Originally for the OSCP. Now for the PNPT certification test. for a lot of reasons including cost, ability to retest for free, and lack of software restrictions.
https://certifications.tcm-sec.com/pnpt/
The PNPT certification exam is a one-of-a-kind ethical hacking certification exam that assesses a student’s ability to perform an external and internal network penetration test at a professional level. Students will have five (5) full days to complete the assessment and an additional two (2) days to write a professional report.
- Perform Open-Source Intelligence (OSINT) to gather intel on how to properly attack the network
- Leverage their Active Directory exploitation skillsets to perform A/V and egress bypassing, lateral and vertical network movements, and ultimately compromise the exam Domain Controller
- Provide a detailed, professionally written report
- Perform a live 15-minute report debrief in front of our assessors, comprised of all senior penetration testers
The standalone exam is perfect for students who are already well-versed in OSINT, external penetration testing techniques (such as vulnerability scanning, information gathering, password spraying, credential stuffing, and exploitation), and internal penetration testing techniques (such as LLMNR Poisoning, NTLM Relay Attacks, Kerberoasting, IPv6 attacks, and more).
No, exam vouchers do not expire.
No, once acquired, the certification is lifetime.
No, you will have access to your training for life.
Yes! You can view an example of those here. https://www.credential.net/b1378d28-1db0-4fba-8174-a8827435b4b3?_ga=2.240223427.1903223037.1619739387-204885165.1618896985
Yes. The exam is a pentest and all tools are allowed. Including Linpeas.
The exam environment permits five full days to simulate a real pentest, though you can complete the engagement objectives ahead of time. You will have an additional two days to write a professional report and submit it to our team.
In short, it really doesn’t. The exam was designed because the industry is lacking in practical certifications. Some certifications are multiple choice and do not test a student’s technical skills. Other exams are hands on, but are not realistic in time allotment or attack methodology. This exam replicates a true pentest in both attack methodology and the amount of time permitted to perform the test.
Everyone is different, however, we believe that:
- If you are a beginner, the exam will be very difficult and we strongly recommend that you purchase the associated training.
- If you are a junior penetration tester, the exam will be difficult and may require additional training.
- If you are a mid to senior level pentester, the exam will be of moderate difficulty.
Yes. It was designed for student’s to pass the exam with the training. The training is designed for students from absolute beginner to moderate levels and will teach you the skills necessary to be successful as a penetration tester.
No. We do monitor network traffic in the exam environment and have detection mechanisms in place for cheating in the environment and the exam, but there will be no proctor or intrusive software to install on your machine.
- https://cheatsheet.haax.fr/
- https://book.hacktricks.xyz/
- https://gtfobins.github.io/
- https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#active-directory-exploitation-cheat-sheet
- https://sqlwiki.netspi.com/
- https://github.com/NetSPI/PowerUpSQL/wiki
- http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://sqlwiki.netspi.com/attackQueries/
- Buffer Overflow
- Linux Commands and Privilege Escalation
- Windows Commands and Privilege Escalation
- Metasploit Emergency Use
- Massive amount of current Windows Exploit that Microsoft doesn't plan to fix (because it works properly).
- GitHub Repo (this one) — https://github.com/ciwen3/OSCP.git
- MSFVenom Payload Creator — https://github.com/g0tmi1k/msfpc
- Exploit-DB — https://www.exploit-db.com/
- SearchSploit — https://www.exploit-db.com/searchsploit
sudo apt update && sudo apt -y install exploitdb
searchsploit -u
searchsploit -h
searchsploit afd windows local
Note, SearchSploit uses an AND operator, not an OR operator. The more terms that are used, the more results will be filtered out. Pro Tip: Do not use abbreviations (use SQL Injection, not SQLi). Pro Tip: If you are not receiving the expected results, try searching more broadly by using more general terms (use Kernel 2.6 or Kernel 2.x, not Kernel 2.6.25).
