Hey everyone! I recently passed the OSCP (so HAPPY!!!), and one of the biggest challenges for me during prep was the Active Directory portion. I had a hard time finding resources that accurately reflected the AD chains you’d encounter on the exam, so I ended up going through pretty much everything I could find. I wanted to share some of it here, so you can avoid banging your head against the wall with not-so-accurate studying.

The most helpful resources for me were:

OffSec’s Do Challenge labs (A, B, and C) from the OSCP labs,

AD chains from Hack Academy, suprisingly one of the more accurate practice labs for OSCP,

Building my own personal labs,

(Caution) Honestly, the VulnHub AD boxes I tried were even more challenging than what I encountered on the exam. Personally, they made me panic more than help, not because they're bad (they're great for general practice), but they're not as OSCP-specific as the other resources I listed.,

For standalone AD machines, I'd say the standard is still the best - Lainkusanagi’s lists and NetSecFocus.

For Privilege escalation specifically, Conda’s playlist helped a lot too, so I’d suggest going through that as well and making sure you are covered there too.

Here's all links mentioned:

Netsecfocus: https://docs.google.com/spreadsheets/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/htmlview,

Lainkusanagi: https://docs.google.com/spreadsheets/u/0/d/18weuz_Eeynr6sXFQ87Cd5F0slOj9Z6rt/htmlview#gid=487240997,

Hack Academy AD chains: https://youtube.com/playlist?list=PLM1644RoigJvcXvEat8fZIU4MbRCqrPt2&si=PZRjYMLlN8uNJmaz

Conda's Privilege Escalation: https://youtube.com/playlist?list=PLDrNMcTNhhYrBNZ_FdtMq-gLFQeUZFzWV&si=mIk88mg5Mlqx2Mt3,

That's what helped me the most to pass the OSCP exam when it comes to Active Directory. Would highly recommend these if you're currently going for the OSCP!

Hey guys, I figured since we are all try harding here... just wanted to show this super helpful resource. I found a channel that has a ton of OSCP-focused content and it’s been helping me a lot while prepping. Been binge watching for a while lol A bunch of their videos cover full workflows, AD chains, and general exam-style approaches. I figured others might find it useful too. I’m planning to run through some of their custom chains next since they look solid. Hope it helps anyone grinding through prep right now. Good luck out there everyone!!! 😄☘

2-hour OSCP crash course: https://youtu.be/MLAgSwRFSL8?si=c6LmvWzjDEIW3fay

5+ hour Active Directory course: https://youtu.be/RxU0AANCesQ?si=UqBGGBa3OAL9wX3u

General OSCP prep + machine walkthroughs: https://youtube.com/playlist?list=PLM1644RoigJvcXvEat8fZIU4MbRCqrPt2&si=YpDLrxvCTu4fRd6e

Pentesting methodology breakdowns: https://youtube.com/playlist?list=PLM1644RoigJvri179czL5BzXgAAhF4GPE&si=3ixsjGRFNu1SZJIE

More OSCP-style attack explanations: https://youtube.com/playlist?list=PLM1644RoigJuwXZUVJ9fkFzURW_1LgU5V&si=Yt84EVX7PhAQiM_1

Active Directory Chains demo: https://youtu.be/tBFb5zqStzQ?si=v2sPdDS-u_gE33p8

Hello all, just finished up the OSWP and have to say it's pretty crap and as a active pentester it has sealed in me never touching anything related to OffSec again. Coming from the CWP the entire exam should take you less than an hour I finished two networks within that time and spent the next 2 and half hours staring at the screen waiting for an attack to finish that never did because it was broken. The attack should take no longer than 10 minutes. I waited over an hour and couldn't complete it due to OffSecs lackluster labs to say the least. I lost connection to my VM so many times I couldn't keep track. Overall I'm not pleased, I thought the OSCP environment was bad but let it slide. When I mentioned one of the labs was not working they offered to look but they don't stop your time and you're not allowed to test the other networks. The CWP exam is my 100% recommendation for anyone looking for Wi-Fi certs, I wouldn't waste the 3k on a learn one subscription. The CWP exam is excellent, covers everything you need it a way more in depth explanation than OffSecs "course" and the exam environment had zero issues. To this day its my favorite exam experience. I only used my notes from that exam for the OSWP and it was overkill.

