OSCP roadmap (PEN-200)

OSCP roadmap (PEN-200)

TL;DR: A zero-to-OSCP study path that uses only this repo plus official OffSec material and free practice platforms. Twelve-week plan, ordered so each week builds on the last. Pair with oscp-exam-methodology and oscp-full-chain-walkthrough.

Who this is for

You have:

  • Basic computer literacy and curiosity.
  • No prior pentest or programming background required, but it helps.
  • 15-20 hours a week to study.

You want:

  • To pass OSCP within 12 weeks of focused study.

How to use the path

  • Each week lists notes to read, labs to run, and a deliverable (a small artefact that proves you can do the thing).
  • Stop at the end of each week and rebuild your tooling VM with what you learned.
  • After week 12, sit a mock exam under exam rules. If you pass it, book the real one.

The 12 weeks

Week 1 — terminal and HTTP

Week 2 — recon and service enumeration

Week 3 — web attacks (first half)

Week 4 — web attacks (second half)

Week 5 — Linux privilege escalation

Week 6 — Windows privilege escalation

Week 7 — public exploits + buffer overflow

Week 8 — Metasploit + client-side

Week 9 — tunneling, pivoting, password attacks

Week 10 — Active Directory (foundations)

Week 11 — Active Directory (movement)

Week 12 — methodology, mock exam, report

Exam booking checklist

  • Passed the mock with ≥ 70 points without any AI assistance.
  • Reporting template prepared, finding skeleton drafted.
  • All tools on Kali updated; clean snapshot saved.
  • OpenVPN connection tested.
  • OffSec portal ID verification done.
  • Sleep schedule sane for the 48 hours before.

Beyond OSCP

Practice platforms (free or low-cost)

  • TryHackMe — beginner-friendly rooms, OSCP-prep paths.
  • HackTheBox — retired machines, TJ Null OSCP-like list.
  • OffSec Proving Grounds Practice — paid, closest to exam feel.
  • VulnHub — old but still gold for BOF practice.
  • PortSwigger Web Security Academy — web only, but the best free web-vuln training in existence.

Quick decision matrix — given an open port

This is the one-page artefact most candidates wish they had built earlier. Print it. Pin it.

Port Service First check Then
21 FTP nc -nv $IP 21 for banner; anonymous login (ftp $IP, user anonymous) <a class="wikilink" href="/learnfromscratch/learn/topics/network/ftp-enum/">ftp-enum</a>, look for writable dirs + web-root overlap
22 SSH banner version → searchsploit <a class="wikilink" href="/learnfromscratch/learn/topics/network/ssh-enum/">ssh-enum</a>, user enum (CVE-2018-15473), key reuse
25 SMTP nc $IP 25, VRFY/EXPN user enum <a class="wikilink" href="/learnfromscratch/learn/topics/network/smtp-enum/">smtp-enum</a> for open relay, internal-only injection paths
53 DNS dig axfr @$IP $domain <a class="wikilink" href="/learnfromscratch/learn/topics/network/dns-enum/">dns-enum</a>, subdomain brute with gobuster dns
80/443 HTTP(S) whatweb $IP, nikto -h $IP, ffuf -u http://$IP/FUZZ <a class="wikilink" href="/learnfromscratch/learn/topics/network/http-enum/">http-enum</a>, framework-specific (WordPress wpscan, Drupal droopescan)
111 rpcbind rpcinfo -p $IP look for NFS (port 2049), showmount -e $IP
135 MSRPC rpcclient -U "" $IP <a class="wikilink" href="/learnfromscratch/learn/topics/network/msrpc-enum/">msrpc-enum</a>, null sessions, anonymous SAMR enum
139/445 SMB smbclient -L //$IP -N, enum4linux-ng $IP <a class="wikilink" href="/learnfromscratch/learn/topics/network/smb-enum/">smb-enum</a>, null shares, EternalBlue era CVEs, signing status
161 SNMP onesixtyone -c community.txt $IP, snmpwalk -v2c -c public $IP <a class="wikilink" href="/learnfromscratch/learn/topics/network/snmp-enum/">snmp-enum</a>, community brute, walk for creds in sysDescr
389/636 LDAP ldapsearch -x -H ldap://$IP -s base namingcontexts <a class="wikilink" href="/learnfromscratch/learn/topics/network/ldap-enum/">ldap-enum</a>, anonymous bind, BloodHound from null
1433 MSSQL mssqlclient.py -p 1433 sa@$IP <a class="wikilink" href="/learnfromscratch/learn/topics/network/mssql-enum/">mssql-enum</a>, xp_cmdshell, link abuse
3306 MySQL mysql -h $IP -u root -p <a class="wikilink" href="/learnfromscratch/learn/topics/network/mysql-enum/">mysql-enum</a>, default creds, into outfile
3389 RDP rdesktop -u guest $IP, crackmapexec rdp $IP -u ... -p ... <a class="wikilink" href="/learnfromscratch/learn/topics/network/rdp-enum/">rdp-enum</a>, BlueKeep era, sticky-keys persistence post-foothold
5985/5986 WinRM evil-winrm -i $IP -u user -p pass <a class="wikilink" href="/learnfromscratch/learn/topics/network/winrm-enum/">winrm-enum</a>, paired with valid AD creds
6379 Redis redis-cli -h $IP <a class="wikilink" href="/learnfromscratch/learn/topics/network/redis-enum/">redis-enum</a>, write SSH key via CONFIG SET dir

