 [link] [comments] Passed OSCP - My Experience Originally, I was leaning against doing an obligatory post-OSCP Reddit post because I didn't want to come across as another "look at me - I passed OSCP!!" cringeworthy OSCP Oscar speech, but I decided to go ahead and do one because my experience was perhaps a little unique and answers the much-asked question "can I do OSCP without experience?". A quick background to add context... I'm 00 years old and my employment history is a mixture of sales, graphics, and media-related job roles. I felt discontented for a long time earning (barely) living wage in job roles I had little passion for. Anyway, to cut a long story short, I decided to quit my latest sales job in November last year (0000) to pursue a career in cybersecurity/infosec. I didn't know what ‘TCP' or ‘UDP' was, and I'd never heard of ‘Kali' or how to run a VM, but I was convinced that this would be the career path for me. Anyway, I went through Security+ and C|EH from November to March and, just as I was going to start applying for Security Analyst type job roles, our friendly neighbourhood Coronavirus came along and shut down the economy. Even though I had no intention of doing OSCP for another year or two, I thought it was a better option than twiddling my thumbs for a few months, so I decided to sign up for PWK labs and have a crack at it. Fast-forwarding to yesterday, after a few brutal months and an incredible experience, I finally got the OSCP "you have successfully completed" email. Apologies in advance for the essay but I just want to go through my journey for those of you that might be in a similar position to the one I was in - limited/zero IT experience and feeling intimidated by the dreaded OSCP mountain. My journey... In the weeks leading up to the wait to start my 00 days PWK material and labs, I went through The Cyber Mentor's Practical Ethical Hacking Udemy course and then went on a Hack the Box rampage, so, by the time my lab time started, I felt like I was in a pretty decent position. Unfortunately, because I was a naïve idiot, I tackled the labs straight away and went through the PWK PDF casually on the side. This was a big mistake and something I would definitely change in hindsight because it cost me 0 easy points on the exam (I thought I could smash through the PDF exercises during the last week of labs but this didn't prove to be enough time). In 00 days I ended up rooting around 00 machines - I didn't bother going for the networks because it didn't apply to the exam and, although valuable real-world experience, I didn't want to get distracted and flood my brain with even more information when it wasn't going to be relevant for my mission. One big thing that I did get right was note-taking. I can't express enough how valuable it is to take detailed notes and build your own cheat sheet library. After every machine I rooted, I did a walkthrough on OneNote and added any new tools/commands to my cheat sheet library. This not only saves precious time in the exam, but it helps you build your own knowledge instead of relying on other people's cheat sheets without really understanding what you're doing. After my 00 days had finished, I spent 0 month on TJ Null's OSCP Hack the Box list and IppSec's video walkthroughs. I also can't stress enough how valuable this learning methodology is. My only regret is that I rushed through it. I'd already booked my exam 00 days after lab time, so I ended up jumping through walkthroughs when I got stuck on boxes instead of exhausting all options. This was another naïve idiot mistake on my behalf and something I would do differently in hindsight. There's a difference between "trying harder" and "trying harder, but in a smart way". I was putting 00+ hours in every day but I wasn't always being efficient with my time. I'd definitely recommend seeking hints and tips on boxes but only after you've exhausted all options first, something which I didn't always do. Anyway, my first exam attempt came around towards the end of July. Was I ready? No, but I had delusional confidence in myself that has paid off for me more often than not, so I was hoping it would pay off for me again. My first exam was brutal. I sat in my chair for a total of 00 hours and 00 minutes, with only 0 short 0-minute breaks to get food to snack on. My VPN was shut down after 00 hours and I had a total of 00 points, which I'd been stuck on for the last 0 hours of my exam. I got the BO, root on one of the 00-point machines, root on the 00-point machine, and user on the other 00-point machine. I just couldn't get root on that last machine. I was pretty devastated because I'd put my heart and soul into Sec+, C|EH, and OSCP for 0 straight months and I wanted it bad. But my delusional confidence wasn't enough. After listening to depressing Taylor Swift songs for a few days (joke), I decided to book another exam in, 0 weeks after my first attempt. This time around, I decided to go through Tib0rius's Linux and Windows Privilege Escalation courses (they were great) and go back over some of the HTB machines. I honestly felt at this point that there wasn't much more study material that I could go through. 0nd exam came up and it was an almost minute-for-minute repeat of the first exam. BO done, 00 point rooted, 00 point rooted, but could only get user on the other 00 point. 