- Windows Kernel Exploits — https://github.com/SecWiki/windows-kernel-exploits
- Linux Kernel Exploits — https://github.com/lucyoa/kernel-exploits
- Hashcat — https://hashcat.net/hashcat/
- John the Ripper — https://www.openwall.com/john/
- pattern_create.rb — /usr/share/metasploit-framework/tools/exploit/pattern_create.rb
- pattern_offset.rb — /usr/share/metasploit-framework/tools/exploit/pattern_offset.rb
- Kali's builtin Windows Resources:
/usr/share/windows-resources/
/usr/share/windows-resources/binaries/
- https://cirt.net/passwords
- https://www.passwordsdatabase.com/
- https://datarecovery.com/rd/default-passwords/
- https://www.routerpasswords.com/ [So Many Adds on this Page]
- GoBuster — https://github.com/OJ/gobuster
- Recursive GoBuster — https://github.com/epi052/recursive-gobuster
- Nikto — https://github.com/sullo/nikto
- dirb — https://tools.kali.org/web-applications/dirb
- Feroxbuster — https://github.com/epi052/feroxbuster
- Rustbuster — https://github.com/phra/rustbuster
- Nmap
- Unicornscan
- AngryIP Scanner
- Advanced Port Scanner
- SQLMap – Automatic SQL Injection And Database Takeover Tool - https://github.com/sqlmapproject/sqlmap
- jSQL Injection – Java Tool For Automatic SQL Database Injection - https://github.com/ron190/jsql-injection
- SQL – A Blind SQL-Injection Exploitation Tool - https://github.com/Neohapsis/bbqsql
- QLMap – Automated NoSQL Database Pwnage - https://github.com/codingo/NoSQLMap
- Whitewidow – SQL Vulnerability Scanner - https://kalilinuxtutorials.com/whitewidow/
- DSSS – Damn Small SQLi Scanner - https://github.com/stamparm/DSSS
- explo – Human And Machine Readable Web Vulnerability Testing Format - https://github.com/dtag-dev-sec/explo
- Blind-Sql-Bitshifting – Blind SQL-Injection via Bitshifting - https://github.com/awnumar/blind-sql-bitshifting
- Leviathan – Wide Range Mass Audit Toolkit - https://github.com/leviathan-framework/leviathan
- Blisqy – Exploit Time-based blind-SQL-injection in HTTP-Headers (MySQL/MariaDB) - https://github.com/JohnTroony/Blisqy
- CherryTree — https://www.giuspen.com/cherrytree/ (Template: https://411hall.github.io/assets/files/CTF_template.ctb)
- KeepNote — http://keepnote.org/
- PenTest.ws — https://pentest.ws/
- Microsoft OneNote
- GitHub Repo
- Joplin with TJNull (OffSec Community Manager) template — https://github.com/tjnull/TJ-JPT
- Obisidian Mark Down — https://obsidian.md/
- Dradis — https://dradisframework.com/academy/industry/compliance/oscp/
- Serpico — https://github.com/SerpicoProject/Serpico
- Report Template
- Created by whoisflynn — https://github.com/whosiflynn/OSCP-Exam-Report-Template
- Created by Noraj — https://github.com/noraj/OSCP-Exam-Report-Template-Markdown
- AutoRecon — https://github.com/Tib3rius/AutoRecon
- nmapAutomator — https://github.com/21y4d/nmapAutomator
- Reconbot — https://github.com/Apathly/Reconbot
- Raccoon — https://github.com/evyatarmeged/Raccoon
- Dirsearch — https://github.com/maurosoria/dirsearch
- GoBuster — https://github.com/OJ/gobuster
- Feroxbuster — https://github.com/epi052/feroxbuster
- wfuzz — https://github.com/xmendez/wfuzz
- goWAPT — https://github.com/dzonerzy/goWAPT
- ffuf — https://github.com/ffuf/ffuf
- Nikto — https://github.com/sullo/nikto
- dirb — https://tools.kali.org/web-applications/dirb
- dirbuster — https://tools.kali.org/web-applications/dirbuster
- Impacket (SMB, psexec, etc) — https://github.com/SecureAuthCorp/impacket
- SecLists — https://github.com/danielmiessler/SecLists
- IIS — https://gist.github.com/nullenc0de/96fb9e934fc16415fbda2f83f08b28e7
