# OSCP (PEN-200) Study Path

> An independent, structured study path aligned with the OSCP® (PEN-200) exam syllabus, from network enumeration and web application attacks to Active Directory exploitation and privilege escalation.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path
- **Vendor:** OffSec
- **Code:** PEN-200
- **Difficulty:** Intermediate
- **Exam duration:** 23 hours 45 minutes + 24-hour report window
- **Exam passing score:** 70 / 100 points
- **Exam standalone machines:** 3 machines, 20 points each (60 points)
- **Exam active Directory set:** 1 set, 40 points
- **Exam metasploit restriction:** Allowed on one standalone machine only
- **Exam certification:** OSCP+ (since Nov 2024), 3-year renewal
- **Exam proctoring:** Proctored via webcam and screen sharing
- **Official syllabus:** https://www.offsec.com/documentation/penetration-testing-with-kali.pdf
- **Practice machines:** https://hackindex.io/learn/oscp-pen-200-study-path/machines.md
- **Published:** 2026-09-23
- **Updated:** 2026-09-27

## Prepare for the OSCP® Exam with Free, Hands-On Study Material

The Offensive Security Certified Professional (OSCP®) is one of the most recognized hands-on penetration testing certifications in the industry. It is earned by passing OffSec®'s PEN-200 exam, which validates that a candidate can identify vulnerabilities, develop exploits, and compromise systems in a controlled environment under time pressure. Unlike multiple-choice exams, it requires you to break into machines and write a professional report about your findings.

The PEN-200 exam syllabus spans information gathering, vulnerability scanning, web application attacks, SQL injection, client-side attacks, privilege escalation on Windows and Linux, Active Directory exploitation, tunneling, antivirus evasion, and the Metasploit framework. This study path organizes free HackIndex content around those topics in its own structure.

HackIndex is independent study material and is not affiliated with, endorsed by, or sponsored by OffSec. All content here is original: it maps to the public exam topics so you can practice the same techniques, and links to OffSec's official pages as the authoritative source. Use it alongside the official course, or as a standalone reference to gauge your readiness.

The OSCP® exam gives you 23 hours and 45 minutes to compromise several targets, followed by a 24-hour reporting window, and you need 70 of 100 points to pass. Metasploit is restricted to a single machine, so manual exploitation skills are essential.

> [!WARNING]
> This is still a work in progress. Some modules still need to be set up and finished.

## Modules

- [Getting Started: Pentest Workflow](https://hackindex.io/learn/oscp-pen-200-study-path/introduction-to-penetration-testing.md): A brief overview of the penetration testing workflow and how HackIndex organizes content by services, platforms, and phases to help you navigate the OSCP study path.
- [Passive Information Gathering](https://hackindex.io/learn/oscp-pen-200-study-path/passive-information-gathering.md): Collect target information from public sources without touching the network. WHOIS, DNS records, Shodan, certificate transparency, Google dorking, and automated OSINT tools.
- [Active Information Gathering](https://hackindex.io/learn/oscp-pen-200-study-path/active-information-gathering.md): Map open ports and services with Nmap, then enumerate DNS, SMB, SNMP, and SMTP to identify the attack surface before moving to exploitation.
- [Vulnerability Scanning](https://hackindex.io/learn/oscp-pen-200-study-path/vulnerability-scanning.md): Automated vulnerability scanning with Nmap NSE scripts, Nuclei, and Nikto to identify known CVEs, misconfigurations, and missing patches across networks and web applications.
- [Introduction to Web Applications](https://hackindex.io/learn/oscp-pen-200-study-path/introduction-to-web-applications.md): Web application fundamentals for penetration testing. HTTP basics, technology fingerprinting, content discovery, CMS detection, and Burp Suite as intercepting proxy.
- [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks.md): Directory traversal, file inclusion, command injection, and cross-site scripting. Detection, exploitation, and filter bypass techniques for the most common web vulnerabilities.
- [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks.md): SQL injection from detection to code execution. UNION, error-based, blind, and stacked query techniques across MySQL, MSSQL, PostgreSQL, and Oracle with sqlmap automation.
- [Client-Side Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/client-side-attacks.md): Attack users instead of servers. Browser-based attacks like clickjacking and CSRF, plus payload delivery through Office macros and Windows shortcut files.
- [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits.md): Find, evaluate, and adapt public exploit code from SearchSploit, Exploit-DB, and GitHub. Understand what an exploit does before running it.
- [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits.md): Adapt public exploits for your target. Modify hardcoded values, cross-compile binaries, troubleshoot failures, and deliver reliable payloads with stable shell handling.
- [Antivirus Evasion](https://hackindex.io/learn/oscp-pen-200-study-path/antivirus-evasion.md): Understand AV detection mechanisms and bypass them with payload obfuscation, custom encoding, and in-memory execution techniques.
- [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks.md): Brute force, password spraying, and offline cracking with hashcat and John the Ripper against network services and captured hashes.
- [Windows Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation.md): Enumerate misconfigurations, abuse dangerous privileges, and exploit services to escalate from low-privilege user to SYSTEM on Windows.
- [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation.md): Enumerate misconfigurations, abuse sudo and SUID, hijack services, hunt credentials, and exploit kernel vulnerabilities to escalate to root on Linux.
- [Metasploit Framework Essentials](https://hackindex.io/learn/oscp-pen-200-study-path/the-metasploit-framework.md): Metasploit workflow, msfvenom payloads, Meterpreter post-exploitation, and pivoting. Exam limits MSF to one target.
- [Active Directory Enumeration](https://hackindex.io/learn/oscp-pen-200-study-path/active-directory-introduction-and-enumeration.md): Domain discovery, unauthenticated user enumeration, object queries, ACL analysis, and BloodHound attack path mapping.
- [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication.md): Password spraying, Kerberoasting, AS-REP Roasting, NTLM relay, ADCS abuse, delegation exploitation, and ACL-based privilege escalation.
- [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory.md): Pass-the-hash, pass-the-ticket, PSExec, WMI, DCOM, WinRM, golden/silver tickets, and trust abuse for domain-wide lateral movement.

> [!NOTE]
> HackIndex is independent study material, not affiliated with, endorsed by, or sponsored by OffSec. OSCP® and OffSec® are registered trademarks of OffSec Services Limited. PEN-200 is an OffSec course designation. This study path uses only original HackIndex content and links to OffSec's official pages as the authoritative source.