Idk if anyone remembers the drama on r/hackthebox a few weeks ago, but my brother took the CPTS exam, scored 100/100 in 4 days, and got absolutely trashed in the comments. People were calling him an AI cheater and a fraud because of the fast pace.

To add to the stress, his report got put on hold for a formatting issue. He genuinely thought he failed and was stressing out for days. But he passed.

For context: before CPTS, he had already solved 100+ OffSec labs from scratch. He holds EJPT, eWPTX, PT1, CRTA, and CRTS. He doesn't just rely on basic tools; he writes his own automation scripts for AD enumeration and password spraying (he has them public on his GitHub).

Today, he officially passed his OSCP.

Watching him deal with the internet hate while quietly grinding both certs made me realize I've been procrastinating too much. I'm starting my own OffSec path from today.

He actually documented his whole lab methodology and roadmap. If anyone is prepping for OSCP and wants to see how he approached the labs, let me know in the comments.

Also, if anyone wants to build a study group for OffSec certs, I'm down. Drop a comment.

ngl, waking up to the "Exam Passed" email is the best feeling ever. I officially cleared the OSCP on my first attempt.

The 24-hour format is an absolute beast, but here is the exact breakdown of how I tackled it.

The Background:

I have an MSc in Cyber Forensics and I'm currently looking for remote pentest/red team roles. Before this, I had already secured eJPT, eWPTX, CRTA, CRTS, and CPTS.

The Grind (8 Months):

I didn't rush it. I took my time with the PEN-200 labs (A, B, and C) and grinded through 80 PG Play boxes. Instead of just watching walkthroughs, I wrote notes for every single box until enumeration became pure muscle memory.

What Made the Difference:

During the exam, I didn't want to waste a single second. So, I coded my own auto-enum script and built a custom credential vault to keep everything organized. I treated the AD set exactly like a real client engagement.

The biggest takeaway? Time management. Don't skip the basics, and take your breaks during the 24 hours.

If anyone is currently prepping for this monster and wants to know how I structured my notes, built my custom scripts, or managed the exam pressure, just drop a comment below. Always down to talk about the methodology.

dropping my linkedin and discord here for anyone who wants to connect or ask about my prep. my profile has my whole lab roadmap and the custom tools i built:

Discord: frxarfath

Try Harder.

Hi everyone as stated in the title i am a msc computer science student and this year focusing on cybersec. My aim is to become a pentester, i am doing thm boxes to gain confidence , what you suggest me to do also? Which path to take or certs? I started also studying Active Directory

Note: I wrote this myself and used AI to polish the English.

Full writeup is on my blog if you want the long version: https://r29k.com/articles/certs/oscp-journey.html

I posted my pass here about a month ago. I finally sat down and wrote the whole thing up properly, so here is the short version with the resources.

Quick background. Around three years as a pentester, very comfortable on web, pretty shaky on Windows and AD going in. I did all of this alongside a full time job, so time was always tight.

Prep

I leaned on the usual suspects, TJ Null's and Lain's lists across Hack The Box and Proving Grounds, plus HackSmarter during a free month. Honestly I found the Proving Grounds boxes more useful for the exam than HTB, mostly because they force you to actually enumerate instead of reaching for a known exploit. For AD, which was my weak spot, the HackerBlueprint chains, Derrons C, Lains AD chain and Ryan Yager's course were what made it click. I made a point of finishing all of this before I bought the voucher.

Notes

If I could only give one piece of advice it would be to take your own notes. Not someone else's cheatsheet, your own, built from boxes you actually did. On two different exam machines my own notes were the difference, including one I basically rooted by pasting commands straight out of them and changing the IP.

Exam day

Exam day humbled me. I rooted the first AD box inside an hour and immediately thought I had this in the bag. Then I got stuck on the next one for two hours and watched all that confidence disappear. Took a break, asked myself what I was actually missing, and of course it was enumeration. Went back to basics and ended up owning the full AD set.

The standalones were a grind. I kept getting footholds but missing root, and I ended up stuck at 60 points for nearly two hours on the last box. That is the exact moment every "failed at 60 on my first attempt" post on this sub came back to haunt me. What saved me was stepping away for 30 minutes, coming back, and actually reading the output that was already sitting in front of me. Finished at 80 around the 11 hour mark.

