My OSCP Journey — A Review

This post describes the journey that I went through while studying for the Offensive Security Certified Professional (OSCP) certification. It outlines my personal experience and therefore is very subjective. I don’t go into any details about the OSCP labs and exam due to restrictions set by Offensive Security. Instead, I’ve structured it in such a way that it gives the advice that I wish I had gotten when I first started the certification.

When it all Began — Or so I thought…

I first enrolled in the OSCP certification at the beginning of last year. I had just finished a Master’s degree in Computer Science and started my first full time position as a Security Assessment Analyst. At the time, I had a background in web security, however, I recognized that there was a huge gap in my knowledge of the entire process of penetration testing. This is what peeked my interest in the OSCP certification.

Without doing much research into the prerequisites of the certification, I enrolled in the PWK v1.1.6 of the course and made the incorrect assumption that it would be like any other course that I have taken where you get a book or manual that teaches you the foundational knowledge to tackle the labs and exam. And boy was I wrong!

For those of you that have done v1.1.6 of the course, you know that the course material does not at all go in depth on the techniques you need to compromise a host and escalate privileges. Therefore, although I completed most of the course manual at the time with the exercises, I felt completely lost when it came to the labs. I felt that there was such a huge gap between what was taught in the course material and what you encountered in the labs. That in combination with having just started a new job and just finished a Master’s degree, I didn’t realize how burnt out I already was.

I let my lab time (and exam attempt) expire and decided to instead focus on my job. That is also when I decided to never go back to the OSCP labs until I felt that I’m not only prepared for the OSCP labs but also for the exam.

So here’s advice #1.

I would not recommend enrolling into the OSCP course unless you have previous experience in all the general steps that you take to compromise a host: recon, initial…