OSCP+¶
What this section is
Study hub for the OSCP+ exam (PEN-200). The layout follows what 2025–2026 pass and fail write-ups agree on: get the Active Directory set solid, and hold the standalone machines with strong fundamentals. Where a technique already has a page in this handbook, the OSCP page links to it instead of repeating it — so the attacker view here and the detection view in Adversary / Windows / Network stay connected.
Before the exam: check the official OSCP+ Exam Guide
Exam rules — banned tools, the Metasploit limit, proof requirements, report format — change over time. Before you sit the exam, read the current OffSec OSCP+ Exam Guide yourself. The rule notes in this section are a study aid, not the authority.
Restricted in the exam (summary)
- Automatic exploitation tools — sqlmap, SQLninja, db_autopwn, browser_autopwn → do SQLi by hand (Manual SQLi).
- Mass vulnerability scanners — Nessus, OpenVAS, NeXpose, Core Impact →
nmap -sV/ NSE +searchsploit(Recon). - Commercial tools — Burp Suite Pro, Metasploit Pro → Burp Community, manual testing.
- Spoofing — ARP / DNS / NBNS / LLMNR poisoning (Responder poisoning, mitm6, bettercap) → coercion to your own SMB server.
- AI / chatbots — ChatGPT, Claude, Gemini, OffSec KAI and the like → your own notes and public references.
- Metasploit / Meterpreter — one target only, no pivoting with it;
msfvenomandmulti/handler(non-Meterpreter) are fine everywhere (Shells).
Details: Exam format › Restricted · Metasploit.
1. Know the exam¶
-
Exam format & scoring
3 standalones (60 raw points) + AD set (40), no bonus points. Before 1 Dec 2026, 08:00 GMT: 70 raw points to pass; from that start time: 400 on a 100–500 scaled score. Exam changes and date-specific scoring examples.
-
Exam workflow
The whole exam as one pipeline: recon → foothold → stable shell → privesc → AD assumed breach → pivot → lateral movement → domain. Links every stage to its page.
Start with the practical guides¶
-
Practical field guide
Essential tools → workspace → command and output → failure diagnosis → evidence. Connect Nmap, ffuf, Burp, NetExec, shells, privesc, AD and pivoting.
-
Impacket handbook
14 scripts, identity grammar, prerequisites, worked commands and troubleshooting, with actual help and local-execution output images.
-
Reproducible tool lab
Local HTTP discovery, fuzzing, SMB authentication, file transfer and integrity checks without a Windows VM. Includes images and raw logs.
2. Study areas¶
Each study-area page follows the same layout: concept → main tools → scenarios (situation → command → what to read → next step) → common mistakes → exam tips.
-
Recon & enumeration
nmap, NetExec, smbclient, enum4linux-ng, SNMP, NFS — find every port and everything it leaks.
-
Web & initial access
ffuf / feroxbuster / gobuster, nikto, Burp Community, searchsploit, manual SQLi, upload, LFI, client-side.
-
Shells & file transfer
Reverse shells, msfvenom payloads, TTY upgrade, moving tools in and loot out, the one-target Metasploit rule.
-
Linux privilege escalation
LinPEAS, pspy, GTFOBins — sudo, SUID, capabilities, cron, credentials, NFS, kernel last.
-
Windows privilege escalation
WinPEAS, PrintSpoofer / GodPotato, LOLBAS — tokens, services, tasks, AlwaysInstallElevated, stored creds.
-
Password attacks
hashcat / john modes, custom wordlists, NetExec & Kerbrute spraying, hydra — and lockout math.
-
Active Directory
Top priority. Assumed breach → NetExec, BloodHound CE, Kerberoast / AS-REP, ACL abuse, Impacket lateral movement, mimikatz, DCSync.
-
Pivoting & tunnelling
The most common failure point: reaching the internal subnet. Ligolo-ng, Chisel, SSH forwarding, proxychains.
-
Methodology & habits
Enumeration checklist, simple things first, rabbit holes, the one-target Metasploit budget, notes.
-
Reporting
Proof screenshots that count, exam-time note structure, template, mock reports.
3. Practice¶
-
Practice labs & machine lists
Challenge Labs (OSCP A/B/C), Proving Grounds Practice, LainKusanagi list, AD drills, mock exams, progress log.
-
Lab walkthroughs
Full worked examples from my home lab — attack end to end, then detect it (Splunk / Zeek). First up: Kerberoasting.
4. Exam day and plan¶
-
Exam-day strategy
Booking, setup, order of attack (one standalone → AD set), breaks, point tracker.
-
My study plan
Focus areas, weekly plan, weak-points log, mock exam results.
Readiness checklist¶
- PEN-200 modules done, up to and including Assembling the Pieces
- Challenge Labs OSCP A, B and C cleared — and understood, not just flagged
- Proving Grounds Practice machines from the LainKusanagi list → Practice labs
- AD set from assumed-breach credentials to DC, without notes → Active Directory
- Pivot into an internal subnet with Ligolo-ng from memory → Pivoting
- Timed mock exam + full report, at least three times → Reporting
- Exam booked (slots are limited — book about a month ahead) → Exam day