01 Theory Roadmap & Resources

Created: 2026-07-24 14:02
#note

📚 OSCP External Theory & Practice Resources Roadmap

[!tip] Theory vs Practical Strategy
Use Weekdays (Mon-Thu) to digest these resources in small 1-hour chunks.
Apply every concept immediately on Fridays in hands-on lab machines.

🔖 Raindrop Saved Bookmarks & Community Labs (Your Collection)

• 📌 Free Active Directory Lab for OSCP Prep (Reddit)
• 📌 HackerBlueprint | OSCP AD Chains Tracker
• 📌 (FREE LAB) OSCP-Like AD Chains/Sets Built Specifically for Exam Prep
• 📌 OffSec - p4n4Sec (PG Practice Guide)
• 📌 AD-Attacking-Notes GitHub Repository
• 📌 Passed OSCP 100 points in 7 hours (Reddit Debrief)

1. Active Directory (AD) Exploitation (40 Points on Exam)

• Official Course: OffSec PEN-200 AD Modules.
• TCM Security - Practical Ethical Hacking (PEH):
  • Watch the Active Directory section (Password Spraying, LLMNR/NBT-NS Poisoning, Kerberoasting, AS-REP Roasting, Pass-the-Hash, DCSync).
• Useful External Links:
  • Impacket GitHub Repository
  • BloodHound Python Ingester
  • PayloadsAllTheThings Active Directory Architecture

2. Privilege Escalation (Linux & Windows)

• Tib3rius Courses (Udemy / TryHackMe):
  • Linux Privilege Escalation for OSCP: Sudo rights (sudo -l), SUID binaries, Capabilities, Cron Jobs, Writable /etc/passwd, NFS shares, Kernel exploits.
  • Windows Privilege Escalation for OSCP: Service permissions (Unquoted Service Paths, Insecure Service Executables), AlwaysInstallElevated, Token Impersonation (PrintSpoofer, GodPotato, JuicyPotato), Password hunting in registry/files.
• Useful External Links:
  • Tib3rius Linux PrivEsc Cheatsheet
  • Tib3rius Windows PrivEsc Cheatsheet
  • PEASS-ng (LinPEAS / WinPEAS)
  • GTFOBins (Linux SUID/Sudo binaries)
  • LOLBAS (Windows Binaries)

3. Web Vulnerability Deep-Dive

• PortSwigger Web Security Academy (Free):
  • PortSwigger Main Academy
  • SQL Injection (SQLi)
  • Directory Traversal / LFI
  • OS Command Injection
  • File Upload Vulnerabilities
  • Server-Side Request Forgery (SSRF)

4. Pivoting & Tunneling (Ligolo-ng Gold Standard)

• Ligolo-ng: Modern TUN interface tunneling tool.
  • Ligolo-ng Official Repository
  • Ligolo-ng Documentation & Usage
  • See 04 Pivoting with Ligolo-ng for command syntax.

5. Walkthroughs, Writeups & Community Guides

• 0xdf Hacks Stuff (Best HTB & PG Machine Writeups)
• IPPSec Video Search Engine
• Reddit r/oscp Community

Tags

#oscp #resources #theory #cheatsheets #privesc #active_directory #web_security #raindrop