The Offensive Security Certified Professional (OSCP) is a hands-on cybersecurity certification focused on practical penetration testing skills. Unlike theoretical exams, it requires you to compromise live systems under extreme time pressure. 1. Core Prerequisites & Foundational Skills
While there are no strict official prerequisites, successful candidates typically have a solid grasp of:
Networking: Knowledge of the OSI model, TCP/UDP ports, and common services (HTTP, SMB, FTP).
Linux & Windows Proficiency: Comfort with command-line interfaces and file system navigation in both operating systems.
Scripting: Basic ability to read and modify Python, Bash, or PowerShell scripts to aid in exploitation.
The "Try Harder" Mindset: A core OffSec philosophy emphasizing persistence and creative problem-solving when hitting obstacles. 2. The PEN-200 Course (Official Training)
The primary way to prepare is through the Penetration Testing with Kali Linux (PEN-200) course.
A BEGINNERS GUIDE TO OSCP 2021. from zero to oscp | by Harris
The prompt on the screen was simple, white text on a black background: "Prove you have Administrator access on the target machine."
I stared at it, bleary-eyed. It was 2:00 AM on a Sunday. I had been in the Offensive Security labs for fourteen hours straight. My coffee cup was a fossil monument; my back ached from the cheap IKEA chair. This was the OSCP—the Offensive Security Certified Professional certification—often described as the most grueling exam in the industry.
They say the OSCP isn’t just a test; it’s a rite of passage. It’s where "script kiddies" go to die. The motto of the course is simple, brutal, and honest: Try Harder.
For months, I had lived in the VPN tunnels of the Offsec labs. I had learned to think like an attacker. I stopped relying on automated tools like Metasploit—the "easy button"—because the exam forces you to do things manually. I learned to craft my own buffer overflows, injecting shellcode byte by byte, calculating memory offsets until my eyes crossed. I learned to enumerate deeply, to check every open port, every forgotten script, every misconfigured permission.
But this exam was different. The machines were alive.
I had already compromised three of the five required targets. I had twelve hours left on the clock. The machine I was staring at now, let’s call it "Vault," was a beast. It was a Windows Server 2016 box, locked down tight.
I had spent four hours enumerating it. I found nothing. No weak passwords, no open SMB shares, no obvious web vulnerabilities. The frustration was physical; it sat in my throat like a stone. I wanted to quit. I wanted to close the laptop and accept that I wasn't ready.
Then, I remembered the mantra. Try Harder.
I went back to the basics. Port 80 was open, running a standard IIS server. But port 8080 was filtered—blocked by a firewall. Why run a web server on a non-standard port and then block it?
I fired up a different scanner, one that looked for subtle differences in TCP packet responses. A few minutes later, the result popped up: Firewall bypass possible via source port manipulation.
I reconfigured my scan to spoof the source port as 20 (FTP data). The firewall, configured with a lazy rule to allow FTP data traffic, let my packet through.
The port opened. It was a custom accounting application. offensive security oscp
I browsed to it. A login screen. I tried default credentials: admin/admin. Rejected. I tried SQL injection. Blocked. I sat back and rubbed my temples.
Then, I looked at the URL structure. view?id=102. I changed it to view?id=103. A different invoice appeared. I changed it to view?id=../etc/passwd. Nothing.
But when I changed it to view?id=102'|dir
The server hiccupped. An error message leaked. It wasn't a standard error. It was a verbose error from a legacy script. It was running a system command.
My heart hammered against my ribs. This was it. A blind OS command injection.
I didn't have a fancy tool to exploit this. I had to do it manually. I crafted a payload to ping my machine back. I set up a listener on my local Kali box.
view?id=102|ping -n 1 10.10.14.5
I hit enter. I stared at my terminal. One second passed. Two seconds.
Beep.
A packet received. I had execution.
But "execution" is not "Administrator." I was running as a low-level service account. I couldn't read the Administrator's desktop where the proof file sat.
I spent another hour trying to escalate privileges. I uploaded a kernel exploit, but the machine patched it instantly. I tried a Potato attack, but the privileges were stripped.
Time was bleeding away. It was 6:00 AM. The sun was coming up. The exam ended at 10:00 AM. I had four hours.
I looked at the running processes. There was a custom backup service running as SYSTEM. I couldn't touch the executable; it was locked. But I could read the configuration file for the service.