00 points again. This time I ended up listening to Taylor Swift + Lana Del Rey. I was pretty adamant that I could do this and that I was very close, so I sent Off-Sec an email explaining my situation and they were kind enough to allow me another exam attempt without waiting 0 weeks - I booked another exam in 0 weeks after my second attempt. This time, my preparation was entirely mental. In both my prior exams, I was sat on my chair for over 00 hours because I was flapping around aimlessly like a headless chicken, desperately firing off exploits that I knew wouldn't work on the other 00-point machine. So, I went into the 0rd exam determined to go at a slow and steady pace, and not let the 00-hour timeframe pressure me into a wild goose chase. Miraculously, it seemed to work. After 00 hours, I'd done the BO, rooted both 00-point machines, rooted the 00-point machine, and got user on the 00-point machine. 00-ish points in total. The point of this story is to get across to people that you need to try simpler, not harder. I perhaps failed my first exam because I'd not gone through Tib0rius's Priv Esc courses, but I failed on my 0nd 000% due to mentality. There was no skill-level difference between my 0nd exam and 0rd exam. I'll finish off with my recommended learning methodology and exam tips (for people with limited/zero IT experience): . The Cyber Mentor Practical Ethical Hacking Udemy course (usually on offer at $00.00-ish) . Tib0rius's Linux and Windows Privilege Escalation course (usually on offer at $00.00 each) . Try Hack Me OSCP Learning Path (I would recommend doing this before HTB - it is $00 for 00 days) . PWK labs (I personally don't feel more than 00 days are required - unless you work full-time) . TJ Null's OSCP Hack the Box list ($00 for retired HTB machines - very worth it) . You should be ready for the exam Exam tips: . Become proficient with Nmap but use an enumeration tool like nmapAutomator for the exam . You will need to understand what bash and Python scripts are doing (you don't need to be able to write them from scratch) . Don't be tempted to use a fancy BO methodology for the exam, stick with PWK's methodology - it works (some of the others don't) . Play around with various reverse shell payloads - sometimes a bash one-liner won't work so you need to go with Python. Sometimes Bash, Python, and netcat won't work, so you need to understand what alternatives you can use in that scenario . Get into the habit of reading service manuals. In all 0 of my exams, I came up against machines that had services I'd never even heard of. Fortunately, I'd got into the habit reading service manuals, otherwise, I would have skipped over the services and got lost down a rabbit hole . Get into the habit of exploiting conventional services in unconventional ways. Just because an SUID binary isn't on Gtfobins, it doesn't mean that you can't exploit the SUID binary in an unconventional way. Again, get into the habit of reading manuals to understand what services do . Become familiar with Burp Suite. Many exploits won't work in the way you might expect them to, but they will work if you run them through Burp. Or, at the very least, you'll be able to understand why they're not working. This issue came up in my last exam and I would have been completely lost if it weren't for Burp . Take breaks if you get frustrated - this is said over and over again by people on this subreddit and it's an absolute must. The 00 point machine that I couldn't root after 0 hours on my 0nd exam was on my 0rd exam (thanks Off-Sec - I know you tried to fu*k me with that), but I was able to root it within 0 hour on my 0rd exam, simply because my mindset was different at the time. . Trust your gut - by doing PWK and HTB machines, you should develop a gut feeling of when you are in a rabbit hole and when you're on the right track. I ended up rooting over 000 machines before the exam (albeit with plenty of hints and tips) and it helped me develop a good gut feeling. I can't explain why but there were times in my last exam where I knew I was in the right area even though I wasn't able to enumerate the specific service version. This feeling simply came from experience. I'm sure many of you watch IppSec's videos and wonder "how the hell does he know to do X or Y?". I used to wonder this all the time but after going through dozens of machines, I finally got it. It comes down to experience. Try to do as many machines as you can before the exam to build that gut feeling, and trust it in the exam. . Embrace failure - this is perhaps the most important thing that I can say. OSCP is a difficult journey and many people fail multiple times before passing. And you know what? That's okay. It's okay to fail. It's how you react to failure that counts. I'm not particularly smart but I embrace failure and I know deep down that I will keep trying until I pass. I was prepared to take the OSCP exam 0000 times if I had to, I was never going to let the exam beat me. I suggest you approach it with the same mentality and not let silly pride prevent you from having a go at it. One last thing! Join a solid Discord community. This journey has been amazing since day one and a big reason behind that is the amazing online community. I was very active in an HTB community and ended up talking to several people who were going through OSCP at the same time as me. This was honestly such a massive help to me because I didn't know what the hell I was doing when I first started! Sorry for the massive rant - I just see so many people on here treating OSCP like an unsurmountable mountain. It's not. You can do it! submitted by TheCrypt0nian to oscp [link] [comments] 