0.0 OSCP Exploitation Reference
Open the default OSCP notes — concise service and technique pages for everyday lookup. This repository is the extended library for additional procedures, variants and explanations.
Complete operational task index — every procedure and task, searchable by service or technique.
A task-oriented extended study knowledge base and exam playbook. Use the Attack Strategy Map when you need to compare methods by prerequisites or study a technique in depth. Practical mastery remains tracked separately from publication.
0.0.1 Learning resources
Start with the default notes. Open the extended library for the larger cheatsheets, complete procedures, mechanics and worked examples. The attack-stage directories below keep one owning procedure per task.
- AD cheatsheet: the main AD command collection and evidence-driven next checks; annotated investigations provide detailed output interpretation and expected behavior.
- AD surface helpers: automatic native LDAP and current-host collectors with bounded findings summaries, private evidence and linked manual next checks; optional
-Preview. - Enumeration toolkit: established multi-check collectors by stage, recommended foundations and defaults/optional behavior to review.
- Direct collection commands: task-focused upstream invocations and inline configuration in the owning track pages; native AD/host collectors remain available where useful.
- Attack-surface maps and notes: technique-name maps link to detailed notes and exact quick-command sections. Complete track canvases are available alongside them. Map setup · Complete atlas.
- Interactive strategy workspace: expandable workflows, recognition checks, commands and evidence-driven next decisions; attack-path visualizer for explicitly recorded investigation steps.
- Attack Strategy Map: the complete documented method inventory, prerequisite-based selection and links between capability transitions.
- Discovery-to-recognition workflows: where to investigate before choosing an attack.
- Recognition practice: unanswered paper cases for testing clue discovery and prerequisite reasoning.
- Self-contained method guides: explanations, prerequisite checks, commands/variants, worked examples, verification and failure-driven alternatives.
- Master Notes: attack reasoning, necessary mechanics, recognition clues and failure interpretation.
- Speedrun breakdown: attack tasks, practical outcomes and the tooling map for accelerated study.
- getSH coverage map: source snapshot, route/topic accounting, corrections and remaining speedrun gaps.
- Cheatsheet index: compact, executable commands and decision cues for immediate lookup.
- Use the stage and quick-task indexes below for complete operational procedures.
Operational flow: discovery and scanning → service enumeration → initial access → shells/transfers/credentials → local privilege escalation → AD/lateral movement → pivoting/tunneling → evidence/reporting.
Study flow: use the grouped study sequence. Numbered blocks remain stable lookup units; related blocks are learned as complete attack paths.
Current exam boundary: command impact is not the restriction test. Manual credential access, shells, privilege escalation and lateral-movement commands can be legitimate on assigned exam systems when their prerequisites and scope are satisfied. The current official guide instead prohibits spoofing, commercial tools/services, automatic exploitation tools, mass vulnerability scanners, AI chatbots/LLMs and features that perform equivalent restricted actions; Metasploit/Meterpreter has a one-selected-target limit and Metasploit pivoting is prohibited. Nmap/NSE, Nikto, Burp Free and DirBuster are explicitly listed as permitted examples. Recheck the current OSCP+ Exam Guide before the exam—this reference may be used offline, but AI must not be used during the exam or reporting phase.
0.0.2 Stage index
| Stage | Purpose | Open |
|---|---|---|
| 01 | Establish reachability, port coverage, application clues and the next enumeration queue | Discovery and scanning |
| 02 | Extract names, files, permissions, credentials, configuration and usable access from services | Service enumeration |
| 03 | Use verified access paths to establish a remote session | Initial access |
| 04 | Make execution reliable, move files and classify/recover/test credential material | Shells, transfers and credentials |
| 05 | Trace Linux/Windows object control into higher-privileged execution | Local privilege escalation |
| 06 | Map domain relationships, gain a better identity and move through compatible services | AD and lateral movement |
| 07 | Reach internal services through explicit forwards, SOCKS or routed pivots | Pivoting and tunneling |
| 08 | Preserve reproducible transitions and report-ready evidence | Evidence and reporting |
Tools and scripts — lookup by tool name with task-specific commands and selection cues.
