OffSec OSCP+ Review

Happy to announce that I have passed my OSCP exam recently :D

What is the OSCP?

The Offensive Security Certified Professional (OSCP) is a foundational red team certification. I won’t list out everything about it here, but it is a relatively well-known cybersec certification that benefits both blue and red teams.

What is included in the OSCP?

I won’t go too much into detail here as the entire syllabus is available on their site. It covers the entire attack life cycle from reconnaissance to maintaining persistence. Active Directory (AD) attacks are also included in the course and is guaranteed to show up in the exam.

How did I prepare for the exam?

The company I work for was generous enough to pay for the annual Learn One subscription so I was able to practice with Proving Grounds lab for 12 months. I highly recommend starting to work on these labs as soon as possible as the format and “tricks” are very similar to those in the exam.

During my time hanging around r/OSCP and the discord channel, I’ve also noticed others pushing the “Try Harder” mindset. Often times, people minunderstood this as brute-forcing your way through the course materials and labs. Obviously, you should give a good try to solve any roadblocks you encounter. BUT! There’s no way of knowing what you don’t know. No shame in taking a hint or two when working on the labs and note down what you missed/learned. Personally, I would’ve completed the course much faster instead of hitting my head on a brickwall for a couple days and wasting my time.

Resources

The labs in Lainkusanagi’s list is what I used to prepare for the exam. There’s a reason why this list exists, the attack paths or exploit utilised will be almost identical to the exam.
This cheatsheet by hdks is what I used in the real exam.
For better understanding of AD, I’ve also followed through the Active Directory Enumeration & Attacks module from HackTheBox.

Final Thoughts and Advice

Overall, I think OSCP is defintely worth spending your time on as it’s one of the best entry/mid level red team certifications out there. It doesn’t go too much into detail on certain topics but it’s enough to get you started with the mindset of “Trying Harder” to improve and gain more knowledge independently. Also, it’s really helpful for blue teamers to finally get a glimpse of the dark side and how attackers move.

On another note, the value of the OSCP certification leaves much to be desired considering the USD $1,749 price tag for only 90 days of access. If you’re working full time and you’re a newbie in the cybersecurity field like me, you won’t have enough time to learn and build up enough confidence for the exam in just 3 months. Although, I’ve heard of wild stories where other individuals absolutely smashed it with no issues. It’s just not the reality for most people who have commitments outside of work and/or study.

If you absolutely need to grab the OSCP certification, I would suggest paying the USD $490/year and go through the HTB CPTS course first. Everything from OSCP, if not more, is covered in CPTS. After CPTS, you will have a much higher chance of completing the OSCP course & labs and passing the exam within 90 days.

Would I have done the OSCP if I had to pay for it myself in this economy? To be honest, nope.

Tips and Tricks

By no means does this cover everything in the OSCP, but this will help you greatly when completing practice labs:

Enumerate harder. Google harder.
Find multiple versions of the same exploit, switch it up if one doesn’t work.
Look it up in HackTricks if you come across an unfamiliar port. If the methods in HackTricks didn’t work, it’s most likely not the path forward.
Familarise yourself with the standard OS configurations. E.g. What folders are non-standard? Anything interesting in /opt (Linux) or C:\ (Windows)? Why is there an open port for MySQL (Port 3306) listening on localhost?
The tree command will save your life.
Have multiple different ways of file transfer/exfiltration on hand.
Learn to use Ligolo now. Learning to port forward is a must for privilge escalations.
Reminna has never failed me. You can save connection details for quick and easy access.
NetExec is a must have for AD.
Use bloodhound-ce-python instead of having to search for the right Sharphound version.

I hope these tips I’ve gathered from the quirks of Offsec makes your journey a bit easier.