Skip to content
HackIndex.io

Free study path · OffSec PEN-200

OSCP (PEN-200) Study Path

An independent, structured study path aligned with the OSCP® (PEN-200) exam syllabus, from network enumeration and web application attacks to Active Directory exploitation and privilege escalation.

Modules
18
Resources
545
Study time
~41 h
Difficulty
Intermediate

Exam at a glance

Duration
23 hours 45 minutes + 24-hour report window
Passing score
70 / 100 points
Standalone machines
3 machines, 20 points each (60 points)
Active Directory set
1 set, 40 points
Metasploit restriction
Allowed on one standalone machine only
Certification
OSCP+ (since Nov 2024), 3-year renewal
Proctoring
Proctored via webcam and screen sharing

Prepare for the OSCP® Exam with Free, Hands-On Study Material

The Offensive Security Certified Professional (OSCP®) is one of the most recognized hands-on penetration testing certifications in the industry. It is earned by passing OffSec®'s PEN-200 exam, which validates that a candidate can identify vulnerabilities, develop exploits, and compromise systems in a controlled environment under time pressure. Unlike multiple-choice exams, it requires you to break into machines and write a professional report about your findings.

The PEN-200 exam syllabus spans information gathering, vulnerability scanning, web application attacks, SQL injection, client-side attacks, privilege escalation on Windows and Linux, Active Directory exploitation, tunneling, antivirus evasion, and the Metasploit framework. This study path organizes free HackIndex content around those topics in its own structure.

HackIndex is independent study material and is not affiliated with, endorsed by, or sponsored by OffSec. All content here is original: it maps to the public exam topics so you can practice the same techniques, and links to OffSec's official pages as the authoritative source. Use it alongside the official course, or as a standalone reference to gauge your readiness.

The OSCP® exam gives you 23 hours and 45 minutes to compromise several targets, followed by a 24-hour reporting window, and you need 70 of 100 points to pass. Metasploit is restricted to a single machine, so manual exploitation skills are essential.

Syllabus modules

Work through the modules in order. Each one explains the topic and links the content worth your time.

  1. 1

    Getting Started: Pentest Workflow

    A brief overview of the penetration testing workflow and how HackIndex organizes content by services, platforms, and phases to help you navigate the OSCP study path.

    No resources yet ~0.25 h

  2. 2

    Passive Information Gathering

    Collect target information from public sources without touching the network. WHOIS, DNS records, Shodan, certificate transparency, Google dorking, and automated OSINT tools.

    5 resources ~1.5 h

  3. 3

    Active Information Gathering

    Map open ports and services with Nmap, then enumerate DNS, SMB, SNMP, and SMTP to identify the attack surface before moving to exploitation.

    20 resources ~2 h

  4. 4

    Vulnerability Scanning

    Automated vulnerability scanning with Nmap NSE scripts, Nuclei, and Nikto to identify known CVEs, misconfigurations, and missing patches across networks and web applications.

    4 resources ~1.5 h

  5. 5

    Introduction to Web Applications

    Web application fundamentals for penetration testing. HTTP basics, technology fingerprinting, content discovery, CMS detection, and Burp Suite as intercepting proxy.

    10 resources ~1 h

  6. 6

    Common Web Application Attacks

    Directory traversal, file inclusion, command injection, and cross-site scripting. Detection, exploitation, and filter bypass techniques for the most common web vulnerabilities.

    148 resources ~3 h

  7. 7

    SQL Injection Attacks

    SQL injection from detection to code execution. UNION, error-based, blind, and stacked query techniques across MySQL, MSSQL, PostgreSQL, and Oracle with sqlmap automation.

    49 resources ~2.5 h

  8. 8

    Client-Side Attacks

    Attack users instead of servers. Browser-based attacks like clickjacking and CSRF, plus payload delivery through Office macros and Windows shortcut files.

    4 resources ~0.75 h

  9. 9

    Finding and Evaluating Public Exploits

    Find, evaluate, and adapt public exploit code from SearchSploit, Exploit-DB, and GitHub. Understand what an exploit does before running it.

    57 resources ~1 h

  10. 10

    Adapting Public Exploits

    Adapt public exploits for your target. Modify hardcoded values, cross-compile binaries, troubleshoot failures, and deliver reliable payloads with stable shell handling.

    27 resources ~1 h

  11. 11

    Antivirus Evasion

    Understand AV detection mechanisms and bypass them with payload obfuscation, custom encoding, and in-memory execution techniques.

    1 resource ~0.5 h

  12. 12

    Password Attacks

    Brute force, password spraying, and offline cracking with hashcat and John the Ripper against network services and captured hashes.

    14 resources ~2 h

  13. 13

    Windows Privilege Escalation

    Enumerate misconfigurations, abuse dangerous privileges, and exploit services to escalate from low-privilege user to SYSTEM on Windows.

    32 resources ~5 h

  14. 14

    Linux Privilege Escalation

    Enumerate misconfigurations, abuse sudo and SUID, hijack services, hunt credentials, and exploit kernel vulnerabilities to escalate to root on Linux.

    61 resources ~5 h

  15. 15

    Metasploit Framework Essentials

    Metasploit workflow, msfvenom payloads, Meterpreter post-exploitation, and pivoting. Exam limits MSF to one target.

    5 resources ~1.5 h

  16. 16

    Active Directory Enumeration

    Domain discovery, unauthenticated user enumeration, object queries, ACL analysis, and BloodHound attack path mapping.

    14 resources ~3.5 h

  17. 17

    Active Directory Authentication Attacks

    Password spraying, Kerberoasting, AS-REP Roasting, NTLM relay, ADCS abuse, delegation exploitation, and ACL-based privilege escalation.

    48 resources ~5 h

  18. 18

    Active Directory Lateral Movement

    Pass-the-hash, pass-the-ticket, PSExec, WMI, DCOM, WinRM, golden/silver tickets, and trust abuse for domain-wide lateral movement.

    46 resources ~4 h

  19. Complete the path

    18 modules to finish. Then test yourself on the practice machines below.

OSCP practice machines 339 machines mapped to the syllabus