What you control is enumeration discipline, Active Directory and privilege-escalation coverage, report evidence captured as you work, and walkthroughs read only after an honest attempt. Anything you buy from a third party is a supporting input, and you verify it before you pay.
What decides whether you pass OSCP on your first attempt
Most failed first attempts come down to a stalled phase, not a missing tool. Someone runs out of ideas on a foothold, burns three hours on one privilege-escalation vector, or finishes the machines and then discovers the evidence for the first compromise was never saved.
The table below separates the six resource types candidates ask about, so you can see what each one actually contains and where it stops.
| Resource | What it contains | Fits | Limits |
|---|---|---|---|
| Official course and labs | OffSec’s material and lab machines | Building the baseline method | Takes time; solved machines teach less on a second pass |
| Your own notes | Commands, failure signals, per-service checklists | Fast recall under the exam clock | Only as good as the dead ends you logged |
| Walkthroughs and writeups | One machine’s solution path | Diagnosing a missed step after an attempt | Read early, they replace the enumeration habit |
| Report PDF samples | Section structure and evidence formatting | Laying out your own report | Show no target solutions or attack path |
| Exam reports | Third-party claims about exam content | Nothing you can independently confirm | Unverifiable against the current exam |
| Exam reports | Same category, different label | Nothing you can independently confirm | Unverifiable, and exam-content sharing is restricted |
The first four rows build skills you can test yourself. The last two ask you to trust a seller’s description of something nobody outside OffSec can check, which is why neither belongs at the centre of a plan.
This article is not a shortcut. If you want a list of machines to memorise, it will disappoint you, because memorised paths do not survive a different target.
Build an enumeration routine that finds the foothold
Your routine should be boring and identical on every machine. When the order never changes, a stall tells you something: a step was skipped, or the target genuinely has nothing left to give on that branch. The longer companion piece on OSCP enumeration methodology goes deeper on ordering and stop conditions.
Map the full attack surface before you exploit
Sweep every TCP port first, then enumerate service by service, then pick one exploit path at a time. Skipping the full sweep is the classic way to miss a service on a high port that holds the real foothold.
# 1. Full TCP sweep, all 65535 ports
sudo nmap -p- --min-rate 1000 -T4 -oA scans/full $TARGET
# 2. Version and default-script scan on only the open ports
ports=$(grep -oP '\d+(?=/open)' scans/full.gnmap | paste -sd, -)
sudo nmap -sC -sV -p "$ports" -oA scans/targeted $TARGET
# 3. Top UDP ports, run in a second terminal while you read the TCP results
sudo nmap -sU --top-ports 20 -oA scans/udp $TARGET
Typical output from step 1 on a machine with something hiding high looks like this (sample lines, not from a real exam target):
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
8443/tcp open https-alt
Port 8443 is the line that matters. A scan limited to the default 1,000 ports would never have shown it.
Then go service by service. Read banners, browse every web root, check each share and each login prompt, and write down what you tried and what came back. Pick one exploit path and work it until it either lands or you can write down why it failed.
The log is not optional. A dead end you recorded is a branch you will not walk again at hour fourteen.
Spot failure signals and switch branches early
Three signals tell you to change course, and each has a specific next branch.
- An exploit fails on a matching version. Do not rerun it with new payloads. Check the exact build and patch level, confirm the target path and parameters, and read the exploit source for assumptions it makes. If the conditions still match and it still fails, park it and move to the next service.
- A credential authenticates nowhere. Test it against every service you have found, not only the one you found it on, and try username variations. If it fails everywhere, treat it as a lead for wordlist-building and move on rather than spraying blindly.
- Enumeration stops returning new information. Go back to the sweep output and ask which ports and directories you only skimmed. Rerun content discovery with a different wordlist or extension set, and check UDP before you decide the machine has nothing left.
Credential tests across several hosts are quick with NetExec:
nxc smb targets.txt -u users.txt -p 'Winter2026!' --continue-on-success
Watch for lockout policy before you spray anything against a domain account. One careless run can cost you a user you needed.