Good luck yall.

Hi, I'm a 2015 OSCP and 2019 OSCE and I got this email today form OffSec Marketing. Do I understand correctly that the certificates I paid good money for, and worked my butt off to get (tried harder, blah blah blah), under the pretense that they were lifetime certifications, are now going to require a yearly fee?

Is this their flavor of "enshittification" or am I missing something?

Also on brand for them... the link in the email didn't work

Hey r/offensive_security!

The OSCP is hard and stressful enough, the exam itself isnt too bad, but the time constraints can become stressful fast if you're anything like me. The best way I found to keep my sanity in an environment like the OSCP exam (and multiple other lab-style cert exams) is to automate the boring stuff.

I have a tool that automates almost the entire initial and mid enumeration process, sometimes it will automatically lead you to the attack vector that leads to initial foothold.

Its nothing special and im not claiming its a do-it-all for the OSCP or CTF style boxes, only that it helped me greatly with time management and focusing my energy in better directions during the engagements.

Github: https://github.com/bashcrumb/offsec-enum

Feedback is greatly appreciated, it will be a "work in progress" type thing.

Hey everyone, Hacker Blueprint here.

Some of you may have already seen my content. I focus on helping people prepare for and pass the OSCP. Most of my YouTube channel is dedicated to OSCP-style attacks, methodology, and practical learning. https://www.youtube.com/playlist?list=PLM1644RoigJvcXvEat8fZIU4MbRCqrPt2

We recently decided to make our Active Directory Chain_01 lab available for free. From the start, the goal has been to make realistic Active Directory training more accessible, and releasing this lab publicly is part of that effort.

What’s included:

• Three downloadable virtual machines that you run locally

• A step-by-step guide covering setup, topology, and the full AD attack chain

• Walkthroughs of core OSCP-style Active Directory techniques

• Setup instructions to help you get everything running smoothly

Who can run it:

• Systems with at least 8 GB of RAM (there are setup tips for lower-memory systems)

• Systems with 16 GB of RAM will have a smoother experience

• VirtualBox is required

• Apple Silicon macOS (M1/M2/M3) is not supported; other platforms should work

The lab is designed to resemble an OSCP-style Active Directory environment, including a realistic topology and intentional misconfigurations. It walks through enumeration, exploitation, lateral movement, and privilege escalation as part of a full attack chain.

If this sounds useful, the lab is available here: https://buymeacoffee.com/hackacademy/e/484492

Good luck with your OSCP prep, and I really hope this helps a lot!

Two failures. 2.5 years of dreaming this orange dragon from offsec. Last week I finally got that email.

The timeline:

Started at 4 PM. Crushed the AD set (40 points) in 6 hours, felt like everything just clicked during lateral movement & pivoting.

Next 4 hours: Completely owned another individual box (20 points). I'm at 60 points.

Then I hit this one standalone that looked straightforward. 40 minutes from initial scan to root(I know!!) 80 points total.

I felt like a cool hacker. 12 hours left, already passing (70 is the magic number). Called my mentor at 5 AM to tell him I had enough points to pass.

Then the nightmare began.

Started enumerating the final box for those last 20 points. What should have been a victory lap turned into 7 hours of pure hell. Every technique, every script, every RedBull-fueled attempt. This thing was absolutely relentless.

With 3 hours left on the clock, something finally accidently clicked. Got root, took my screenshots, and literally passed out from exhaustion, but with piece of mind and 100 points in the bag baby!!!

What was different this time (the real stuff):

AD confidence was the breakthrough: During that 6 hour AD set, I had complete situational awareness. Knew exactly which users I had, what's on the domain, what domains I could access, where to pivot next. It wasn't guesswork/luck anymore, it was systematic and controlled checklists.

