0.5 getSH Source Coverage

Back to the index | Master Notes | Cheatsheets

This page records how the public getSH OSCP notes were incorporated into this repository. It is a coverage and provenance map, not a substitute for the task-oriented procedures.

0.5.1 Source boundary

Source repository: lizaJose/getSH
Reviewed snapshot: e1f62dd, dated 2026-10-19
Reviewed routes: Home, Scan, Common Services, Web, Password Cracking, Privilege Escalation, Active Directory, Useful Stuff and Tool Cheatsheet
Treatment: ideas and commands were reorganized into original explanations, procedures and quick-reference sheets. The application source was not copied wholesale.

The source is a community reference, not an official OffSec control and not evidence that a technique has been independently executed. Current OffSec rules, supplied PEN-200 material, official tool documentation and the Hexdump modules take precedence where claims or syntax conflict.

0.5.2 Route-to-note map

getSH route	Source topics accounted for	Canonical destination
Scan	Nmap service probes/NSE, banner checks, unknown ports, RustScan, Masscan, Nikto and saved output	Discovery and scanning, scanner alternatives, discovery cheatsheet
Common Services	SSH, FTP, SMB, HTTP, SMTP, SNMP, LDAP, RDP, MySQL, MSSQL and PostgreSQL	Service enumeration, LDAP/Kerberos, service cheatsheet
Web	Recon, technology/headers, Gobuster/Feroxbuster/ffuf/wfuzz, WordPress, authentication/sessions, SQLi, command injection, XSS, upload, traversal/LFI/RFI, wrappers/log poisoning, SSRF and API testing	HTTP mapping, web initial access, WordPress and SSRF, web sheets
Password Cracking	Feasibility/keyspace, mutation rules, John, KeePass, SSH keys, NTLM/Net-NTLMv2, pass-the-hash/relay and Credential Guard	Credential use and cracking, credential cheatsheet
Privilege Escalation	Linux and Windows enumeration, credentials, sudo/SUID/capabilities, cron/services/tasks, PATH/DLL/wildcards, containers, tokens, Backup Operators, kernel/software candidates and automated-enumerator validation	Local privilege escalation, Linux sheet, Windows sheet
Active Directory	Native/PowerView enumeration, SPNs, ACLs, shares/GPP, BloodHound, credential access, Kerberos, password attacks, AD CS, DCOM, GPO, DCSync, post-compromise checks, Linux/Windows flows and a worked multi-host chain	AD and lateral movement, AD cheatsheet
Useful Stuff	File transfer, Git/file hunting, database references, tunneling/forwarding, payload formats, Python environments and RDP	Stage 04, pivoting and their quick sheets
Tool Cheatsheet	Nmap, RustScan/Masscan, ffuf/Gobuster, Nikto, PowerView, Mimikatz, Rubeus, NetExec/CME, Impacket, BloodHound/SharpHound, Certipy, ldapsearch, SMB tools, Hydra, Responder/relay, Hashcat, John, SQLmap, WPScan, msfvenom/Netcat, Chisel/Ligolo/SSH and FreeRDP	Task-specific procedures, tool selection matrix and tool command reference
Home	Workflow ordering and route descriptions	Speedrun breakdown and the repository main index

0.5.3 Topic-level accounting

The following source blocks are deliberately consolidated rather than duplicated:

Repeated Nmap service scripts live beside the relevant service procedure; Nmap coverage and state interpretation remain in Stage 01.
Repeated file-transfer commands have one canonical home in Stage 04 and are linked from privilege-escalation and AD pages.
Repeated password/hash/ticket commands are split by state: extraction in the producing technique, classification/cracking in Stage 04, and compatible reuse in the relevant access or AD page.
Repeated web-discovery invocations live in the HTTP mapping procedure; exploit-specific syntax remains in Stage 03.
The source's three-host AD narrative was converted into a generic worked reasoning chain. Machine names, credentials and exact solutions are not retained.
Tool-card duplicates are represented in the task procedure and selection matrix instead of separate copies of every command.

0.5.4 Corrections and scope decisions

SQLmap is retained only as a recognition/research reference. The current OSCP+ exam guide prohibits automatic exploitation tools such as SQLmap; the operational exam path remains manual SQL injection.
Metasploit/Meterpreter restrictions are called out wherever relevant. msfvenom and multi/handler are treated separately because the official guide explicitly permits them across targets subject to the Meterpreter limitation.
Responder poisoning and NTLM relay are retained as lab concepts, but spoofing is prohibited on the exam. Do not translate a lab workflow into an exam action without rechecking current rules.
Dedicated buffer-overflow development is excluded by learner choice. Public memory-corruption exploit reading, prerequisite checking, compilation and parameter/payload adaptation remain in scope.
The getSH navigation contains a disabled future privilege-escalation item under the AD route. It has no content to migrate; the populated standalone privilege-escalation route is fully mapped.
The source includes commands whose flags, package names or behavior may vary by distribution and version. Procedures identify version-sensitive areas and prefer current upstream names; unverified host availability is not claimed.

0.5.5 Coverage limits

The source is broad but not complete enough to replace the speedrun map. It is comparatively light on public-exploit adaptation, shell reliability/failure isolation, evidence/report construction, detailed NFS/DNS mechanics, some lateral-movement authorization distinctions and systematic dead-end recovery. Those subjects remain explicit Blocks 6, 7, 14 and 15 and are supplemented from PEN-200, current official guidance and relevant Hexdump modules.

This import establishes studied reference coverage, not practical competence. Live-target work, capstones, cold re-solves and mastery evidence remain deferred until the concept phase is complete.