After many long nights and hundreds of hours of study, I finally passed the OSCP. The certification has a reputation for being difficult, and in my experience that reputation is deserved. But the difficulty wasn’t only technical. The hardest part was learning how to stay methodical when I was stuck, how to recognize rabbit holes before they consumed too much time, and how to keep moving when the next step wasn’t obvious.
This post isn’t a walkthrough, and it doesn’t contain exam spoilers. Instead, I want to share the lessons that actually helped me improve: building a stronger methodology, escaping rabbit holes, practicing pivoting, improving privilege escalation, managing time, and taking the report seriously.
1. Methodology Matters More Than Any Single Exploit
The OSCP isn’t as difficult as some people make it out to be. If you have a strong methodology and manage your time well, passing becomes a lot more achievable. Having a repeatable process matters more than knowing one more exploit from memory.
Before I passed, I treated enumeration as something I did at the beginning of a machine. Over time I realized enumeration isn’t a single phase. It’s something you repeat constantly. You enumerate before exploiting, after finding credentials, after getting a shell, after privilege escalation, and again after pivoting. Every new piece of access changes what you can see and what you should test.
A strong methodology also means slowing down enough to understand what your tools are telling you. It’s easy to blindly run scanners, copy commands, or chase whatever looks interesting. But the OSCP rewards people who can look at output and ask, “What’s actually unusual here?” or “What does this tell me about the attack path?” Properly researching findings and recognizing what looks out of place mattered more than simply running more tools.
I also learned to re-check simple things before assuming the answer was complex. It’s tempting to believe every box requires some obscure exploit, but that mindset can cause you to miss the obvious: reused credentials, exposed files, default functionality, weak permissions, or a service behaving slightly differently than expected. When I got stuck, I reminded myself to return to basics and to use more than one tool for the same job (SMBMap, smbclient, and NetExec, for example, will each occasionally surface something the others miss).
Notes
I thought good notes meant documenting everything perfectly. In reality, the most useful notes were the ones that helped me make decisions. They tracked open ports, credentials, interesting files, failed attempts, possible attack paths, and what I wanted to come back to later. Notes should reduce confusion, not create more work.
The screenshot above shows the product of all my OSCP notes thrown together into a quick, Claude-generated website. During the test, I decided to move away from actual note taking software and instead build an easy to use series of web pages containing all of my notes. I created five lengthy pages covering Active Directory, General Tips, Privilege Escalation, Services and Ports, and Web Applications, and populated them with hundreds of commands I’d collected during my OSCP journey. I found that this worked really well. I didn’t have to hunt for any commands; they were all nicely organized. I even created a section for what to do when I was truly stuck, so I could work through a checklist to help me think through the problem differently.
I use Microsoft OneNote for my main note-taking system, and have for a few years. Before that I used CherryTree, and I’ve also tried Joplin and Obsidian. I still prefer OneNote overall, mainly because it syncs automatically, handles cloud backup, and lets me access notes from my phone or any computer. It has flaws (search is genuinely bad for a note-taking app), but I work around that with tags and a consistent hierarchy.
Here’s the structure I use for exam-style prep: a section for each target machine, with subnodes for enumeration and a new node per service (an FTP service on port 21 gets an “FTP 21” node, and everything related to that service, including enumeration and exploitation, goes there). I also keep a foothold note, a privesc note, and a creds note per machine, plus a running To-Do note where I dump ideas to try later and mark things done (dirbusting, subdomain enum, nikto, etc.). I use color coding, with teal, orange, and white text in dark mode, yellow highlighting for anything important, and OneNote’s built-in tags (like “Important”) with a personal rule that anything tagged Important gets followed up before I move on.
I take a lot of screenshots and paste them straight into OneNote rather than saving them to the filesystem. It’s easy to zoom in, resize, and re-screenshot within OneNote for the report, and the resolution holds up fine.
Checklists
Checklists are helpful, but they shouldn’t replace thinking. A checklist can remind you what to test, but it can’t tell you why something matters. The goal isn’t to mechanically run through commands. It’s to build an attack path from evidence.
Timers and Personal SOPs
One practical habit that helped was using timers, both for individual tasks and for how long I’d spend on a machine before stepping back to reassess. This kept me from burning hours on a path just because I wanted it to work.
