0.3 Attack-first OSCP speedrun breakdown

Back to the index | Attack Strategy Map | Master Notes

Each numbered block is a stable reference unit for notes and exam lookup. Study the blocks through the grouped attack-path units below rather than as fifteen disconnected mini-courses. This map has no time allocations and does not require the earlier chapter/class sequence.

The Attack Strategy Map is the main content entry point. Its topic guides organize each objective into named methods with recognition clues, access/configuration prerequisites, checks, associated concepts, complete command examples and variants, worked reasoning, verification, failure diagnosis and linked next transitions. Use this breakdown for study order and block definitions.

Teach mechanisms when they help select an attack, execute it, interpret evidence or diagnose failure. Other background is optional. For each task, work through recognition clues -> prerequisites -> method -> execution -> result interpretation -> failure diagnosis -> next action.

Present popular, well-supported approaches first, then less popular but viable methods, manual checks and built-in alternatives. Explain when each is preferable and give complete usable examples. Record taught approaches in the operational procedures and cheatsheets, with necessary explanations in Master Notes. This list describes study coverage, not completed work or demonstrated competence.

0.3.1 Study phase before practical exploitation

Before selecting a method, use the discovery workflows. All 166 documented methods show where to investigate, a discovery action, synthetic evidence, the precise clue, missing conditions and enabled/ruled-out/inconclusive examples. Use Recognition Practice to test that reasoning without opening the explanations first.

Finish concept study across all 15 blocks before beginning practical exploitation. This phase includes full command examples, tool selection, attack prerequisites, worked attack chains, sample/saved-output interpretation, failure diagnosis and alternative approaches. Teach the attacks in enough detail to understand their execution while keeping hands-on attack activity for the later phase.

Use hypothetical worked examples, paper-based changed-condition exercises and recall during concept study. Continue building Master Notes, complete procedures and extensive cheatsheets. Command examples are material to study and retain; they are not assignments to execute against a target during this phase.

Defer target-based exploitation, hands-on attack drills, capstones and practical retests. Pending lab work remains recorded for later and does not block the next concept section; no live scan, flag or lab-output submission is required to progress through this document.

When coverage of all grouped units and their numbered blocks has been reviewed and the learner indicates concept study is complete, select scoped labs and validate the methods through practical execution and independent retests. Record concept coverage and practical evidence separately. A request to explain a command or attack does not itself start the practical phase.

0.3.2 Grouped study sequence

Keep the numbered blocks separate in the reference, but study them in this dependency order:

Block 14 is cross-cutting: teach its relevant failure model inside Units 2, 4 and 6 when the failure can first occur, then use Unit 7 as consolidation. Block 5 is also a recurring state transition: study its credential mechanics once, then reapply them whenever another block produces authentication material.

Finishing one numbered block does not mean forgetting its loop. New hostnames, routes or listeners return to Blocks 1-2; a new credential returns to Block 5 and authenticated enumeration; execution moves to Block 7; a new identity or privilege triggers re-enumeration.

0.3.3 Reference task index

1. Find attack surfaces
2. Extract opportunities from services
3. Find useful web behavior
4. Turn application weaknesses into access
5. Use discovered credentials and keys
6. Adapt public exploits
7. Obtain a reliable session
8. Escalate on Linux
9. Escalate on Windows
10. Map AD attack paths
11. Gain a more useful domain identity
12. Check which other hosts your current identity can access
13. Reach internal services
14. Resolve payload execution obstacles
15. Complete and document an unfamiliar attack

0.3.4 Find attack surfaces

Study unit: 1 of 8, first half. Continue directly into Block 2; return here whenever service enumeration discloses a new in-scope hostname, address, listener, route or source position.

Situation: I have a target IP. Where can I attack?

• Discover exposed services, including coverage missed by limited scans.
• Interpret open, closed, filtered and ambiguous results.
• Establish application identity and select relevant enumeration.
• Rank the first investigations and recognize when to rescan.

