From Zero to OSCP
Ten modules. Twenty-five machines. Every technique that shows up on the exam. Work through them in order — each module builds on the last.
Train on real OSCP machines — free, in your browser
Ten modules. Twenty-five deliberately-vulnerable boxes covering everything the exam throws at you — enumeration, web, Active Directory, Linux privesc and more. No VPN, no setup: spin a machine up and start hacking. Free accounts get 3 fresh machines every day.
- ✓ Exam-style Linux & Windows machines
- ✓ On-box tips that teach the method, not just the answer
- ✓ Full walkthrough unlocks once you root the box
- ✓ No credit card — sign up and go
Uncle Rat's Ultimate OSCP Prep Guide & Course
Want the complete roadmap? My full OSCP course walks the entire methodology end-to-end — the guide, the videos, and the exact game-plan I use to pass — and includes 3 months of RatCTF Premium (unlimited daily machines) so you can drill everything here with no limits.
Get the full OSCP course ↗Exam Strategy
Four principles that separate passing attempts from failing ones.
1 — Enumerate First, Always
The single biggest cause of OSCP failures is running exploits before finishing enumeration. Run full nmap TCP + UDP, then service-specific scripts before touching Metasploit or exploit-db. Every machine in this path is broken by information you can find with standard tools — no zero-days required.
nmap -sC -sV -p- -T4 -oA full_tcp TARGET
nmap -sU --top-ports 200 -oA top_udp TARGET2 — Keep a Playbook
Build a personal cheat-sheet as you go through these labs. Write down every command that worked, every privesc vector you found, and every service quirk. On exam day you will not have time to think — you need to execute. The best playbook is the one you wrote yourself while rooting real machines.
# Suggested structure
notes/
enum/ recon outputs per target
privesc/ local enum, sudo, SUID, cron
shells/ working reverse shell one-liners
flags/ user.txt + root.txt per machine3 — Master PrivEsc Patterns
Getting a foothold is the easy half. Escalating to root is where most candidates get stuck. Learn to run LinPEAS and read the output critically. The five most common vectors on OSCP: sudo misconfiguration, writable cron jobs, SUID binaries, world-writable service scripts, and weak file permissions on config files.
sudo -l # always first
find / -perm -4000 -type f 2>/dev/null # SUID binaries
cat /etc/crontab && ls /etc/cron* # cron jobs
ls -la /etc/passwd /etc/shadow /etc/sudoers4 — Active Directory Is Mandatory
The OSCP exam always includes an Active Directory set worth a huge chunk of the points. Module 8 (Active Directory) is the module most candidates under-prepare — and the reason they fail. Drill all three domains until enumerate → foothold → domain admin is muscle memory, and give AD a big slice of your study time.
# AD drill goal: enumerate → foothold → DA in one session
# Chain all three domains: CorpNet → MegaCorp → VaultNet
# Must be muscle memory before exam dayThe Ten Modules
Complete them in order. Each module has paced assignments — finish all assignments before moving on.
Recon & Enumeration
Every engagement starts with protocol-aware reconnaissance. These labs force you to extract live data from DNS and SNMP before touching an exploit.
PEN-200 Module 5 — Information Gathering- Zone transfers & DNS brute-forcing (dig, dnsenum, fierce)
- SNMP community string enumeration (snmpwalk, onesixtyone)
- Service fingerprinting with nmap -sV / --script
- Building an accurate target asset inventory
Hands-on assignments for this module are available to Premium members.
Cleartext Protocol Exploitation
Telnet and TFTP represent the bottom of the authentication security ladder. These labs teach credential capture, anonymous file retrieval, and pivoting from weak services.
PEN-200 Module 9 — Attacking Network Services- Telnet credential brute-force and session hijacking
- TFTP directory traversal and unauthenticated file retrieval
- Hydra / Medusa against TCP auth services
- Service-to-shell chains with shared credential reuse
Hands-on assignments for this module are available to Premium members.
File Share Exploitation
Misconfigured rsync modules and anonymous SMB shares remain common in real enterprise targets. Learn to extract secrets from both.
PEN-200 Module 9 & 12 — Network Services / Windows Exploitation- Rsync anonymous module enumeration and download
- SMB null session enumeration (smbclient, enum4linux)
- FTP anonymous access and writable directory abuse
- Credential extraction from synced configuration files
Hands-on assignments for this module are available to Premium members.
Mail & VoIP Services
Two classic network services that leak their way to a shell. SMTP VRFY/EXPN leaks usernames for password sprays; a misconfigured Asterisk PBX (SIP + the Manager port) hands over remote command execution. Footprinting network services is a consistent OSCP theme.
PEN-200 Module 9 — Attacking Network Services- SMTP user enumeration via VRFY, EXPN, RCPT TO
- Open relay detection and abuse
- SIP extension enumeration & password cracking (SIPVicious svwar/svcrack)
- Asterisk Manager Interface (AMI) abuse — Originate/System RCE
- Credential reuse across SIP, AMI, and SSH
Hands-on assignments for this module are available to Premium members.
Web Exploitation — Foundations
Command injection via PHP applications is the most common initial foothold on OSCP. This lab isolates the pattern, from parameter discovery to reverse shell.
PEN-200 Module 13 — Web Application Attacks- Directory / file enumeration (gobuster, ffuf)
- PHP command injection parameter identification
- Reverse shell staging with netcat and /dev/tcp
- Shell stabilisation (pty upgrade, stty raw -echo)
Hands-on assignments for this module are available to Premium members.
Web Exploitation — Advanced
Chain SQLi → command injection → file upload in a realistic portal application. Mirrors the multi-stage web machines that appear in OSCP exam sets.
PEN-200 Module 13 & 14 — Web Application Attacks- SQL injection (UNION-based + blind) with sqlmap
- Authentication bypass via SQLi
- Command injection chaining after auth bypass
- Malicious file upload (PHP webshell bypass techniques)
- sudo -l privilege escalation via interpreter abuse
Hands-on assignments for this module are available to Premium members.
Database & Directory Services
MySQL, LDAP, and Redis each store credentials and configuration data. These labs teach extraction, lateral movement via credential reuse, and privesc via service trust.
PEN-200 Module 9 & 17 — Network Services / Post-Exploitation- MySQL unauthenticated login, UDF exploitation, INTO OUTFILE
- LDAP anonymous bind and attribute enumeration (ldapsearch)
- Redis CONFIG SET dir / dbfilename SSH key injection
- Credential pivoting from database user tables
Hands-on assignments for this module are available to Premium members.
Active Directory
Three Windows domains of increasing size. Start with the CorpNet pair (DC + workstation), then take on the larger MegaCorp and VaultNet environments (DC, workstation, and a DB member server). Enumerate AD objects, escalate via Kerberoasting or AS-REP roasting, move laterally, and DCSync your way to domain admin.
PEN-200 Module 21–22 — Active Directory Attacks- BloodHound / ldapdomaindump AD object enumeration
- Kerberoasting and AS-REP roasting (GetUserSPNs.py)
- Pass-the-Hash and Pass-the-Ticket lateral movement
- DCSync for credential harvesting (secretsdump.py)
- Multi-host lateral movement across DC, workstation, and member servers
Hands-on assignments for this module are available to Premium members.
Linux Privilege Escalation — Project Meridian
Five machines inside SolarGate Energy's network. Each teaches a distinct Linux privesc technique: SUID binaries, cron job hijacking, sudo vim, sudo awk, and Linux capabilities. Work through them in order — difficulty climbs from Easy to Hard.
PEN-200 Module 16 — Linux Privilege Escalation- SUID binary abuse (python3, GTFOBins)
- Cron job script hijacking (world-writable scripts)
- Sudo misconfiguration — vim shell escape
- Sudo misconfiguration — awk system() escape
- Linux capabilities enumeration and cap_setuid exploitation
Buffer Overflow — Stacksmash
The classic stack buffer overflow, end to end. Fuzz the service to find the crash, control EIP, locate bad characters, find a JMP ESP, and drop your shellcode for a shell. The methodology the OSCP exam expects you to execute cold.
PEN-200 — Stack Buffer Overflows- Fuzzing a service to trigger a crash
- Controlling EIP and finding the offset (pattern_create / pattern_offset)
- Bad-character identification
- Locating a JMP ESP and staging shellcode (msfvenom)
Training Schedule
— click to expand
Pace your study, not just your machine unlocks. Finish the assignments for each module before moving forward.
Free Plan — 10-Week Pace
With 3 labs/day, spread your work across 10 weeks. One module per week, with the extra weeks reserved for AD and BOF.
Week 1: Module 1 — Recon (dns-lab, snmp-lab)
Week 2: Module 2 — Cleartext (telnet-lab, tftp-lab)
Week 3: Module 3 — File Shares (rsync-lab, smb-ftp-lab)
Week 4: Module 4 — Email (smtp-lab)
Week 5: Module 5 — Web Basics (http-lab)
Week 6: Module 7 — Databases (mysql-lab, ldap-lab)
Week 7: Module 7 — Redis + review
Week 8: Module 8 — AD workstation (corp-ws)
Week 9: Module 8 — AD domain (corp-dc)
Week 10: Review all, redo two hardest boxesPremium Sprint — 3-Week Blitz
Unlimited access means you can go fast. Three weeks is enough to complete the entire path if you commit 2–3 hours per day.
Days 1-3: Modules 1-3 (all file/protocol labs)
Days 4-5: Modules 4-5 (SMTP + HTTP)
Days 6-7: Module 6 — Injectrix (web chain)
Days 8-10: Module 7 — all three DB labs
Days 11-14: Module 8 — full AD set
Days 15-17: Module 9 — BOF (repeat 3x min)
Days 18-21: Full replay of hardest 5 machinesOSCP Report Standard
Your exam report must be professional-grade. For each machine document:
## Machine: TARGET_NAME (TARGET_IP)
### Enumeration
- nmap output (full TCP + relevant UDP)
- Service versions identified
### Exploitation
- Vulnerability identified: CVE / technique name
- Proof-of-concept command / payload
- Screenshot: whoami output at foothold
### Privilege Escalation
- Vector: sudo / SUID / cron / writable script
- Exact commands used
- Screenshot: id showing root + cat root.txtWrite your notes in this format as you go — don't try to reconstruct from memory after the exam.
Timed Practice Rules
Once you've rooted all machines once, run timed sessions to simulate exam pressure.
Session rules:
- 3h30m per machine (exam budget)
- No walkthroughs — use only your own notes
- Must complete: foothold + user flag + root flag
- Must write the report section during the session
BOF drill goal: under 20 minutes start-to-root
Web chain goal: under 45 minutes
AD set goal: under 2 hours both machines
If you miss the target time:
→ identify the exact sticking point
→ drill that single technique tomorrow
→ re-run the full machine next week