- Reverse Shell Generator — https://github.com/cwinfosec/revshellgen
- Windows Reverse Shell Generator — https://github.com/thosearetheguise/rev
- MSFVenom Payload Creator — https://github.com/g0tmi1k/msfpc
- Windows PHP Reverse Shell — https://github.com/Dhayalanb/windows-php-reverse-shell
- PenTestMonkey Unix PHP Reverse Shell — http://pentestmonkey.net/tools/web-shells/php-reverse-shell
- tmux — https://tmuxcheatsheet.com/ (cheat sheet)
- tmux-logging — https://github.com/tmux-plugins/tmux-logging
- Oh My Tmux — https://github.com/devzspy/.tmux
- screen — https://gist.github.com/jctosta/af918e1618682638aa82 (cheat sheet)
- Terminator — http://www.linuxandubuntu.com/home/terminator-a-linux-terminal-emulator-with-multiple-terminals-in-one-window
- vim-windir — https://github.com/jtpereyda/vim-windir
- Exploit-DB — https://www.exploit-db.com/
- AutoNSE — https://github.com/m4ll0k/AutoNSE
- Windows Kernel Exploits — https://github.com/SecWiki/windows-kernel-exploits
- LOLBins - https://lolbas-project.github.io/#
- Windows Takeover completely from Linux — https://www.sprocketsecurity.com/blog/the-ultimate-tag-team-petitpotam-and-adcs-pwnage-from-linux
- Windows Credentials — https://www.alteredsecurity.com/post/fantastic-windows-logon-types-and-where-to-find-credentials-in-them
- Everything Below — https://github.com/cfalta/MicrosoftWontFixList/blob/main/README.md
- https://github.com/GossiTheDog/HiveNightmare
- https://github.com/GossiTheDog/SystemNightmare
- https://github.com/leechristensen/SpoolSample
- https://github.com/topotam/PetitPotam
- https://github.com/antonioCoco/RemotePotato0
- https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH
- https://github.com/cube0x0/CVE-2021-1675
- Linux Kernel Exploits — https://github.com/lucyoa/kernel-exploits
- GTFOBins (Bypass local restrictions) — https://gtfobins.github.io/
- BruteX — https://github.com/1N3/BruteX
- Hashcat — https://hashcat.net/hashcat/
- John the Ripper — https://www.openwall.com/john/
- Post-Exploitation / Privilege Escalation
- LinEnum — https://github.com/rebootuser/LinEnum
- linprivchecker —https://www.securitysift.com/download/linuxprivchecker.py
- Powerless — https://github.com/M4ximuss/Powerless
- PowerUp — https://github.com/HarmJ0y/PowerUp
- Linux Exploit Suggester — https://github.com/mzet-/linux-exploit-suggester
- Windows Exploit Suggester — https://github.com/bitsadmin/wesng
- Windows Privilege Escalation Awesome Scripts (WinPEAS) — https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS
- Linux Privilege Escalation Awesome Script (LinPEAS) — https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS
- GTFOBins (Bypass local restrictions) — https://gtfobins.github.io/
- Get GTFOBins — https://github.com/CristinaSolana/ggtfobins
- sudo_killer — https://github.com/TH3xACE/SUDO_KILLER
- Local Privilege Escalation Workshop — https://github.com/sagishahar/lpeworkshop
- Linux Privilege Escalation — https://www.udemy.com/course/linux-privilege-escalation/
- Windows Privilege Escalation — https://www.udemy.com/course/windows-privilege-escalation/
- HTB/Vulnhub like OSCP machines (Curated by OffSec Community Manager TJNull)— https://docs.google.com/spreadsheets/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/edit#gid=1839402159
- Virtual Hacking Labs — https://www.virtualhackinglabs.com/
- HackTheBox (Requires VIP for Retired machines) — https://www.hackthebox.eu/
- Vulnhub — https://www.vulnhub.com/
- Root-Me — https://www.root-me.org/
- Try Hack Me — https://tryhackme.com
- OverTheWire — https://overthewire.org (Linux basics)