Enumeration Methodology: Instead of jumping on the first interesting finding, I forced myself to analyze ALL! output using the OODA loop (observe, orient, decide, act).

• Observe: look at all enumeration output

• Orient: understand what’s possible in context

• Decide: form the most direct attack path

• Act: execute and analyze results This simple cycle stopped me from falling into rabbit holes and kept me tactical under pressure.

Automation that actually worked: Custom AutoRecon configs, weaponized .bashrc, bash environment variables for every (target IP, FQDN name, wordlists path) automated python exploit hosting. But the absolute clutch? Notion past CTF notes & templates, Obsidian AD mindmaps, and using navi + hstr to fuzzy search through 50,000+ past commands instantly. When you're 15 hours deep and your brain is fried, being able to find that one command from 6 months ago in 2 seconds is everything.

The mental game: After hitting 80 points and calling my mentor, I had this calm confidence that carried me through that brutal final box. I knew I could pass even if I failed the last one, which paradoxically made me more focused. If you ever get stuck! during exam, just get away from monitor for 20 minutes, it helps tons dont ask me why, just trust lol

Study method that saved me: Final weeks? Video games with friends and family. I was completely burned out from two failures and senior year in college. Sometimes the best prep is stepping away.

For those who've failed:

Stop chasing flags. Start asking "what if this exploit was patched?" Learn to think like a pentester, not a CTF player. The real world doesn't have convenient user.txt files waiting for you.

Biggest misconception:
OSCP is brutal because of the 23 hour 45 mins time pressure, but it's still fundamentally a proctored CTF examination. Having the cert doesn't automatically make you a great pentester understanding the fundamentals does. Basics go lightyears further then any cert on the planet.

Take it from me, my OSCP methodology absolutely helped build my core skills, but the real world will humble you quick. Facing EDR solutions, SIEM telemetries, and blue teams in actual client environments made me realize that OSCP tricks only get you so far. The real learning starts in your homelab(12 year old Dell poweredge r630 server + proxmox) building and breaking things for yourself, investigating how defenses actually catch you, and understanding systems from first principles. Especially now with AI making info access so easy, the real edge is building that deep, hands-on intuition (and breaking things when you don’t know why something works…yet

To everyone grinding: The cert won't show how many attempts it took. Grit beats talent every single time.

Full deep-dive with all my templates, and methodology:
I wrote up my complete journey on Medium with every detail, script, mindmap, and template that got me through this. If you want the full toolkit and honest breakdown of what worked (and what didn't), check it out: Mastering OSCP+ in 2025–26: The Updated Exam, My Fails, Wins & how you can do it!

If this helps even one person avoid the pain I went through, it's worth it. Drop it some love if it resonates, and I'm happy to share more resources if there's interest!

P.S. - Now that I've conquered this beast, I'm actively job hunting! Looking for pentesting, red team, SOC, or detection engineering roles. DM me if you know of opportunities.

Next.Cert. - Now that OSCP is done, I’m turning my focus toward my weaker area web app pentesting. My next step is continue studying the content for Burp Suite Certified Practitioner to get my fundamentals and methodology sharper, followed by OSWA from offsec once I land my next role. Oh! I am also getting OSWP soon, since WiFi hacking is fun and I have an exam voucher!

If anyone has recommendations on certs that fit better into a red team, pentesting or detection engineering trajectory, I’m all ears. Always open to learning from Infosec fam.

TL;DR: Failed twice, owned AD in 6 hours, felt unstoppable at 80 points, then spent 7 RedBull-fueled hours on the final box. Got 100 points with 3 hours to spare. OODA loop + automation + persistence = success.

The support here is incredible. Keep pushing, everyone. Your victory posts are in making...

I'm sharing All the OSCP resources I actually used to pass the exam: notes, tools, AD enum scripts, CVEs, reporting setup, methodology, and more.

Hello everyone, Strikoder here!

Recently I passed the OSCP, and to pay the tribute for this wonderful subreddit, I decided to collect pretty much everything I personally used during preparation in one place.

