Course Overview

The OffSec Certified Professional (OSCP+) course is a hands-on Penetration Testing Certification training that trains individuals for real-world assessments. It emphasizes identifying, exploiting, and mitigating vulnerabilities across diverse systems in networks. Key areas of this course cover information gathering, enumeration, initial access, privilege escalation, web exploitation, active directory attacks, and pivoting. This OSCP+ is renowned for its 48-hour certification exam demanding candidate’s persistence and deep understanding of ethical hacking concepts. It is highly valued for cyber security professional aiming to gain expertise in pentesting.

Syllabus

Chapter I – Introduction to OSCP course

• Overview of OSCP objectives and requirements.
• Setting up a Kali Linux VM and necessary tools.
• Introduction to PEN-200 modules and learning pathways.
• Broad overview of penetration testing fundamentals.

Chapter II – Report Writing

• Basics of note-taking during penetration tests.
• Tools and techniques for effective documentation (screenshot utilities, note-taking apps).
• Structure of penetration testing documentation:
• Executive Summary.
• Technical Summary.
• Writing actionable technical findings and recommendations.

Chapter III – The Penetration Testing Lifecycle

• Phases of penetration testing:
• Reconnaissance.
• Scanning and Vulnerability Assessment.
• Exploitation.
• Post-Exploitation.
• Real-world workflow for assessments.

Chapter IV – Information Gathering

• Passive vs. active reconnaissance techniques.
• Introduction to OSINT (Open Source Intelligence).
• DNS, SMB, SNMP, and Web Enumeration.
• Tools: Nmap, Rustscan, and custom scripts.

Chapter V – Vulnerability Scanning

• Understanding the vulnerability scanning process.
• Installing and configuring Nessus.
• Utilizing Nmap NSE scripts for vulnerability assessment.
• Interpreting scan results for actionable insights.

Chapter VI – Introduction to Web Applications

• Overview of OWASP Top 10 vulnerabilities.
• Use of Burp Suite and other proxies for analysis.
• Techniques to enumerate headers, cookies, and source code.

Chapter VII – Cross-Site Scripting

• Types of XSS vulnerabilities: Reflected, Stored, DOM-based.
• Exploiting XSS for privilege escalation.

Chapter VIII – Directory Traversal

• Absolute vs. relative paths in exploitation.
• Encoding techniques for bypassing filters.

Chapter IX – File Inclusion Vulnerability

• LFI vs. RFI attacks.
• Using PHP wrappers and other advanced techniques.

Chapter X – File Upload Vulnerability

• Identifying and exploiting file upload flaws.
• Bypassing content-type validation.

Chapter XI – Command Injection Vulnerability

• Basics of OS command injection.
• Chaining commands to gain access.

Chapter XII – SQL Injection Vulnerability

• Advanced SQL injection types: Error-based, UNION-based, Blind SQLi.
• Exploiting MSSQL databases with xp_cmdshell.
• Automation using SQLMap.

Chapter XIII – Attacks on Client-Side

• Preparing for Office document attacks using macros.
• Leveraging Windows shortcuts and library files.

Chapter XIV – Searching for Public Exploits (Online)

• Reviewing online exploit repositories.

Chapter XV – Searching for Public Exploits (Offline)

• Using SearchSploit and frameworks for offline exploitation.

Chapter XVI – Exploit Adaptation and Development

• Basics of Python Programming.
• Debugging and upgrading existing exploits.

Chapter XVII – Antivirus Evasion

• Understanding AV detection methods.
• Manual and automated AV bypass techniques.

Chapter XVIII – Password Attacks

• Brute-forcing SSH, RDP, and HTTP logins.
• NTLM hash cracking and pass-the-hash attacks.

Chapter XIX – Windows Privilege Escalation

• Enumerating sensitive information using tools like PowerShell.
• Techniques: DLL hijacking, unquoted paths, and Scheduled Tasks.

Chapter XX – Linux Privilege Escalation

• Exploiting misconfigured cron jobs, SUID binaries, and kernel vulnerabilities.
• Utilizing special sudo permissions.

Chapter XXI – Port Redirection and SSH Tunneling

• Techniques for port forwarding using Socat and SSH.
• Local, remote, and dynamic forwarding.

Chapter XXII – Advanced Tunneling

• HTTP and DNS tunneling using tools like Chisel and dnscat.

Chapter XXIII – The Metasploit Framework

• Exploiting vulnerabilities using Metasploit modules.
• Post-exploitation and pivoting techniques.

Chapter XXIV – Active Directory Introduction and Enumeration

• Active Directory enumeration using tools like BloodHound.
• Gathering domain-specific data for further exploitation.

Chapter XXV – Attacking Active Directory Authentication

• Techniques like Kerberoasting and NTLM attacks.
• Exploiting SPN-based vulnerabilities.

Chapter XXVI – Lateral Movement in Active Directory

• WMI, WinRM, and Pass the Hash techniques.
• Persistence using golden tickets and shadow copies.