Offensive Security Certified Professional – OSCP

Module 1: Introduction to Penetration Testing

• Penetration testing fundamentals
• Penetration testing methodology
• Rules of engagement
• Scope definition
• Legal and ethical considerations
• Testing environments
• Penetration testing workflow
• Documentation requirements
• Professional reporting

Module 2: Information Gathering and Reconnaissance

• Passive reconnaissance
• Active reconnaissance
• Information gathering
• Target enumeration
• Network discovery
• Service identification
• DNS enumeration
• Web reconnaissance
• Technology fingerprinting
• Attack surface identification

Module 3: Vulnerability Identification

• Vulnerability assessment
• Vulnerability discovery
• Service enumeration
• Vulnerability research
• Public vulnerability databases
• Exploit research
• Manual enumeration
• Automated scanning
• Validating vulnerabilities
• Prioritizing attack paths

Module 4: Web Application Penetration Testing

• Web application architecture
• Web enumeration
• HTTP and HTTPS
• Directory enumeration
• Authentication testing
• Input validation
• Common web vulnerabilities
• File inclusion
• Command injection
• SQL injection concepts
• Web exploitation
• Manual testing techniques

Module 5: Exploitation Fundamentals

• Exploitation methodology
• Exploit development concepts
• Public exploits
• Exploit modification
• Payloads
• Reverse shells
• Bind shells
• Command execution
• Initial access
• Troubleshooting failed exploits

Module 6: Password Attacks

• Password security
• Password attacks
• Password enumeration
• Password spraying
• Credential attacks
• Hash identification
• Password cracking
• Wordlists
• Credential reuse
• Authentication weaknesses

Module 7: Windows Privilege Escalation

• Windows security architecture
• User and group permissions
• Service misconfigurations
• Scheduled tasks
• Registry permissions
• Weak configurations
• Token privileges
• Credential discovery
• Local privilege escalation
• Post-exploitation enumeration

Module 8: Linux Privilege Escalation

• Linux security architecture
• Users and groups
• File permissions
• SUID and SGID
• Linux capabilities
• Cron jobs
• Services
• Kernel vulnerabilities
• Credential discovery
• PATH manipulation
• Local privilege escalation

Module 9: Active Directory

• Active Directory fundamentals
• Domain environments
• Users and groups
• Domain controllers
• Kerberos
• LDAP
• SMB
• Active Directory enumeration
• Credential-based attacks
• Lateral movement
• Privilege escalation
• Domain compromise
• Assumed-compromise scenarios

Module 10: Client-Side Attacks

• Client-side attack fundamentals
• Social engineering concepts
• Malicious documents
• Browser-based attacks
• Payload delivery
• Client-side exploitation
• User interaction
• Security awareness considerations

Module 11: Tunneling and Pivoting

• Network segmentation
• Pivoting fundamentals
• Tunneling
• Port forwarding
• Proxying
• Accessing internal networks
• Multi-host attack paths
• Network pivoting techniques
• Post-exploitation movement

Module 12: Metasploit and Exploitation Frameworks

• Metasploit fundamentals
• Exploit modules
• Auxiliary modules
• Payloads
• Sessions
• Post-exploitation
• Exploit configuration
• Manual exploitation vs automated frameworks
• Responsible use of exploitation frameworks

Module 13: Shells and Payloads

• Command shells
• Reverse shells
• Bind shells
• PowerShell
• Bash
• Payload generation
• Shell stabilization
• Interactive sessions
• Troubleshooting shell access

Module 14: Enumeration and Post-Exploitation

• System enumeration
• User enumeration
• Process enumeration
• Network enumeration
• Service enumeration
• Credential discovery
• Privilege escalation
• Lateral movement
• Persistence concepts
• Evidence collection
• Post-exploitation documentation

Module 15: Penetration Testing Reporting

• Penetration testing reports
• Executive summaries
• Technical findings
• Vulnerability descriptions
• Evidence
• Screenshots
• Exploitation steps
• Remediation recommendations
• Risk communication
• Reproducibility
• Professional documentation

Module 16: Hands-On Penetration Testing Labs

• Network reconnaissance
• Vulnerability discovery
• Exploitation
• Privilege escalation
• Windows penetration testing
• Linux penetration testing
• Web application testing
• Active Directory attacks
• Pivoting
• Post-exploitation
• Professional reporting
• Full penetration testing scenarios

• Penetration Testers
• Ethical Hackers
• Cybersecurity Professionals
• Security Analysts
• Offensive Security Professionals
• Vulnerability Assessment Professionals
• Security Engineers
• Red Team Professionals
• SOC Analysts transitioning into offensive security
• Network Security Professionals
• Application Security Professionals
• Security Consultants
• IT professionals transitioning into penetration testing
• Cybersecurity professionals preparing for the OSCP+ examination

• Apply a structured penetration testing methodology.
• Conduct passive and active reconnaissance.
• Enumerate networks, systems, services, and applications.
• Identify and validate security vulnerabilities.
• Research and adapt public exploits.
• Gain initial access to vulnerable systems in authorized environments.
• Perform Windows and Linux privilege escalation.
• Conduct web application penetration testing.
• Perform password and credential attacks.
• Understand and assess Active Directory environments.
• Perform lateral movement and network pivoting.
• Use tunneling and port-forwarding techniques.
• Work with penetration testing frameworks and security tools.
• Develop and use appropriate payloads and shells.
• Perform post-exploitation enumeration.
• Document penetration testing activities professionally.
• Produce reproducible technical findings and remediation recommendations.
• Develop the practical problem-solving skills required for real-world penetration testing.

• Strong understanding of TCP/IP and networking.
• Reasonable proficiency with Linux.
• Familiarity with the Linux command line.
• Basic knowledge of Windows administration.
• Understanding of common network services and protocols.
• Familiarity with Bash scripting is beneficial.
• Basic Python or Perl knowledge is advantageous.
• Familiarity with cybersecurity and penetration testing concepts is helpful.

Certification: OffSec Certified Professional Plus (OSCP+)
Exam Type: Practical, performance-based penetration testing examination
Exam Duration: 23 hours 45 minutes
Report Submission Window: Additional 24 hours after the practical examination
Maximum Score: 100 points
Passing Score: 70 points
Delivery: Remote proctored examination