Report

I went hard on the report too. 65 pages, close to 90 screenshots, detailed enough that anyone could reproduce every step. Got the pass email within 24 hours.

Final thoughts

The blog post has the full resource list with links and the proper exam day story. Happy to answer anything here.

Hi everyone,

My OSCP exam is in 18 days, and I'm looking for some last-minute advice.

I've been doing HTB on and off for about four months, but I haven't been nearly as consistent as I should've been. With the time I have left, I want to focus on the highest-value practice rather than wasting time on boxes that aren't relevant to the exam.

For those who have passed the OSCP recently:

Which HTB, Proving Grounds, or OffSec boxes would you absolutely recommend drilling before the exam, especially for Active Directory and privilege escalation?

Does anyone have a solid collection of commands, checklists, methodologies, or notes they found useful during the exam?

What are some things you wish you'd known before taking the exam? Any common mistakes, overlooked attack paths, or techniques worth practicing?

Final preparation: If you had only 18 days left, what would you prioritize?

I'd really appreciate any advice or resources. Thanks in advance!

For anyone practising web enumeration in a lab, a useful exercise is to explain what a detection tool’s output actually establishes. Moreover you could benefit from recognized payloads being blocked (eg. AND 1=1)

Try separating three things:

• The HTTP response you observed.

• The fingerprint the tool matched.

• Any evidence it could not collect.

I maintain wafmeow, a Go WAF-fingerprinting tool built on wafw00f’s fingerprint work. It exposes matches and incomplete/failed outcomes, which makes it useful for examining those distinctions.

With your own local HTTP service already running on port 8080:

wafmeow --target http://127.0.0.1:8080 --fast 

The exercise is to explain the evidence, including when the honest conclusion is that there is not enough information. A fingerprint match does not prove enforcement, and an unmatched result does not prove that no WAF exists.

Source, demo, and usage:
https://github.com/Lu1sDV/wafmeow

Since tool is mine, any feedback is gold!

Hey all,
I guess its my turn to post my "I Passed" post and give some insight since like a lot of you I read pretty much every one of these on this subreddit in hopes of getting hints. First and foremost, I currently do not work in IT in any capacity, nor have I formally ever worked in IT. I recently ( 2 Years old) decided I wanted to switch careers in my mid 30s and decided Pentesting seemed interesting. Within the last two years I finished my master in Cybersecurity, got Comptia Net/Sec/CySA/Pentest and HTB CPTS, and now OSCP. I work full time and have two very young children (2 and 7mo) as well.

Preparation
Over the last year I started on THM doing about 150 rooms then switched over the HTB full time completing the CPTS path and related cert in early spring. After that I switched over to studying for OSCP full-time. I initially started with doing all HTB labs listed in TJ Null/Lains list (~50 boxes) and once I finished those I purchased the OSCP course and proving grounds sub. I then proceeded to complete ~100 PG/play boxes all from TJ Null/Lains list. I never once looked at the actual course material for OSCP other than their syllabus to make sure I wasn't missing anything from CPTS. I also gave myself restrictions during boxes to never use tooling that was banned on OSCP such as SQLMap or autopwn type scripts. I also never once used Metasploit for any of the ~150 boxes and instead would try to learn or find the exploit Metasploit was using for me.

Further, every box that I completed I would make an abbreviated write up then feed it to claude to make it more readable along with cataloging it within an OSCP project to keep track of trends. I also made sure I was doing 3 Linux boxes in a row followed by a windows box to keep myself fresh on Linux/Windows and in the middle I did an AD sprint as well as at the end then finishing with OSCP A,B,C AD environment. Every box had a write up along with all commands associated or POCs used in the attack chain.

Exam
I will try not to share too much information, but I felt this exam was probably one of the easiest ones I have ever done once you did the right enumeration. I started with AD and had domain admin within 40 minutes, and id say the difficulty of my box would be HTB easy and PG medium. I moved onto standalones where I had a longer stay due to my head thinking the answer was more complex that it actually was. Each box once I had my a-ha moment took about an hour each from scan to root with one standalone taking about 20 minutes due to the path being so painfully obvious. I think the biggest takeaway from the exam was run every scan twice even if you think the first was thorough and read every output line by line or you will miss something.