I also built personal SOPs around time management and wellness for exam day specifically: a timer every 30 minutes to stand up and rest my eyes, a break every hour, a walk outside every three hours, and a real plan for sleep. As a precaution, I taped “No Phones Allowed” signs on the door and marked a boundary line on the floor with painter’s tape, partly for me when I’m exhausted and partly as a reminder for my wife.
On the technical setup side: I don’t open other browsers on the host machine, and I screenshot and save everything twice. I create folders on the host machine for each box (“AD,” “1,” “2,” “3,” “4”) on both Windows and Linux. I start a dedicated terminal for the OpenVPN connection, minimize it, and never touch it again. Then I open a Terminator session with a tab per machine, renamed to the target IP (e.g., <X.X.X.X – Box #1>), each split vertically, with the left pane for enumeration and the right pane for active exploitation. I’ll split further if I need a dedicated pane for a specific tool. When I’m done with a machine, I close the tab unless I still need it for report evidence. Once AD pivoting starts, I add a fifth dedicated tab for that. Once you’re running Ligolo-ng or Chisel, you need the extra real estate for the additional panes involved. Early in my pentesting career I used to get lost across too many shell tabs or, worse, separate terminal windows entirely; this structure fixed that.
I also keep standing SOPs for specific moments: as soon as I start enumeration on a target, right after I get a foothold, when I’m stuck, and after I get a username or credential. Standardizing these keeps things consistent under pressure.
2. Rabbit Holes
Rabbit holes are one of the most frustrating parts of OSCP preparation, and one of the most important things to learn how to manage.
A rabbit hole isn’t just a wrong path. It’s a wrong path you keep defending because you’ve already spent too much time on it. You find a service that feels exploitable, spot a version number, locate exploit code, and start convincing yourself this must be the way in. An hour passes, then two. At some point the problem isn’t the machine anymore. It’s that you’re emotionally invested in proving your original idea was right.
My rule: don’t spend more than an hour on a box without measurable progress, whether that’s a foothold, a privilege escalation, or enumeration that’s genuinely promising. If I’m stuck after an hour, it’s time to move to another box, and ideally that’s also the perfect time to take a break. Walking outside works like a shower thought for me, and I can’t count how many “aha” moments I’ve had pacing around a park.
When I’m completely stuck, I run through my “I’m Stuck” checklist:
- Mindmap it first: Do I have a lead (a path I think works but can’t get functioning) or am I completely stuck with no direction?
- If I have a lead: Try a different exploit, try a different tool, check my reverse shell troubleshooting guide (different port, multi-step delivery, etc.).
- If I’m fully stuck: Start over and go step by step, looking deeper at each layer. Google everything. Step back and look at the bigger picture. Review cheatsheets, Ippsec.rocks, HTB Academy. Search Discord for the topic (as a resource, not to ask the question directly). Review the PEN-200 PDF. Review my box notes and box spreadsheet.
- If one exploit isn’t working, try another, then another, and if none work, intercept the exploit’s HTTP traffic in Burp Suite to see what’s actually failing.
The OSCP has more rabbit holes than anything you’ll see in the labs or on Proving Grounds, and they’re more convincing. I’ve been fooled more than once, certain “this is definitely the path,” only to find out later it wasn’t. One of the best ways to avoid this is to write down why you think a path is valid. “This looks interesting” or “there’s an exploit on GitHub” usually isn’t enough on its own. Good evidence looks more like a confirmed vulnerable version, a matching configuration, reachable functionality, credentials that apply to the service, or behavior that actually supports your theory.
I also keep a “come back later” section in my notes. Moving on doesn’t mean abandoning an idea forever; it means recognizing the current evidence is weak or the time investment isn’t justified yet. Parking a lead keeps your momentum without losing track of something that might matter later.
A practical rule: set a short timer for promising leads. If you’re not making progress by the time it goes off, stop and reassess. What have you actually proven, what are you assuming, and are there better leads available? Rabbit holes get a lot less dangerous once you treat them as hypotheses instead of commitments.
Re-enumeration is another way out. After every new credential, shell, privilege level, or network position, enumerate again. A path that was impossible before may now be obvious. A service that seemed irrelevant might become useful once you have credentials. The biggest mistake is assuming your first view of the target is complete.