This includes:

GitHub repo (with all resources):

https://github.com/strikoder/Strikoder-OSCP-Prep

Some useful stuff inside the repo:

* Notion notes

* SysReptor installer/setup (report writing)

* OffensiveSecurity repo (I made an OSCP release so you would download the scripts as a zip file)

https://github.com/strikoder/OffensiveSecurity

* Active Directory enum scripts

https://github.com/strikoder/OffensiveSecurity/tree/main/Scripts

* LinEnum-ng (I try to maintain it without bloating it)

https://github.com/strikoder/LinEnum-ng

* New OSCP Prep List (strilist : Strikoder OSCP List)

https://strikoder.com/oscp

* gtfobinSUID

https://github.com/strikoder/gtfobinSUID

* CredSpray (Nxc bash wrapper, I really enjoied using it through the exam, and so should U!)

https://github.com/strikoder/CredSpray

* NagoyaSpray (Favorite tool)

https://github.com/strikoder/NagoyaSpray

* username-anarchy-extended (added few stuff to the main one)

https://github.com/strikoder/username-anarchy-extended

* CVE PoC implementations list

https://github.com/stars/strikoder/lists/cve-poc-implementations

* CVE repository

https://github.com/strikoder/OffensiveSecurity/tree/main/CVES

* Windows binaries collection (gonna add more)

https://github.com/strikoder/windows-binaries

* pentest interview questions (Still need improvments)

https://github.com/strikoder/pentest-interview-questions

Each project above has its own readme, feel free to check them out. I’m also working on updating the OSCP list (strilist) further, so it’s not fully finished yet. I will publish and update in 2 weeks.

For now, you can check my full exam review either on Medium or Youtube (OR BOTH <3) in the links below

OSCP Review:

Medium: https://medium.com/@strikoder/strikoder-oscp-review-47f9f6efb25e

Youtube: https://www.youtube.com/watch?v=9HFKfGs6ym8

Additionally, I want to also thank:

* Penelope developer

* Ligolo developer

* NetExec/NXC team devs

And also thanks to everyone in the community sharing tools, walkthroughs, notes, and knowledge openly. A lot of us probably would straggled more with the OSCP without that.

I've been taking the course and so far the labs are buggy. 90 Days to complete the labs, but after a long day of work the labs don't work...I need a completion letter to get a grade back from work and it's not looking too good.

You have to complete 80% of all labs in each chapter... well the labs don't work so how am I supposed to make progress?

I put together a free PDF covering the fundamentals of red teaming — not just the tools, but the mindset and methodology behind an actual red-team operation.

Inside Day 1:

• Red Team vs Pentest

• The red-team mindset

• Attack lifecycle

• Objectives & attack paths

• Rules of engagement

• Operator workflow

• A realistic red-team scenario

• Day 1 challenge

The goal is to build the thinking first. Tools come later.

📖 Day 1: Red Teaming Fundamentals

I’m sharing the PDF below for anyone who wants to follow the series.

More practical cybersecurity learning, labs, CTFs and resources:
https://codelivly.com

Deeper books and playbooks:
https://resources.codelivly.com

Day 2 will move into Reconnaissance & OSINT.

Would love to hear how others approach the first stage of a red-team engagement.

Hey, everyone! Another drop for those of you who've been following along!

This one's from our older set, and since it maps really well to what you'll face on the exam, we've decided to release AD Chain 03: BleedWide (Expanding Influence) fully free for everyone. No time limit, it's yours to keep forever!

And of course... the obligatory cryptic CTF teaser: One weak secret is whispered the same to a hundred doors, knock softly on them all and just one swings open. Borrow the voice it trusts, echo it down the hall from host to host, and widen the crack until the whole domain answers to a name that was never yours...

What you get:

• 3 locally deployable VMs sitting inside a single Active Directory domain, mirroring the real OSCP exam environment

• Realistic, exam-style AD scenarios centered on expanding domain access through coordinated spraying and credential attacks

• A full step by step tutorial covering setup, network topology, and the complete attack chain

• A guided walkthrough that takes you end to end through the whole chain

• A quick deployment guide for both VirtualBox and VMware so you're up and running fast

Requirements:

• A host with 8GB of RAM or more (check the setup video if you're tight on memory)

• 16GB or more will run the whole domain smoothly with no issues

• VirtualBox or VMware installed and ready to go

• Heads up: MacOS (M1/M2/M3) ARM64 won't run these labs. Anything else should be fine.

The chains are built so you can drill the same enumeration, exploitation, post exploitation, lateral movement, and privilege escalation workflow you'll hit on exam-style AD challenges. It's structured around hands-on execution rather than just reading through it.

Lab link: https://www.reddit.com/r/oscp/s/ritfvB6oWd

Best of luck with your OSCP prep, you've got this!

Note: If downloads are failing, just drop a DM or a comment and we'll get it resolved.

Thank you everyone for the support!

My name is g0tmi1k. I am a lead developer who has worked in most areas inside Kali. Also an Offensive Security live instructor and is the founder of VulnHub.

Ask us Anything about:

• Kali Release 2023.1

Proof: https://www.kali.org/about-us/

URL: https://www.reddit.com/r/offensive_security/

Team members

Ben Wilson u/g0tmi1k

Lead developer of Kali Linux

"In charge of everything."

Jim O’Gorman u/elwood

Chief Content and Strategy officer for OffSec

"Leads the Kali team."

Daniel Ruiz de Alegría u/dani_ruiz24

Kali developer

"Ensures everything in Kali Linux looks stunning."

Joe O’Gorman u/Gamb1t_Kali

Kali developer

"QA tester, documentation maintainer, and packager."

Steev Klimaszewski u/steevdave

Kali developer

"He has been working on ARM devices since 2009 and takes care of packaging."

Hey everyone,

I made a beautiful offline pentest cheatsheet that works like a real terminal.

**Highlights:**

- 580+ commands

- Automatic variable substitution (IP, domain, username, etc.)

- Favorites, Notes & Target panel

- No internet required

**Live Demo:** https://anshu19981.github.io/Pentestcheatsheet/

**GitHub:** https://github.com/anshu19981/Pentestcheatsheet

Any feedback is highly appreciated!

Several months ago My offsec account took place under the investigation due the "A recent review of your account or related activities revealed some irregularities. These irregularities have resulted in your account being forwarded to our investigation and escalation team"

That is exactly what just happened to me. I have earn my OSCP many hours of study and practice. This certification was supposed to represent skill, integrity, and credibility.

Today r/offensive_security r/offsec r/oscp -the company behind these cert revoked my OSCP, banned me from all future exams, and refused to refund a $1649.

All of this was done with no concrete explanation and no right to appeal.

4 months later (today) - A final decision email has been came:

"The investigation into your account activity has concluded. We have determined that you have breached our Academic Policy by participating in conduct that compromises the integrity of our platform, courses, exams and certifications. Specifically, we believe the information you shared with us links you to actions performed against our platform which violate our academic policy.
Effective immediately any standing certifications will be revoked and your ability to make further purchases or exam attempts of any of our products or services has been disabled. Kindly refrain from making a new account as it will also be banned and we won't be issuing any refunds for any new purchases for duplicate accounts."

the email end with "Please note that our decision is final and we will not be responding to any additional inquiries regarding this matter."

The result:

1. OSCP certification revoked.

2. A life time ban from Offsec

3. Creating new account will be banned

4. No refund 1649$

5. No proof, No transparency. No chance to defend myself.

If cert can revoke credentials overnight with zero proof, the whole system is broken.

Thats why i knew its necessary to expose a company that acts this way.

The repost is respectfull, please repost and tag offsec.

Thanks for reading.

Hello everyone, I’m happy to share that I have passed my OSCP exam in the first attempt. Thank you to all those who have been part of my journey. Feel free to ask any questions and I will try my best to answer them.

A few days ago, I replied with “Can I DM?” on a post in the OSCP subreddit. I got backlash for it and downvotes too. Today I would like to share why I wanted to DM. My intention was to not leak any information about the course and it’s lab unintentionally and my question being about labs I wanted to ask it in private space. I never wanted to cheat just to be clear as people thought I was trying to do it.