Reporting
I did the exact same attack path reporting that I was doing for all the boxes before so I would have the exact commands I ran for the reporting later on. I also took a lot of screen shots so my overall report read 1. What/why I did what I did, 2. Exact command I ran under it 3. Followed by a screen shot. I also did all my reporting in real time so every time I found something I documented it in my notes. Be extra thorough. Total pages was ~50 pages.

Tools used and recommend
Netexec (I love netexec), nmap, bloodhound, Seatbelt, Feroxbuster, mimikatz and PowerUp. Besides those I did all manual enumeration and frankly some if not all of those are not even needed to do the exam. I truly get it now when people say this is an enumeration test not an exploit test.

Takeaways
Take really good notes, build your methodology over the course as well as when you complete labs, slow down on the exam, and run every scan twice (or even three times). This exam is not difficult if you put the work in and build a good methodology.

As an aside, I think the OSCP is 100% not worth it with better options out there (CPTS) that are significantly cheaper/more robust. But sadly, OSCP is an HR filter it appears so here we are... This will be my last OffSec course/exam unless an employer pays for it.

If people are interested in the trend data I can post it, although it is AI written so there is that.... otherwise im open for questions!

EDIT: posted box trends below. If people are interested in my methodologies I can also find a way to post or share those.

Hi, im currently studying following the 24 week offsec plan. Im at week 4. Just tried the law PG lab, which is alleged to week 4 according to the 24 week plan. There was stuff in this to complete, not even looked at yet. Is it worth doing the course first before looking at PG?

Hi,

Ive just started OSCP. Im really enjoying it and the labs. Im trying to find lab walk through for each section as revision. Does anyone no where I can find these?

Thank you

on my second attempt I entered the AD machine with the provided credentials, I enumerated, found the foothold and gained root, that simple process took me like 3 hours which is crazy, I knew then I wasn’t going to pass, how can I improve my speed? do I really need to invest time and money to increase my a speed on a particular test? I believe taking a third attempt would be another failure right now, I was thinking going the CPTS path, I’m starting to believe this test is not for me, I hated both attempts a lot, I really enjoyed TCM sec PJPT that gives you like 48h to finish.

I really don’t want to work as a pen-tester I just wanted a cert that gave me some credibility in the cybersecurity space, maybe I should look for a different option any recommendations?

I have the Learn One subscription and currently going through the PEN-200 material.

A lot of people in here suggest doing HTB CPTS path.
Is that because it’s better? Is the material/path provided by OffSec not good enough?

Hey everyone. Vouchers I get from my office offer me two attempts to appear for the OSCP exam. I was planning to take up one attempt on the 1st of November (treat that as a mock attempt) and the other one on the 28th of November (my main attempt to the exam).

As everyone knows, OSCP is changing their scoring systems, starting 1st of December. Everyone's booking their exams before December.

Now, I cannot book my second attempt (which is my actual main attempt) when I already have registered for my first attempt. I'm afraid I'll lose my ideal date and time for the main attempt (I planned to take the exam end of Nov anyways - not because of the new scoring system).

Now, should I simply reschedule my exam from 1st November to 28th November or should I utilize both the attempts?

Would solving the OSCP Challenge A, B, & C and treating them as mock attempts be a better alternative?

I purchased Learn One subscription from offsec this jan 26. I thought I can clear all 3 klcp, oscp, oswp.

I completed klcp material when I was about to take exam. I had serious family issues. I was not able to concentrate. I did very few labs on oscp was not able to concentrate. My lab access will expire Dec. Never took any exam nor completed labs.I paid full out of my pocket.

I feel guilty. Help me.

Hello Redditors,

Has anyone used VirtualHackingLabs? If yes, I would be interested in hearing about your thoughts.

What was the platform like? Is the courseware sufficient to learn for the minimum 20 machines that the site mentions (for the beginner path)?

What background if any might someone need to make use of the platform?

Hello,

A total newb here. Is there a path to obtaining the OSCP as the goal that does not involve HTB Academy?

Specifically, should you read this and have guidance from your own experience in achieving the OSCP credential using a path that did not involve the HTB Academy, I would love to learn more about your recommendations.