I opened the config file. It contained a path to a backup script: C:\Scripts\Backup.bat.
I checked the permissions on that folder. The service account I had compromised had Write permissions on the folder.
The machine was checking the integrity of the executable, but it was blindly executing the script.
I had one shot. If I corrupted the script and the service crashed, the proctor might investigate, or I might lock myself out. I had to be perfect.
I crafted a simple batch script that would create a new user and add it to the Administrators group.
net user hacker Password123! /add
net localgroup Administrators hacker /add The Offensive Security Certified Professional (OSCP) is a
I uploaded my malicious Backup.bat to the C:\Scripts folder, overwriting the original.
Now, I had to wait. The backup ran every hour. It was 6:45 AM. The next scheduled run was 7:00 AM.
I sat in silence. The room was cold. I watched the clock on the screen tick. 6:58. 6:59.
At 7:02, my shell session on the target machine spiked. The script had run.
I quickly opened a new command prompt on the victim machine via my backdoor and typed:
runas /user:Vault\hacker cmd.exe
It asked for a password. I typed: Password123!
Access is denied.
My stomach dropped. Had I failed? Was the password complexity policy blocking me?
I checked the user list.
net user hacker
The command completed successfully.
The user existed. I tried to log in again. Access is denied.
Then it hit me. runas requires an interactive session. My simple shell didn't support interactive logins well. I was locked out of my own backdoor.
I had 2.5 hours left. I had Administrator credentials, but I couldn't spawn a shell to use them.
I took a breath. I disabled the firewall on the victim machine using my low-privilege service account's ability to modify the registry keys for the firewall service (a rare misconfiguration I had noted hours ago).
netsh advfirewall set allprofiles state off
The firewall dropped.
Now, I had credentials and open ports. I launched psexec.py from my Kali box.
python psexec.py hacker:Password123!@10.10.10.50
The cursor blinked. The connection attempted. I prayed to the TCP/IP gods.
Impacket v0.9.22 - Copyright 2020 SecureAuth
[*] Connecting to DCE/RPC...
[*] Binding to IOXIDResolver...
[*] Spawning shell... Preparation Strategies The Cost (As of 2024) The
A new terminal window popped up.
C:\Windows\system32>whoami
nt authority\system
I was God.
I didn't cheer. I was too tired to cheer. I navigated to the Administrator's desktop.
cd C:\Users\Administrator\Desktop
dir
There it was. proof.txt.
type proof.txt
A string of characters appeared. I copied them into my report. I took the screenshot.
It was 7:30 AM. I had passed. I had compromised the network, bypassed the firewall, injected code, escalated privileges, and owned the box.
I leaned back in my chair. The exhaustion hit me like a wave, but underneath it was a surge of adrenaline that no drug could replicate. I hadn't just followed a tutorial. I hadn't just run a tool. I had hacked that machine. I had solved a puzzle that tried its hardest to break me.
I saved the report, disconnected from the VPN, and closed the laptop. The OSCP wasn't a piece of paper; it was the feeling in my chest at that exact moment. The realization that if I could break into a fortress built to keep me out, there wasn't a door in the digital world I couldn't open.
I walked to the kitchen to make fresh coffee. I had a report to write.
For the Offensive Security Certified Professional (OSCP) exam, the final report is the most critical component for passing. It must demonstrate a clear, professional, and reproducible path from initial discovery to administrative compromise.
OffSec provides Official Report Templates in Microsoft Word and OpenOffice/LibreOffice formats that you are highly encouraged to use. 📋 Mandatory Report Sections The following structure is required for a valid submission: PEN-200 Reporting Requirements - OffSec Support Portal
The OSCP is not cheap:
Many employers reimburse the cost or provide training budgets. If self-funding, consider it an investment in your career.
The course is known as PEN-200 (Penetration Testing with Kali Linux).
The PEN-200 course assumes you know basic Linux, Windows, networking, and Bash/PowerShell. If you don't know how to navigate a CLI or what a TCP handshake is, start with the CompTIA Network+ or Linux+.
When you purchase the OSCP, you get access to the PEN-200 course materials and the infamous Offensive Security labs (public networks with 50+ machines).
Yes, but with caveats. Here is the current industry view:
The OffSec lab has a mix of easy, medium, and hard machines. Aim to compromise at least 30–40 machines before the exam. The public “PG” (Proving Grounds) machines from OffSec are also great practice.
Pros:
Cons: