat sheet Active Directory in depth › BloodHound
    6. Guide Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI
    7. Guide Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit
    8. Cheat sheet Impacket / NetExec builder
    9. Machine Active easy windows

      GPP password in SYSVOL and Kerberoasting.

    10. Machine Forest easy windows

      ASREPRoast and an ACL chain to DCSync: the classic.

    11. Machine Sauna easy windows
    12. Machine Timelapse easy windows

      A certificate in a zip and reading LAPS.

    13. Machine Cascade medium windows
    14. Machine Resolute medium windows
    15. Machine Support easy windows

  6. Stage 6 Pivoting and mock exam 0/6

    Put it all together against the clock: pick three boxes without hints and give yourself 24 hours, report included.

    1. Guide Port forwarding and pivoting: SSH, chisel and socat
    2. Cheat sheet Port forwarding and pivoting
    3. Machine Jarvis medium linux
    4. Machine Silo medium windows
    5. Machine Querier medium windows
    6. Machine Intelligence medium windows

      AD with several moving parts: good practice for the exam's AD set.