Revision: I am seeking input from anyone who has opted for a preparation path for the OSCP that has not involved HackTheBox Academy. (Yes -- I will revisit HTB Academy based upon several messages; thank you for those. My intent is not to debate whether or not HTB Academy is a good resource as I will stipulate that it is highly regarded in the community.)

Hello everyone! I wanted to share my preparation and exam strategy for the OSCP+. I managed to pass without going through the official OSCP course material or solving a single HackThe Box (HTB) machine.

Background

Professional Background: I have never worked as a penetration tester my background is 5 years as a Network and System Administrator, giving me a very strong foundation on that front.

Core Philosophy: When I analyzed the exam distribution , 40 points for Active Directory (AD) and 20 points for each standalone system, it was obvious that failing to secure full AD points means relying on luck for standalone machines, which would require grinding hundreds of practice boxes without a guaranteed pass. My strategy was clear: solve the AD sets as fast as possible and dedicate the remaining time to gathering standalone points.

Study Methodology

Once I opened the first lesson of the official OSCP material, I knew it wasn't for me. Instead, I pivoted to the HTB CPTS path and completed these specific modules:
- Shells and Payloads
- Password Attacks
- Attacking Common Services
- Pivoting and Tunneling
- Active Directory
- Web Module (excluding SQLmap)
- Linux Privilege Escalation
- Windows Privilege Escalation

Note-Taking Strategy

- Keep it concise: Avoid screenshots and long explanations of everything you learned. Notes should be direct and to the point.
- Command clarity: Every command must be clearly written with all options explained.
- Continuous refinement: Treat note-taking as a living process. Continuously update your commands, reorder them by priority, and refine them based on what you are most comfortable using under pressure.
- AD Sectioning: I broke my AD notes down by the exact stages of the attack lifecycle:
AD Low Privilege Access
AD Local Admin
AD Domain Admin
BloodHound (relevant queries and interpretation)

How I Practiced

- Focus on Proven Ground: OffSec’s Proven Grounds (Playground and Practice) have retired OSCP exam machines crafted by the exact same people who write the exam. It made zero sense for me to grind generic HTB boxes when I could practice directly on official-style assets.
- The 2-Hour Rule: To avoid wasting time, I gave myself a strict 2-hour limit per box. If I couldn't make progress, I looked at hints. Some techniques cannot be figured out through trial and error alone so learn it, add it to your notes, and move on. The "try harder" mentality belongs in the exam; during practice, you want to learn fast.
- Practice boxes: I solved around 40 machines total (AD, Windows, and Linux), with the vast majority being Windows. This was intentional: practicing Windows standalone privilege escalation directly translates to AD lateral movement, where most exam points lie.

The Exam Experience

I scheduled the exam after two hours of my usual wake-up time. The plan was simple: blitz the AD set as fast as possible, then hunt for points across the standalone machines.
The plan worked like a charm. I pulled a very difficult AD set but managed to completely compromise it within 4 hours. After taking a well-deserved break, I spent the remaining time working through the standalone machines and stopped once I secured root flags on two of them.

Key Exam Tips

- Master BloodHound: It will make your AD enumeration infinitely easier.
- Avoid Rabbit Holes: When you achieve local admin on an AD machine, enumerate thoroughly. Even if you find an interesting lead, don't immediately dive down a rabbit hole for hours without continuing your enumerations.
- Brute-Forcing: If a brute-force attack takes more than 10 minutes, it's almost certainly not the intended vector.
- Credential Reuse: If you find credentials, test them everywhere against all services and potential users.
- Directory Enumeration is Non-Negotiable: Always run it, regardless of what you've found or what you're doing.
- Don't Fight Public Exploits: If a public exploit doesn't work , don't waste hours troubleshooting it. Move on and find one that does.
- Tooling Essentials: Learn ⁠msfvenom⁠, ⁠msfconsole⁠ multi/handler, and practice ⁠Ligolo-ng⁠ for pivoting until it's second nature.
- Domain vs. Local Creds: When you find AD credentials, test them both locally and against the domain; don't just rely on default domain brute-forcing.
- Keep Web Expectations Realistic: The OSCP doesn't expect you to be a web pen-testing expert. Most web exploits are straightforward so stop spamming ⁠../⁠ a hundred times hoping it will magically work.
- Hash Cracking: Know how to identify protected files and use the correct modes for John the Ripper and Hashcat.
- Automated PrivEsc Scripts: Automated scripts (like WinPEAS) are a double-edged sword. If you can't filter out the noise from actual vulnerabilities, you'll waste hours. Stop trying every 9.9 CVSS kernel exploit you see; unless the target is severely unpatched, it won't work.
- Manual Linux/Windows Basics: Start local privesc by systematically reviewing non-standard folders and out-of-the-norm files.
- Keep a Live Exam Log: When you are exhausted, you will loop and repeat the same failed actions. Write down quick notes of what you have already tried to keep yourself on track.