Skill to develop: turn scan output into decisions.

0.3.5 Extract opportunities from services

Study unit: 1 of 8, second half. Enter with the Block 1 service queue and leave with evidence-labelled information/access plus a route into web behavior, credentials, public exploits or a verified session.

Situation: this service is exposed. What can it give me?

• SMB/RPC: users, shares, files, domain clues and anonymous/authenticated access.
• FTP/NFS: accessible files, writable locations, permissions and credential opportunities.
• DNS/SNMP/SMTP: names, users, host details and configuration disclosures.
• SSH/RDP/WinRM: usable authentication and remote access.
• Databases: useful data, credentials, file access and execution where rights permit.

Skill to develop: follow a service finding toward information or access.

0.3.6 Find useful web behavior

Study unit: 2 of 8, first half. Carry observed requests, roles, parameters, files and response differences directly into Block 4.

Situation: there is a website. Where is the useful behavior?

• Explore normal functionality, downloads, exports, uploads and account features.
• Discover hidden content, virtual hosts, APIs, backups and exposed configuration.
• Inspect requests, parameters, cookies, authentication and roles.
• Identify technologies and components worth investigating.

Skill to develop: recognize clues through application behavior before choosing an exploit.

Operational pages: HTTP and web application mapping and web mapping cheatsheet.

0.3.7 Turn application weaknesses into access

Study unit: 2 of 8, second half. Use Block 14's relevant parsing, delivery and execution diagnostics here instead of postponing them.

Situation: this application behavior looks exploitable. How do I turn it into access?

• Traversal and file disclosure.
• Local/remote file inclusion and conditions for execution.
• Upload handling, bypasses, storage locations and execution conditions.
• Command injection, including blind cases.
• Manual SQL injection: error, UNION, boolean and time-based methods.
• Authentication/access-control weaknesses and relevant XSS paths.

Skill to develop: move from a validated primitive to credentials, privileges, files or execution.

Operational pages: web file handling, command and SQL injection, access control and XSS, and web exploitation cheatsheet.

0.3.8 Use discovered credentials and keys

Study unit: 3 of 8 and a recurring transition. Re-enter this block whenever service enumeration, web access, local escalation or AD work produces new authentication material.

Situation: I found credentials or a key. What can I do with them?

• Identify the account and its local/domain context.
• Distinguish passwords, keys, stored hashes, captured responses and tickets.
• Crack supported material and build targeted password candidates.
• Test relevant reuse and interpret authentication failures.
• Re-enumerate accessible services and files after success.

Skill to develop: distinguish a valid credential from useful access.

Operational pages: credential classification, cracking and reuse and credentials/cracking cheatsheet. Re-enter this procedure after every new credential artifact.

0.3.9 Adapt public exploits

Study unit: 4 of 8, first half. Treat execution proof, callback assumptions and payload compatibility as the handoff into Block 7.

Situation: there is a public exploit. Can I make it work?

• Check the exact software, configuration, architecture, authentication and other prerequisites.
• Read the relevant code and identify its assumptions.
• Adjust parameters, paths, requests, payloads and callbacks.
• Resolve dependencies and compile existing exploits.
• Troubleshoot and verify the actual result.

Scope: retain practical use and adaptation of existing memory-corruption PoCs. Skip dedicated overflow development, stack/register/offset drills and shellcode development. Explain the mechanics necessary for the existing exploit alongside its use.

Skill to develop: select and adapt a suitable public exploit and explain why it should work.

Operational pages: public exploit selection and adaptation and public exploit quick sheet. Leave this block only after the exploit's effect is independently verified.

0.3.10 Obtain a reliable session

Study unit: 4 of 8, second half. Apply Block 14 diagnostics for payload, listener, connectivity and session failures while they are relevant.

Situation: I can execute commands. How do I get a reliable session?