3. Pivoting
Pivoting is critical for the OSCP, especially in the Active Directory environment. Successfully compromising the AD set is often the most realistic path to passing, so you need to be comfortable moving through a network, not just attacking a single isolated machine.
Pivoting is more than running a tunneling tool. It’s using one compromised system as a new vantage point. Once you have access to a host, the question becomes: what can this machine see that I couldn’t see before? Internal services? Additional subnets? Domain resources? File shares? Credentials? Trust relationships? A foothold isn’t the finish line. It’s a new starting point.
The best way to get comfortable with pivoting is to practice it before exam day. Build a home lab with machines on different networks and practice routing traffic through a compromised host. Set up scenarios where one system can reach a network your attacking machine can’t touch directly. Practice scanning through the pivot, accessing web apps through it, transferring files, and catching reverse shells from internal hosts.
I’d recommend getting comfortable with Ligolo-ng for modern OSCP prep. It’s become the go-to pivoting tool because it provides a clean way to route traffic into internal networks. It takes several setup steps, so don’t wait until exam day or a stressful lab session to learn it. Build a copy-paste cheatsheet for starting the proxy, launching the agent, creating the tunnel interface, adding routes, and setting up listeners, and practice file transfers from different network positions.
As a backup, be familiar with Chisel too. It was the go-to before Ligolo-ng became popular, and it’s still solid. Knowing more than one option matters, since tools fail, binaries get blocked, and some environments favor one approach over another. Beyond both tools, it’s worth understanding the underlying concepts well enough to set up simple port forwards or tunnels manually when needed.
Port Forwarding
Port forwarding is closely related to pivoting but worth practicing on its own. Say a MySQL service is running on a target but only listening locally. You can’t connect to it directly from your attack machine, so you forward the remote service to your own system to enumerate and attack it with your normal tools. The same idea applies to internal web apps, database services, SMB, RDP, WinRM, or anything only reachable from a specific host.
The important thing isn’t memorizing a command. It’s understanding the direction of the connection: where the listener sits, what machine can reach what service, and whether your tools are running locally or through the pivot. Most pivoting problems come from confusion about traffic flow. Understand the network path and the commands get a lot easier to troubleshoot.
4. Practice Strategy
Practice became a lot more useful once I stopped measuring progress by the number of boxes I completed and started looking for patterns in my mistakes. It’s easy to treat OSCP prep like a numbers game: finish more machines, collect more flags, move to the next target. That helps build repetition, but it’s not enough by itself. Every failed machine should teach you something specific: was the issue enumeration, web testing, privilege escalation, Active Directory, pivoting, time management, or just not understanding the technology well enough?
The course material and labs should be your foundation. If you complete PEN-200 seriously, work through the labs, and do the capstones, you’ll be in a much better position than someone who only jumps between random practice platforms. Don’t skip the capstones. They force you to connect multiple skills together instead of solving isolated machines.
After the course labs, the best supplement is OffSec Proving Grounds, specifically Proving Grounds Practice, since its style is generally closer to the exam than most traditional CTF platforms. Hack The Box, TryHackMe, Virtual Hacking Labs, VulnHub, and similar platforms can all be useful, but their machines often feel different, more puzzle-like or CTF-like, and not always matching how OffSec designs machines. That doesn’t make them bad; they’re great for learning specific topics or shoring up weak areas. But if the goal is specifically OSCP prep, it makes sense to spend the bulk of your time on OffSec-created or -hosted material.
One thing worth knowing: Proving Grounds Play and Proving Grounds Practice aren’t the same. OffSec acquired Play from VulnHub, so a lot of those machines weren’t originally designed by OffSec. They’re still useful, but I wouldn’t treat them as the closest match to the exam. I’d prioritize PEN-200 labs, capstones, and Proving Grounds Practice first, then use other platforms to fill gaps.
When practicing, do full attack chains instead of only isolated techniques. Knowing how to exploit a vulnerable service is one thing. Enumerating a machine from scratch, identifying the likely path, getting a foothold, escalating, documenting, and reviewing what you missed is another. The OSCP rewards the complete workflow. Practice Active Directory, pivoting, privilege escalation, and reporting deliberately. Don’t assume they’ll “click” automatically on exam day. Build small labs, repeat common workflows, and make sure you understand what your tools are actually doing. For pivoting especially, practice until you can explain where the traffic is going, which host can reach which network, and how to troubleshoot when the tunnel doesn’t behave.