If a port is not on this list, search _learn/topics/network/ index. If still nothing, banner-grab and search-sploit.

Useful one-liners — paste these into your template

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

# Full TCP scan, then service-version on found ports — two-stage pattern that survives slow targets
nmap -p- --min-rate 5000 -oA scans/full $IP
ports=$(awk -F'/' '/^[0-9]/{print $1}' scans/full.nmap | tr '\n' ',')
nmap -sV -sC -p$ports -oA scans/svc $IP

# UDP top-100 (slow — run in background while you start TCP work)
sudo nmap -sU --top-ports 100 -oA scans/udp $IP

# Content discovery — Big lists, json output for grep later
ffuf -u http://$IP/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -of json -o ffuf.json -mc 200,204,301,302,307,403

# vhost discovery when you suspect name-based hosting
ffuf -u http://$IP/ -H "Host: FUZZ.$DOMAIN" -w subdomains-top1million-110000.txt -fs <size-of-default-vhost>

# Reverse shell catcher with auto-upgrade (paste tty trick after callback)
rlwrap nc -lvnp 4444
# in the shell once landed:
# python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl-Z; stty raw -echo; fg; export TERM=xterm-256color; stty rows $(tput lines) columns $(tput cols)

Keep these in ~/oscp/template.sh and source it on every box.

Pragmatic notes from people who sat the exam

A few patterns turn up repeatedly in candidate write-ups that are worth treating as defaults:

  • Host OS: run your tooling inside a Kali VM on a Windows or macOS host, not Kali as the bare-metal host. Two candidates’ worth of pain came from clipboard, copy-paste, and snapshot issues using Kali as the primary OS.
  • Privesc bias: OSCP weighs privesc much more heavily than real engagements do. Real pentests usually stop at “RCE proven, here is the impact”. Lean into privesc grind anyway — it is what the exam tests.
  • IppSec videos: watching retired-box walkthroughs at 1.25–1.5x is often higher-leverage than another raw lab grind once you can already pop easy boxes. Use them to internalise privesc reasoning rather than as a step-by-step script.
  • Mental model shift after OSCP: expect to feel uncomfortable about how little client-side and web-app testing the exam covers compared to real day-to-day work — that gap is exactly why oscp-vs-osep-mindset, oswe-roadmap, and a bug-bounty side practice matter.

References