• Choose direct execution, reverse/bind shells or authenticated remote access.
• Handle shell syntax, quoting, encoding, architecture and payload compatibility.
• Establish listeners and diagnose missing callbacks.
• Improve limited shells and transfer files.
• Verify the host, identity, privilege and network position.

Skill to develop: separate execution failure, connection failure and session instability.

Operational pages: shells, payloads and session repair and shell/payload quick sheet. Apply the callback ladder before replacing a payload blindly.

0.3.11 Escalate on Linux

Study unit: 5 of 8, Linux track. Share the permissions/execution reasoning model with Block 9 but keep the operating-system mechanisms separate.

Situation: I have a Linux shell. How do I become root?

• Credentials in files, histories, configuration and processes.
• Sudo, SUID/SGID and capabilities.
• Scheduled jobs, services, writable scripts, binaries and directories.
• PATH/environment dependencies and relevant mounts.
• Software/kernel exploit selection when supported by evidence.
• Manual validation of automated-enumerator findings.

Skill to develop: trace your control into privileged execution.

Operational pages: Linux privilege escalation and Linux quick sheet. Leave this block only when every candidate can be expressed as controlled object → effective permission → privileged consumer → execution identity → trigger → verified effect.

0.3.12 Escalate on Windows

Study unit: 5 of 8, Windows track. Study after Linux using the same control -> consumer -> identity -> trigger model without merging their techniques.

Situation: I have a Windows shell. How do I become administrator or SYSTEM?

• Account context, groups, tokens, privileges and effective permissions.
• Stored credentials and useful configuration artifacts.
• Service permissions, writable binaries, unquoted paths and DLL loading.
• Scheduled tasks and other privileged consumers.
• Relevant token and software exploitation.
• Trigger conditions and final privilege verification.

Skill to develop: establish both control over an object and a viable privileged trigger.

0.3.13 Map AD attack paths

Study unit: 6 of 8. Study after Block 13's route/proxy fundamentals, then continue through Blocks 11 and 12 as one identity-and-movement chain.

Situation: I have domain credentials. Where can this identity take me?

• Identify the domain, DCs, computers, accounts and groups.
• Enumerate shares, service accounts, permissions, sessions and host access.
• Collect and interpret BloodHound relationships.
• Validate promising edges and rank possible paths.

Skill to develop: connect identity -> rights -> access -> new opportunities.

0.3.14 Gain a more useful domain identity

Study unit: 6 of 8. Enter with a mapped relationship and leave by re-enumerating what the new identity can read, control or reach.

Situation: how do I gain a more useful domain identity?

• AS-REP roasting and Kerberoasting.
• Credential access where current host privileges permit it.
• Account, group and directory-object permission abuse.
• Useful password, hash and ticket transitions.
• Ticket-abuse and DCSync prerequisites.
• Re-enumeration after every identity change.

Skill to develop: explain why each transition works and what it unlocks.

Operational pages: credential access, Kerberos and identity transitions, object control and domain compromise, and the AD cheatsheet. The active core follows the current BOK: password/roast paths, cached credentials, service-ticket forging and DCSync, plus the directory rights that directly enable those transitions. AD CS, delegation/RBCD and broad GPO abuse remain conditional supplements rather than core Block 11 requirements.

0.3.15 Check which other hosts your current identity can access Move to another host

Study unit: 6 of 8. Match password, hash or ticket to a reachable service and its authorization requirements; use the relevant Block 14 failure model immediately.

Situation: I have useful credentials. How do I move to another host?

• SMB/service-based execution, WMI, WinRM and RDP.
• Password, hash and ticket authentication.
• Pass-the-Hash, Pass-the-Ticket and Overpass-the-Hash.
• Authentication versus remote-access authorization.
• Host-specific permissions, service availability and failure diagnosis.

Skill to develop: choose a movement method that matches the credential and destination.

Operational pages: lateral movement, Kerberos and identity transitions, pivoting/tunneling, and the AD cheatsheet. Block 12 owns authentication-material-to-service execution; Block 13 owns the route that makes the service reachable.