The most important part of practice is the review afterward. When you finish a box, don’t immediately move on. Ask what worked, what didn’t, what you missed, and whether there was a cleaner path. If you used a walkthrough, find the exact point your process broke down. Missed a port? Ignored a web directory? Failed to test credentials against another service? Ran the right tool but misread the output? That review is where most of the real improvement happens.
Two popular OSCP machine lists worth using as guides (not requirements):
5. Mindset
It’s a little nerve-wracking working the exam while a stranger watches you on camera and on-screen. Worse, you can’t see the proctor, and you don’t know who they are, where they are, or how often they’re actually watching. That gave me some anxiety early on, but I was able to put it out of my mind and just work.
Passing the OSCP takes technical skill, but mindset matters too. Persistence is necessary but not sufficient: if you keep repeating the same mistakes, effort alone won’t fix the problem. Staying calm, not comparing your timeline to anyone else’s, and treating frustration as feedback instead of proof you’re not capable all matter as much as any technique. I tried to keep an open mind throughout and kept telling myself I was going to pass.
6. Don’t Underestimate the Report
The report is part of the exam. You can compromise every machine and still create risk for yourself if your documentation is incomplete, unclear, or missing required evidence.
The report is no joke. Estimate how long you think it’ll take, then double it. Prepare your report template before exam day. I’d recommend starting from the OffSec-provided template, though I ended up changing quite a bit and cutting entire sections; I wasn’t impressed with it as-is. A lot of people recommend writing the report as you go, which is genuinely good advice. I wasn’t able to pull it off myself, but if you can, it’ll save you a lot of time the next day.
I’m paranoid about file corruption or losing everything before submission, so a safe option is uploading the .docx to OneDrive, then opening it in the desktop version of Word via “Open in Application.” That gives you automatic cloud backup, and every change syncs instantly, which adds a bit of extra protection.
I build a checklist per target machine covering the proof and screenshots needed, then manually go through each machine and triple-check I have both the text value of the local/proof flag and the required screenshots, including the cat/type of the flag file and the whoami output.
7. Exam Strategy
In my opinion, knocking out the AD set is the most important goal of the exam. If you don’t get the AD set, you need to fully compromise the remaining three standalone machines instead, so it’s critical to get started on AD promptly, since it can be a lot of work. The AD attack surface looks large, but if you think about it in steps, first how the foothold will likely work and then how privilege escalation likely works, there really aren’t that many options to consider at each stage, which helps more than it hurts.
I like a simple mindmap I found from Emmanuel Solis. In the context of the OSCP specifically, there aren’t that many realistic options for an initial foothold or for privilege escalation, and I referred back to it multiple times. I also used WADComs to think through what I had and what I could do with it.
[Image: Emmanuel Solis’s Active Directory Pentesting Notes mindmap]
Orange Cyber Defense also has a well-known Active Directory mindmap worth having open during the exam. It’s useful because it lists the tool for each exploitation step, including the actual command to run. Both AD mindmaps are useful in their own way; sometimes it helps to have a simpler image to think in more basic terms.
[Link: Orange Cyber Defense AD mindmap]
There’s also an excellent set of mindmaps from emVee-NL, including a detailed Active Directory mindmap built in Obsidian with a downloadable file. It’s extremely detailed and a little hard to read, but genuinely useful. They also have an Active Directory Enumeration with PowerView mindmap, and their GitHub repo has mindmaps covering file transfer, pivoting, web application pentesting, privilege escalation, and more.
[Link: emVee-NL mindmap GitHub repo]
Keep in mind not every exploitation step in the AD chain is actually an AD-specific exploit; you’ll likely need basic exploitation and privilege escalation techniques along the way too. Going from MS01 → AD machine 1 → AD machine 2 → DC won’t necessarily be linear; you may need to pivot immediately or backtrack to another machine.
Some people say BloodHound is overkill for a network as small as the OSCP AD set, but with limited time, any help toward DC compromise is worth it.
My recommendation: focus fully on the AD set until you’ve made real progress. If you get genuinely stuck, move to one of the other three machines and look for the easiest foothold. To pass, you only need one full machine compromise plus one additional foothold. Identify the easiest foothold among the three standalone machines early.