Where you practise matters as much as how. Machines you have already seen solved will not show where your own enumeration breaks, because you are recalling a path instead of finding one. Pick targets you have not read about, and compare lab machines versus exam difficulty before you decide the labs have fully prepared you. Practice must cover the standalone machines and the Active Directory component both, since each fails in a different way.
Active Directory and privilege escalation: where first attempts stall
Many first attempts reach a shell and then lose hours at the next step. Check the current exam guide for how the Active Directory set is scored and what it requires, because that scope is OffSec’s to define and it can change between versions. You should read it again the week before your exam, not rely on a forum post from last year.
Enumerate the domain before you attack it
Once you have a first set of domain credentials, resist the urge to exploit the first thing you see. Collect users, groups, shares, delegation settings and local admin relationships first, then decide on a path. Our Active Directory enumeration cheat sheet covers the exam-workflow version of this routine.
nxc smb $DC -u $USER -p "$PASS" --shares --users
bloodhound-python -u $USER -p "$PASS" -d $DOMAIN -ns $DC -c All --zip
Load the zip into BloodHound and check the shortest paths from your owned principals before you touch anything else. A path that starts at a user you already control beats a clever exploit against a hardened host.
The failure signal here is a collection that looks empty. If BloodHound returns almost nothing, suspect a DNS or collection-scope problem before you conclude the domain has no paths, and rerun with the correct nameserver.
Work privilege escalation from a checklist, not a hunch
When you have a low-privilege shell, a written checklist removes the guessing. Run it in the same order each time and mark each item done or dead. Use the Linux privilege escalation checklist for the Linux branch and the Windows privilege escalation triage for the Windows branch.
Set a time box before you start each vector, and drop the vector when the box ends. Open-ended retries are how one kernel exploit eats an afternoon while a misconfigured service or a readable credential file sits unchecked further down your list. The same discipline applies across the whole attempt, and an exam pacing plan written before exam day tells you when to stop one machine and start another.
Privilege escalation fails quietly. A script that prints nothing is not proof that nothing exists, so always do the manual checks too.
Treat the report as part of the pass, not an afterthought
The report is a required deliverable. It documents the steps and the evidence for each compromise, and the exam guide sets what it must contain. Read its current wording before your attempt, since a strong technical result with a thin report is still a weak submission.
For structure, follow the OSCP report template. A report PDF sample is useful for one thing only: seeing how sections are laid out and how evidence is formatted. It shows no target solutions, so it does nothing for your attack path.
Capture evidence while you work, not after
Rebuilding evidence from memory after 24 hours awake is how steps get lost. Capture as you go, and your report becomes an assembly job rather than a reconstruction.
- Log your terminal output continuously, so every command and its result is on disk.
- Take a screenshot at each proof point, showing the command, the output and the host identity in one frame.
- Keep a running text file per machine with timestamps, what you tried and what you found.
- Save exploit code you modified, with a note on what you changed.
If you do only one thing, make it the per-machine text file. It doubles as your dead-end log and your report skeleton.
Run a dry run on a practice machine before the real attempt. Write the complete report for it, and you will find out which of your capture habits fall short while it still costs you nothing.
Walkthroughs, writeups and exam reports: what each can and cannot do
These formats get lumped together, but they prove different things. A walkthrough shows one machine’s path, which you can check against your own notes. A report PDF sample shows structure. An exam report or exam report claims to represent live exam content, and nobody outside OffSec can confirm that claim.
Walkthroughs and writeups: use them after an honest attempt
A walkthrough helps only after you have tried the machine yourself. Read after a timed attempt, it shows you which enumeration step you missed. Read before, it hands you the answer and skips the habit the exam actually tests.
Use this order: attempt the machine with a time limit, write down where you stalled, then open the walkthrough and find the exact step where your path diverged. Add that step to your checklist. You are looking for the missing habit, not the missing exploit.
