Offensive Security Certified Professional Review

1. Introduction
There are tons of certification in cybersecurity, for example, CEH, Security+, CISSP....but OSCP is known for its hands on experience and 24 hour exam.

2. Before OSCP....

2.1 Material recommend
There are some resource I would like to highlight before really step in OSCP's course. Although OSCP is the entry level cert in offsec, it still have lots knowledge Offsec expect people knows.
Vulnhub: contain lots vulnerable machine, can download and do it locally
https://www.vulnhub.com

Hackthebox: Need VPN to their network, similar to OSCP's lab, really good resource before OSCP
https://www.hackthebox.eu/

2.2 Course Intro
Official Sire is https://www.offensive-security.com , and before take exam, need to take their PWK course, here is syllabus https://www.offensive-security.com/documentation/penetration-testing-with-kali.pdf

Course have three types: Course + 30/60/90 days lab, can be found here:
https://www.offensive-security.com/information-security-training/penetration-testing-training-kali-linux/
The only difference is days of lab, personally will recommend take more than 60 days, you may found time is not enough for lab if you go for 30 days option.

Course contain PDF and video, basically is really similar. It shows the basic of pentest concept and knowledge you need to know.
After go through the course, you can jump into the famous lab session!

Lab has 4 subnets, total around 5x machines, you will start from Public, goal is get all machine/subnet's access.

Forum & IRC
Offsec offer forum and IRC let student can discuss lab and course content, but it only has hint, don't have direct answer, you need to get it by yourself.

Revert
When you mess with some machine, or some exploit shut off the service, revert is gonna take machine back into original state.
There are 8 reverts per day, is really enough for me.

proof.txt vs network-secret.txt
proof.txt is exist in every machine, is kind of trophy but not the goal, goal is root access. network-secret.txt is only exist in some machine, when you found it, congrats! You will see what to do next!

Try harder
Try harder is the motto in OSCP/ Offsec, means get the answer by yourself, don't count on others. Kinda tough love I feel.

2.3 Take exam
There are 5 machines need to break in 23 hour and 45 minutes, really need good time management and proper sleep. You must need 70 point to pass. After exam, you will have 24 hours to submit your exam report.
If you submit along with lab/exercise, will at most have 5 extra point.

3. Personal experience
3.1 My lab/course experience
Basically I don't have any experience when I start the course. I spend 3 weeks to understand the PDF/video, and do the exercise. I extend 2 times (90 days each) of lab. PDF and video's quality is really awesome, it shows really good work Offsec do.

After the course material, I found not enough in lab, so google is your best friend. Day after days, some low hang fruit, some really hard. In total, I have around 4x machine, around 80%

Sometime you feel totally stuck, you can ask help from admin. They only guide you if you got right track, if your direction is wrong or not specific, you will only get "Try Harder".

3.2 Exam
First:
When I root around 30 machine, lab is expired, and I think I can try the exam. After 24 hour, I get 3 machine full access, around 55 point. I am happy since is first attempt, better than what I expect.

Second:
This time is totally horrible, I only get 1 machine after 24 hour fighting. I start doubt myself if I am not a good pentester. But I know I am not defeated, I must try harder....

Third:
This time it goes more smoothly, starts on 14:00 pm. I got first box in one hour. And got second one after 5 hours. Until 3 am, I only got one low shell. So I decide to sleep since I cannot make any progress.

Wake up at 8:30 am, I have some "Ah-Ha" moment and I am able to get full access on third machine and root 4th machine. Until now I know I have enough point. Unfortunately, I have totally no idea on the last one machine.

But still, the point is enough for me to pass.

After I subnet the report, after two days I receive the letter says I pass the exam and become OSCP.

4. Addition resources
The following are some useful resources I am using on lab:

https://github.com/frizb/OSCP-Survival-Guide#port-scanning

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

http://www.fuzzysecurity.com/tutorials/16.html

http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA





Finally... I become OSCP because I Tried Harder !!


Billy Chang