0.3.16 Reach internal services

Study unit: 6 of 8, studied before Blocks 10-12. Routing is not inherently an AD technique, so retain this as a separate reference block even though it precedes the domain chain during study.

Situation: the next service is behind another machine. How do I reach it?

• Discover internal interfaces, routes and services.
• Local/remote forwarding, dynamic forwarding and SOCKS.
• SSH tunnels and suitable alternative tunneling tools.
• DNS, proxy compatibility and callback routing.
• Diagnose each connection in the path.

Skill to develop: draw and build the complete route your tools require.

Operational pages: tunneling and port forwarding, pivoting cheatsheet, discovery through a SOCKS route, and lateral movement. Block 13 owns transport and reachability; Blocks 1, 2, 10 and 12 consume the new vantage point.

0.3.17 Resolve payload execution obstacles

Study unit: cross-cutting during Units 2, 4 and 6; Unit 7 consolidates what remains. Do not wait until this point to diagnose a failure encountered earlier.

Situation: the payload will not run. What needs changing?

• Relevant client-side delivery and required user interaction.
• Payload format, architecture, execution environment and dependencies.
• Security-control interference and justified adaptations.
• Metasploit modules, payloads, handlers and sessions.
• Tool-feature restrictions affecting practical choices.

Skill to develop: isolate delivery, execution and connectivity problems.

Operational pages: payload execution obstacles, payload-execution cheatsheet, shells and session repair, and pivoting. Block 14 owns the first-failed-boundary diagnosis; Blocks 4, 6, 7 and 13 own the original execution primitive, exploit, shell and route.

0.3.18 Complete and document an unfamiliar attack

Study unit: 8 of 8. This is integration and independent selection, not another catalogue of attack techniques.

Situation: how do I finish an unfamiliar target without losing the thread?

• Maintain a compact map of hosts, identities, credentials, routes and hypotheses.
• Prioritize tests and recover from dead ends.
• Capture access/privilege transitions and reproducible steps.
• Produce a report from retained evidence.
• Revisit assisted steps and test recognition on different targets.

Skill to develop: integrate the techniques into an independent attack.

Operational pages: integrated attack tracking and evidence, integrated attack/reporting cheatsheet, the cross-stage task index and each owning stage procedure selected by the state-change router. Block 15 owns orchestration, evidence and recovery; it does not duplicate the attack mechanics in Blocks 1–14.

0.3.19 Tooling map

This table identifies tooling to cover. Exact commands, prerequisites, decisive output, failure examples and version checks accompany the individual teaching sections; it is not an installation list or a claim that these tools have been tested in the learner's environment.

Research the tools needed for the particular section, establish a popular baseline and cover viable alternatives with their selection criteria. Check official tool documentation for syntax and current OffSec guidance before labelling a feature exam-permitted.

0.3.20 Teaching and reference outputs

Every taught section should produce:

• A hypothetical worked attack with prerequisites, commands, illustrative output and decisions explained.
• A paper-based changed-condition exercise that tests reasoning; hands-on validation follows after concept study is complete.
• Popular approaches first, followed by less popular but viable alternatives and failure-driven fallbacks.
• Master Notes explaining the necessary mechanisms.
• Complete operational procedures and extensive indexed cheatsheets for the approaches taught, usable with this chat closed.

Preserve target-specific commands, actual credentials, flags, transcripts and assistance records in private lab records. Keep reusable public material generic and do not claim mastery or successful execution from a demonstration alone.

0.3.21 Sources

• Hexdump OSCP modules: consult relevant sections as recurring supplements; exclude dedicated overflow development.
• Official Nmap reference: tool syntax and scan interpretation.
• OffSec OSCP+ Body of Knowledge: published competency scope.
• OffSec OSCP+ exam guide: current format, restrictions and evidence requirements.

This is a tutor-organized study map, not an official exam blueprint or a prediction of particular targets.