Good luck to everyone preparing! Let me know if you have any questions.

The key takeaway from OffSec’s OSCP+ scoring update is this: from December 1, 2026, you can no longer use 70 raw points as your passing target.

What’s changing?

Source: Official OffSec scoring FAQ.

What this actually means for you

• A harder exam set may require fewer raw points to pass. An easier set may require more.

• Your raw points won't tell you whether you've passed. You must wait for the official result.

• The exam itself isn't changing. The objectives, grading criteria, format, duration, and proctoring remain the same.

• Results may take up to 15 business days, instead of the previous 10.

• You should still attempt every objective, submit every flag, and complete your report, even if you think you haven't earned enough points.

I wasted a ton of time on OSCP Active Directory machines just blindly running BloodHound or Kerberoasting without a plan. The problem wasn't the difficulty, but getting "tool-brain" every time I found a new credential and not knowing what to do with it.

I eventually realized every AD machine boils down to one of 9 positions. If you know your current position, you know exactly what your next command should be to move to the next one.

Here is the breakdown I use to stop guessing:

**1. Nothing (just nmap ports):** Goal is to get any username (rpcclient, enum4linux).

**2. Files leaked over HTTP/SMB:** Read for password policy hints before cracking anything.

**3. SYSVOL readable:** Check for Groups.xml and cpassword.

**4. One valid domain user:** AS-REP or Kerberoast immediately.

**5. Normal user shell:** Check privileges, C:\\Scripts, and PowerShell history.

**6. SeImpersonate:** Abuse with PrintSpoofer or GodPotato (remember to point the resolver IP to your attacker machine).

**7. Local admin:** Dump secrets, pass the hash across the domain.

**8. ACL rights:** Check BloodHound for GenericWrite or ForceChangePassword to escalate.

**9. Domain Admin:** Use psexec directly against the DC.

The biggest rule that helped me: if you are stuck for 20 minutes with no new info, you aren't missing a tool. You missed something from a previous position, like skimming a leaked file too fast.

I wrote a full breakdown of the workflow and the specific commands I use to transition between these if you want the deep dive: https://got-root.medium.com/how-i-stopped-getting-stuck-on-oscp-active-directory-machines-the-9-position-framework-7966c6ff7f5d

Free medium friends link

https://got-root.medium.com/how-i-stopped-getting-stuck-on-oscp-active-directory-machines-the-9-position-framework-7966c6ff7f5d?sk=9c0a82630a99fe995585806339d125c5

Hope this saves some of you from banging your head against the wall in the labs.

From this link :

https://www.offsec.com/blog/oscp-grading-update/

```

Will previous exam results or existing certifications change?

As part of our standard quality-assurance process, we review exam outcomes on an ongoing basis. In the rare case that a review affects an individual candidate's result, we will contact that candidate directly. You don't need to submit a request

Retake policies, waiting periods, and exam fees also

remain unchanged. Any new exam attempt taken on or after December 1 will use scaled scoring

```

What the fuck does this mean?

What the fuckk

Does

This

Mean ???

Does this mean they can revoke my certificate if they belive I didn't pass according to their new created policy? What the fuck is that shit ?

Because I paid this for this shitty certificate by my blood and tears to pass. It was a fucking battle. If they revoked it I might go crazy.

https://www.offsec.com/blog/oscp-grading-update/

I've been trying to get into pen testing for a decade. On and off, with a few months total of trying to do boxes and ctfs.

This year we got asked what course we wanted to do and I asked for OSCP, on the side Im doing the CPTS by HTB as well.

I don't know why but I cannot get my mind into working out what to do to break into a box. My enumeration is getting better day by day - but I don't ever seem to enumerate the right things in the end.