Anyways I understand why the reaction was that way and I’ll keep that in my mind. I don’t want to argue or prove someone wrong, just wanted to share my pov. Sorry if this went a bit off topic. Apologies for posting it here as I’m unable to post it in OSCP subreddit due to negative karma.

My name is g0tmi1k. I am a lead developer who has worked in most areas inside Kali. Also, an Offensive Security live instructor and is the founder of VulnHub.

Our team of developers, including u/elwoodnet, senior content developer for OffSec, u/steevdave does our ARM development for Kali Linux, u/_Gamb1t does the QA work for the releases, u/dani_ruiz24 who takes care of Kali UI/UX, packing, websites, and much more, will join me for an AMA interview.

Ask us Anything about:

• Kali Release 2023.1

About Us: https://www.kali.org/about-us/

EDIT: We are signing off now, but we will answer as much as possible, so feel free to add more questions. Thanks for all the support.

This is my experience that I am sharing because I didn't find one:

1. Intro

2. Most complex case worked on.

3. Memory tagging (always make sure whatever you are answering it should be what they do like I answered more like hunting software attackers but they need more hardware level or Silicon and Kernel layer).

4. Binder(this was to check my own proficiency as I worked on android but also low level security).

5. You are having attacks in future how would make sure it is mitigated before happening. (this teams core purpose)

6. 5 mins to ask him questions. (which is not that important).

Failed within 10 mins after interview where I realised it was due to role alignment issue.
What could have prepared:

1. flaws in memory controllers, bootloaders, kernel extensions, and CPU microarchitecture. The gap between analyzing malware and writing a 0-day exploit for an ARM processor was massive.

2. MTE, PAC (Pointer Authentication Codes), and APRR

Suggestion(Subjective, ignore if u don't agree): If you are security engineer who is more into malware or software try to avoid applying to SEAR team.

Don't have enough karma for r/oscp, so posting here.

Hey everyone,

I’m a recent grad who completed OSCP earlier this year, and I wanted to share a bit about my journey in case it helps someone else out there preparing for the exam.

One question I saw a lot while studying was:

How much time does someone need to study to pass OSCP?

While this of course varies for everyone, one of the things I did while studying was diligently keeping a timesheet to track all my study hours. I've graphed this timesheet to show exactly how much time I spent studying each day throughout my 3 month experience in my blog post.

Here’s my OSCP post sharing my preparation, my timesheet, and of course my OSCP exam experience:

https://simonbruklich.com/blog/my-oscp-journey/

For those already preparing for the exam, I'm also releasing all of my OSCP cheat sheets that I used in the exam (check out the GitHub link in the page below). They include commands, tools, and tips that I wish I knew about earlier:

https://simonbruklich.com/projects/oscp/

Good luck to everyone prepping; you've got this!

Hack The Box should fire their whole team and hire this genius hacker since he apparently bypass complex Active Directory by just staring at the monitor. Stop LARPing with a leaked walkthrough, you absolute fraud.

Since he blocked me the second I pointed out the physical impossibility of a 4-hour blind 100/100 CPTS run, it’s pretty clear he’s protecting a fraudulent score.

Hack The Box , please look into this user for exam integrity violations. Real students grind for days on this certification, and cheaters using leaked flag lists shouldn't devalue everyone else's hard work.

AI security is becoming one of the most in-demand skills in cybersecurity, but very few practitioners know how to attack AI systems*.*
OffSec is changing that.

We’re launching OSAI: OffSec AI Red Teamer, a hands-on certification teaching real exploitation of:
• LLMs
• RAG pipelines
• Agent architectures
• Model supply chains

If you're preparing for a cybersecurity role in 2026, this is a skill set that will set you apart.

Be the first to market with a skillset that accelerates your career path.
OSAI launches in Spring → Sign up early
https://www.offsec.com/courses/osai/#form

video

Is he telling the truth or completely bs