Sample OffSec OSCP OSCP Practice Questions
Q: Which Nmap scan type performs a TCP SYN scan, also known as a 'stealth scan'?
A: nmap -sS — The -sS flag performs a SYN scan (half-open scan) which sends SYN packets and analyzes responses without completing the TCP handshake, making it stealthier than a full connect scan (-sT).
Q: Which tool is the most common web directory brute-forcer used in OSCP engagements?
A: gobuster dir — Gobuster's dir mode is a fast, multi-threaded directory and file brute-forcing tool that uses wordlists to discover hidden paths and files on web servers. It is one of the most commonly used tools in OSCP for web enumeration.
Q: Which tool is commonly used to generate reverse shell payloads in various formats (exe, elf, php, etc.)?
A: msfvenom — msfvenom is Metasploit's payload generator that creates shellcode and executables in multiple formats. It can generate reverse shells, bind shells, and meterpreter payloads for Windows, Linux, PHP, Python, and many other platforms.
Q: Which automated script is commonly used to enumerate Linux privilege escalation vectors?
A: linpeas.sh (LinPEAS) — LinPEAS (Linux Privilege Escalation Awesome Script) is a comprehensive enumeration script that checks for SUID binaries, writable files, cron jobs, kernel vulnerabilities, and hundreds of other privilege escalation vectors on Linux systems.
Q: After gaining root access on a Linux target, which of the following is the most reliable method for maintaining persistent SSH access?
A: Adding your public key to /root/.ssh/authorized_keys — Adding your SSH public key to the authorized_keys file of the root user provides persistent, password-less SSH access. This is a simple, reliable, and commonly used persistence technique that survives reboots and password changes.
Q: You need to identify all live hosts on a /24 subnet without performing a port scan. Which Nmap command achieves this?
A: nmap -sn 10.10.10.0/24 — The -sn flag (ping scan) performs host discovery only without port scanning. -Pn skips host discovery entirely, -sV does version detection, and -O does OS detection, all of which involve port scanning.
Q: Which Nmap option enables OS detection, version detection, script scanning, and traceroute in a single flag?
A: -A — The -A flag enables aggressive scanning which combines OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) into one convenient option.
Q: During enumeration of a Windows domain controller, which LDAP query filter would enumerate all user accounts?
A: (&(objectClass=user)(objectCategory=person)) — The LDAP filter (&(objectClass=user)(objectCategory=person)) specifically targets user account objects in Active Directory, filtering out computer accounts and other object types.
Q: Which tool is specifically designed for enumerating SMB shares, users, and groups on a target system?
A: enum4linux — enum4linux is a Linux tool designed for enumerating information from Windows and Samba systems via SMB, including shares, users, groups, and password policies. Nikto and dirb target web servers, and wpscan targets WordPress.
Q: You discover SNMP running on a target. Which community string should you try first, and which OID tree contains system information?
A: 'public' community string; OID 1.3.6.1.2.1.1 (system) — The default read-only community string is 'public', and the system OID tree 1.3.6.1.2.1.1 contains basic system information including hostname, description, and uptime. This is always the first enumeration target for SNMP.