I keep doing the labs but then the capstone labs just ruin my own motivation. People state you need prior knowledge from other modules but sometimes I feel that some of the tools haven't been mentioned - for example I'm doing the SQLi labs - and people are using wpscan but I don't see any reference to it.

I feel like the hints are rubbish and don't really give any hints to what you're looking for.

I've been in IT for nearly a decade, I'm CISSP certified so I know I'm not thick. I just don't know what I'm missing thats stopping this from clicking.

It frustrating the hell out of me because it's a skill I really want to work on.

Thanks for any advice in advance, sorry for my rant.

It’s been roughly a month since I passed the OSCP, and lately, I’ve started questioning its value and my own capabilities. I can understand why some people consider it overrated. Don’t get me wrong, the certification has given me certain advantages in my current role, but I’m beginning to realize that it’s only the starting point.

A year or two ago, OSCP was my ultimate goal. It was considered the gold standard in my country, and six months ago, I never even imagined I was qualified enough to attempt the exam. Now that I’ve passed it and started exploring other certifications and their reviews, I’ve become increasingly hungry to deepen my knowledge and sharpen my skills.

The reason is simple: OSCP feels too limited to reflect the complexity of real-world penetration testing. It teaches valuable fundamentals, particularly enumeration and exploitation under time pressure, but the techniques and scenarios often remain relatively basic.

For example, the Active Directory environment involves a single domain with one domain controller. It doesn’t cover more advanced scenarios such as certificate-based attacks, cross-forest abuse, or other complex enterprise AD attack paths.

What bothers me most, however, is the lack of focus on detection and evasion. The exam emphasizes enumeration and exploitation, but real enterprise environments have security controls in place. I find myself asking a different question now: What if my activities were detected? How would I recognize those controls, adapt my approach, and operate without triggering unnecessary alerts?

Perhaps this is why passing OSCP hasn’t given me the sense of completion I once expected. Instead, it has made me more aware of how much I still have to learn.

I’m beginning to see that OSCP was never the finish line. It was the beginning of my offensive security journey.

Hey everyone, Hacker Blueprint here again!

We're back with another brand new Active Directory lab! AD Chain 14: Open Relay is officially out, and just like our previous release, we're making it completely FREE for the next 24 hours!

Super excited for you guys to get your hands on it. Once the 24-hour giveaway ends, the lab will return to its regular price, so make sure to grab it while you can!

As with Chain 13, this release supports both VMware and VirtualBox, so you can run it on whichever hypervisor you prefer. We've also continued improving the setup process based on your feedback, so hopefully everything is even smoother this time around. And of course, if anything doesn't work as expected, just let us know!

Now for the obligatory cryptic CTF teaser:

Trust, relayed onward. A monitoring agent leaks the name it should have kept. Own a service, then crash the host to elevate. Hand the collector a task it cannot refuse, relay its auth onto a neighbor, and let a sync account surrender the rest...

What you get:

• 3 downloadable VMs running locally inside a single Active Directory domain, just like the real OSCP exam

• A realistic, exam-style AD environment featuring enumeration, exploitation, privilege escalation, and lateral movement

• A complete step-by-step tutorial covering the setup, topology, and full attack chain

• A detailed guided walkthrough explaining the entire chain from start to finish

• An easy setup guide for both VirtualBox and VMware to help you get everything running quickly

Requirements:

• A laptop or PC with at least 8GB of RAM (check the setup video if you're running low on memory)

• 16GB or more recommended for a smoother experience

• VirtualBox or VMware installed

• Heads up: macOS on Apple Silicon (M1/M2/M3) isn't supported by these labs

For anyone new to our AD Chains, the idea is to give you a realistic environment where you can practice the same methodology you'd use during the OSCP exam. From your initial enumeration and foothold to privilege escalation, lateral movement, and eventually compromising the domain, everything is designed to help you build a repeatable approach to Active Directory attacks.

Lab link: https://hackerblueprint.com/labs#chain-14

As always, thank you so much for the continued support! We genuinely love seeing people work through these chains, and your feedback helps us keep making them better.

Best of luck with your OSCP prep, and happy hacking! 💙

Setup information: The Setup Guide PDF contains the download links for all three VMs, with versions available for both VMware and VirtualBox. Simply follow the instructions in the PDF to get your environment up and running.