8. Recommended Tools and Resources
This list isn’t exhaustive, and tools alone won’t get you through. The value is in knowing when to use them, why they work, and how to troubleshoot when they don’t. To avoid overwhelming myself with browser tabs, I kept only my OneNote cheatsheet, HackTricks, PayloadsAllTheThings, and the PEN-200 PDF open at any given time.
Communities
- OffSec Reddit
- OffSec Discord
Privilege Escalation and Windows Privileges
- Priv2Admin
A useful reference for understanding Windows privileges shown by whoami /priv and how certain privileges may lead to local privilege escalation or other sensitive actions. This is especially useful for privileges such as SeImpersonatePrivilege, SeBackupPrivilege, SeDebugPrivilege, and others. I also want to continue learning more about Windows tokens, token creation, impersonation, and how these concepts relate to privilege escalation. - Juggernaut Security: Windows Privilege Escalation
Detailed Windows privilege escalation articles with practical examples and multiple techniques. - Juggernaut Security: Linux Privilege Escalation
Linux privilege escalation examples covering common misconfigurations, enumeration steps, and exploitation paths.
Active Directory
- Juggernaut Security: Active Directory Hacking
Practical Active Directory attack content, including enumeration, exploitation, and privilege escalation concepts. - WADComs
An interactive cheat sheet containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.
Web Exploitation and Payload References
- PayloadsAllTheThings
A large collection of useful payloads and techniques for web application security testing, bypasses, privilege escalation, and general pentest scenarios. - PayloadsAllTheThings: Web Version
The web version of the same project, which can be easier to browse quickly. - Reverse Shell Generator
A helpful reverse shell generator for quickly building payloads in different languages and formats. - HackTricks
A broad pentesting reference covering web, Linux, Windows, Active Directory, cloud, privilege escalation, and many other topics. This is one of those resources that is useful when you know what you are looking for, but it is important not to blindly copy commands without understanding them.
Writeups and Technique Research
- Hacking Articles
A large collection of detailed writeups. Many articles show multiple ways to exploit the same issue using different tools, which is useful when one tool does not work or when you want to understand alternate approaches. - Ben Heater: OSCP Prep
A collection of detailed writeups from platforms such as Hack The Box, TryHackMe, OffSec Proving Grounds, and VulnHub. - IppSec.Rocks Searchable Video
A searchable index of IppSec’s hacking videos. This is extremely helpful when you are looking for a specific technique, service, or technology and want to find where it appeared in a walkthrough.
Cheatsheets and Mind Maps
- OSCP Pentesting Cheatsheet
A useful OSCP-focused command cheatsheet. As with any cheatsheet, the goal should be to understand the commands rather than just paste them. - eMVee-NL MindMap Collection
A collection of mind maps covering topics such as Active Directory attacks, PowerView enumeration, pivoting, web application attacks, Windows privilege escalation, Linux privilege escalation, file transfers, and SSTI. These can be especially useful in Obsidian or other note-taking workflows. - Target Machine Enumeration Mind Map
A helpful mind map for when you are stuck on a target. It walks through possible enumeration and exploitation paths and can help force you to revisit areas you may have skipped. - Orange Cyber Defense Mindmaps
Extremely detailed AD mindmap organized by category. This is really a game changer and even shows how to exploit one technique with multiple tools. - Emmanuel Solis – AD Mindmap
This is a much more simplistic Active Directory mindmap that helps us look at the bigger picture and think about what our options are for an initial foothold and privilege escalation.
Living off the Land
- LOLBAS: Living Off The Land Binaries, Scripts and Libraries
A reference for Windows binaries, scripts, and libraries that can be abused during assessments. This is useful for understanding native Windows functionality that may help with execution, download, evasion, or other post-exploitation tasks.
Closing
Overall, I’m happy with the OSCP experience. It was discouraging at times, and there were moments I wanted to give up, but I pushed through and got it done. Some people are critical of the PEN-200 course and point to alternatives like HTB’s CPTS or TCM Academy’s PNPT. Both are genuinely high-quality programs, and I’d recommend the study material from either. But they still carry less name recognition with employers and less stringent proctoring than the OSCP. I’d still recommend pursuing the OSCP.