0.0.3 Quick task index
| Question | Open |
|---|---|
| Is my path correct, and which assigned hosts respond? | Path and host discovery |
| Which TCP ports are reachable, and did I cover all 65,535? | TCP scanning |
| What application appears to be listening? | Service identification |
| What UDP evidence exists, and what remains ambiguous? | UDP scanning |
| How do I verify a result and choose the next test? | Scan results and next actions |
| What can I test from a Windows source host? | Windows network checks |
| What is the complete first-pass attack-surface workflow? | Discovery and scanning cheatsheet |
| What can this exposed non-web service give me? | Service enumeration |
| Which commands turn a service into an opportunity? | Service opportunity cheatsheet |
| How do I map an HTTP application before choosing an attack? | HTTP and web mapping, quick sheet |
| How do I convert a web primitive into useful access or execution? | Web initial-access procedures, web exploitation quick sheet |
| How do I select, audit, compile and minimally adapt a public exploit? | Public exploit adaptation, quick sheet |
| How do I enumerate SMB shares, files and RPC identities? | Find shares, identities and rights through SMB and RPC |
| How do I enumerate DNS records or try a zone transfer? | Expand the host map through DNS records and zone transfers |
| How do I interpret SNMP, NFS or database privileges? | Find configuration and process leads through readable SNMP objects, NFS/RPC, databases |
| How do I inspect rsync modules or retrieve an evidence-backed TFTP file? | Unix file services |
| How do I connect to the assigned Windows host? | Obtain an authorized interactive desktop session |
| How do I transfer a tool such as LinPEAS or retrieve evidence? | File transfer |
| How do I inspect exposed Git history or hunt scoped files for configuration/secrets? | File and repository hunting |
| How do I isolate a Python assessment tool from system Python? | Python tool environments |
| How do I turn command execution into a stable, verified session? | Shells and payloads, quick sheet |
| Why did a document, shortcut, script, binary, callback or framework payload fail? | Payload execution obstacles, quick sheet |
| How do I identify, crack or safely validate a recovered credential? | Credential use and cracking, quick sheet |
| How do I enumerate and validate Linux privilege-escalation paths? | Linux privilege escalation, quick sheet |
| How do I enumerate and validate Windows privilege-escalation paths? | Windows privilege escalation |
| How do I map AD users, groups, hosts, shares, ACLs and BloodHound paths? | Domain mapping |
| How do I reason about LSASS/SAM/LSA/DPAPI/NTDS credential sources? | Select accessible credential material for the next identity transition |
| How do I AS-REP roast, Kerberoast or use a ticket correctly? | Kerberos and identity transitions |
| How do I validate directory ACL, AD CS, GPO or DCSync prerequisites? | Object control, AD CS and domain compromise |
| Which Windows lateral-movement method matches my credential and rights? | Check which other hosts your current identity can access |
| How do I reach an internal service through SSH, Chisel, Ligolo-ng or SOCKS? | Tunneling and port forwarding |
| What should I capture so the attack is reproducible and report-ready? | Attack tracking and evidence |
| How do I keep an unfamiliar attack moving without losing hosts, identities, routes or evidence? | Integrated attack tracking and recovery, quick sheet |
| Which tool should answer this question, and what output is decisive? | Choose tools that match your task and constraints |
0.0.3.1 Placeholder key
| Placeholder | Replace with |
|---|---|
TARGET | Destination IP |
LHOST | Kali/listener IP reachable from the target |
PORT | One listening or connection port |
PORTS | Port, comma-separated list or range; one number where stated |
FILE | Filename to transfer |
KEY | SSH private-key path |
SUBNET | Explicitly assigned CIDR range |
DC_IP | Domain controller IP |
DOMAIN | Domain name |
USER / PASSWORD / AUTH_PASSWORD / PRIV_PASSWORD / HASH | Authentication material |
0.0.4 Choose a task and follow its evidence-based next action How to use the reference
- For study, choose the objective in the strategy map and compare its method prerequisites.
- Read the selected method's checks, explanation, example, variants and next transitions.
- For scoped practice, open its linked operational procedure and establish the required access/configuration.
- Replace every placeholder and use the baseline or variant matching the observed context.
- Interpret decisive output and failure cues before claiming the intended effect.
- After a state change, follow the linked next methods and re-enumerate the new capability.
Target IPs, credentials, flags, transcripts, licensed course text and machine solutions stay in private lab records.