Exam reports and exam reports: what cannot be verified
Exam reports and exam reports are third-party claims. A seller saying a pack matches a live exam is not independent confirmation, and CyberServices.Store is an independent marketplace, not OffSec, so it cannot confirm that either. Whether a pack reflects the current exam, or any exam, is unverified.
OffSec’s candidate terms also restrict sharing exam content. Check the current wording yourself in the exam policy before you decide anything, because the consequences of a violation are OffSec’s to set, not a seller’s.
For these reasons, neither format should be the core of a first-attempt plan. This article reproduces no exam material and makes no claims about pass rates, endorsement or live-exam access.
Buying checklist: what to verify before you pay
Open the live product page and check each item below. The page is the only source for a listing’s contents, sample availability, delivery timing, revisions, customer-protection terms and accepted payment methods, so quote none of those from memory or from a search snippet. This checklist is current as of 6 November 2026; re-check the page on the day you buy.
- Format. Is it a report PDF, a walkthrough, notes or something sold as a report or report? The label decides what you are getting.
- Exam name and version. The listing should say OSCP or OSCP+ as stated, and match the version you are sitting.
- Included files. The page should say what is in the package, in what file types.
- Sample evidence. If a sample exists, check which exam and version it belongs to, and whether it shows the structure you need.
- Delivery method. Find out how the files reach you and how long that takes.
- Update and revision terms. Look for what happens when the material changes.
- Restrictions. Read any limits on use or redistribution.
- Customer-protection terms and support route. Know who to contact and what the page promises before you pay.
If a field is missing from the page, treat that as an answer. When you are ready to compare, the OSCP service listings page lists the OSCP offerings on the store, and each listing links through to its own contents, sample and delivery details.
When a third-party pack is not the right choice
Skip it in these cases:
- You have not done the course lab work yet. A pack cannot stand in for the baseline method, and you will not know what to ask of it.
- The listing does not name your exam version. If you cannot confirm that it matches, you cannot judge its relevance.
- You expect a pack to replace enumeration on exam day. Nothing you buy runs your enumeration for you, and targets that differ from what you studied will expose that quickly.
Planning the retake if your first attempt does not pass
Start with your own failure notes, written within a day or two of the attempt while the details are fresh. Mark which phase stalled: the foothold, the Active Directory set, privilege escalation or the report. Note which report sections were thin and why.
Then act on what the notes say.
- Rebuild the weakest phase with machines you have not seen solved, under a time limit.
- Add every missed step to your enumeration and privilege-escalation checklists.
- Rewrite a full practice report, fixing the sections your notes flagged.
- Check the current retake terms in the OffSec exam policy, including any waiting period and cost, before you book or buy anything else.
If a third-party resource is still on your list, run it through the checklist above again, as if you had never bought one. A bad first attempt is the moment people grab the nearest pack, so slow down and match the purchase to the phase that failed.
Frequently asked questions
Is a report PDF sample enough to pass the OSCP report requirement?
No. A report PDF sample shows section structure and how evidence is formatted, and nothing more. You still have to document your own steps and evidence for each compromise, so capture commands and screenshots while you work.
Is an OSCP exam report the same as a detailed walkthrough?
No. A walkthrough documents one machine’s solution path, and you can check it against your own notes. An exam report claims to reflect live exam content, and that claim can’t be verified from outside OffSec.
Can I verify a PDF before buying it?
Only partly. Check the live listing for the exam name and version, included files, sample availability and delivery terms, and open any sample to see whether it matches what the page says. Authenticity of exam-content claims stays unverified.
How do I avoid an outdated or misleading pack?
Confirm that the listing names your exact exam, OSCP or OSCP+, and the version you are sitting. Then check its update and revision terms and its support route on the live page. If any of those fields is missing, treat the pack as unconfirmed.
When should I open a walkthrough while practising?
Open it after a timed attempt on the machine, once you have written down where you stalled. Compare its path with your notes to find the enumeration step you missed. Reading it first removes the practice value.