OffSec OSCP Study Roadmap

Domain 1: Pentest methodology, Kali Linux setup, bash scripting, report templates

Domain 2: Passive recon — OSINT, Google dorking, Whois, DNS enumeration

Domain 2: Active scanning — Nmap, service enumeration, SMB/SNMP/HTTP

Domain 3: Web attacks — SQL injection (UNION, blind, error-based), sqlmap

Domain 3: Web attacks — LFI/RFI, XSS, command injection, file uploads

Domain 4: Windows exploitation — Buffer overflows, public exploits, Metasploit

Domain 4: Windows privilege escalation — Token impersonation, service exploits, unquoted paths

Domain 4: Linux exploitation & privilege escalation — SUID, cron, kernel exploits, capabilities

Domain 5: Active Directory — Enumeration, BloodHound, Kerberoasting, AS-REP roasting

Domain 5: AD lateral movement — Pass-the-hash, pass-the-ticket, Mimikatz, domain persistence

Domain 6: Post-exploitation — Pivoting, port forwarding, SSH tunneling, Chisel/Ligolo

Lab Practice: Work through OSCP lab machines, document methodology

Lab Practice: Challenge labs, timed exercises, try harder machines

Lab Practice: Full mock exam — 5 machines in 24 hours with report

Report Writing: Practice professional report writing, refine templates

Final Review: Weak areas, exam strategy, rest and preparation