OSCP exploitation reference

Choose a topic or search a tool. Jump to commands, read the result cue, then follow the matching technique.

Start with discovery →Search all procedures & variants →

Discovery

Discovery →An explicitly assigned address or host list and a known source position

Enumeration

Services →A confirmed reachable application; anonymous context or one identified credential
Web mapping →A reachable HTTP application and recorded anonymous or authenticated request state

Initial access

Web exploitation →A reproducible application request and a controlled input or access-context comparison
Public exploits →An identified component/build and a candidate exploit with reviewable source

Usable access

Sessions & transfers →Verified command execution or authenticated remote access and a known network path
Credentials →A credential artifact with a recorded source and possible account context
Execution troubleshooting →A recorded delivery/execution chain with the expected consumer and effect

Local privilege

Linux escalation →A verified Linux foothold with a known effective UID, groups and filesystem context
Windows escalation →A verified Windows foothold with a known token, integrity level and groups

Active Directory

AD enumeration →A known domain identity or a directory endpoint that permits the selected anonymous query
AD identity attacks →A domain identity, appropriate host privilege, or a validated effective directory-object right
Lateral movement →Identified authentication material, destination service reachability and a candidate authorized identity

Internal access

Pivoting & tunnels →A pivot identity/process or reachable SSH service and a drawn source-to-destination path

Evidence & reporting

Integration & evidence →An assigned objective, scope and accumulated host/identity/route evidence

Study order, scope & hypothetical chains

Eight study units: discovery/services; web; credentials; public exploits/sessions; Linux/Windows escalation; pivoting/AD/movement; execution diagnostics; integration/evidence. Concept study and practical competence remain separate.

Linux standalone HYPOTHETICAL

Validate the source path and discover hosts Discover TCP ports with SYN or connect scans Establish scheme, host, redirects and request state Map functions, roles and normal requests manually Read files through directory traversal Classify the artifact and its identity context Validate known passwords and context-specific reuse Use SSH passwords, keys and forwarding-capable access Establish Linux state and choose an escalation candidate Use an allowed sudo operation to cross a privilege boundary Establish Linux state and choose an escalation candidate

Windows standalone HYPOTHETICAL

Validate the source path and discover hosts Discover TCP ports with SYN or connect scans Establish scheme, host, redirects and request state Map functions, roles and normal requests manually Establish upload acceptance, storage and retrieval Execute an uploaded file through a compatible handler Verify command execution, host and represented identity Establish Windows token, host and process context Change a privileged service's executable configuration Establish Windows token, host and process context

AD roast and movement HYPOTHETICAL

Establish domain identity, DC, DNS, time and route Enumerate directory objects with native, LDAP and PowerView approaches Request a selected service ticket for offline service-account recovery Recover passwords with feasible dictionary, rule and mask attacks Validate known passwords and context-specific reuse Match route, destination service and effective authorization Use WinRM, WinRS or PowerShell remoting Establish Windows token, host and process context Select a privilege-backed impersonation or object-control route Obtain accessible live logon-session credential material Recover or reuse an NT password hash Select password, NT hash, key-to-ticket or ticket authentication Execute through uploaded service creation using PsExec

AD replication and evidence HYPOTHETICAL

Establish domain identity, DC, DNS, time and route Enumerate directory objects with native, LDAP and PowerView approaches Validate effective directory-object control Use validated directory replication rights for bounded credential proof Capture state-transition, proof and exploit-adaptation evidence Build and validate the report and submission artifacts

Pivoted domain access HYPOTHETICAL

Discover pivot interfaces, routes and internal service context Route a selected internal subnet through Ligolo-ng Preserve DNS, Kerberos names and time across a pivot Establish domain identity, DC, DNS, time and route Enumerate directory objects with native, LDAP and PowerView approaches Collect focused BloodHound data and validate an attack path Validate effective directory-object control Add a controlled identity to a group through effective membership rights Use WinRM, WinRS or PowerShell remoting

Execution and callback repair HYPOTHETICAL

Verify command execution, host and represented identity Connect a Linux reverse shell through an available interpreter Diagnose connection direction, listener and session failures in order Pair staged payloads with the correct handler and session lifecycle Verify command execution, host and represented identity

Built from your reviewed exploitation reference. Dedicated buffer-overflow development is excluded by preparation choice. Existing-exploit adaptation remains covered. Check current exam rules ↗