OSCP Exam Writeup Guide resources are most valuable when they teach you how to approach unfamiliar targets, document attack paths, manage evidence, and turn enumeration findings into reproducible exploitation steps.
OSCP+ is a hands-on penetration testing exam. The goal is not to memorize an “OSCP exam dump” or copy a fixed sequence of commands. You need a methodology that still works when the IP addresses, applications, credentials, services, and attack paths are different.
A practical OSCP workflow looks like this:
Enumeration → Attack Surface → Initial Access → Privilege Escalation → Active Directory → Evidence → Reporting
This guide focuses on that process and the lessons you can carry into your own authorized OSCP+ lab practice.
Current OSCP+ Exam Structure
Understanding the exam structure should influence how you prepare.
| Section | Structure | Points |
|---|---|---|
| Standalone Targets | 3 machines | 60 |
| Active Directory | 3-machine AD set | 40 |
| Maximum | 6 machines | 100 |
| Passing Score | 70 |
Each standalone machine is worth 20 points:
10 points — Initial Access
10 points — Privilege Escalation
The Active Directory environment is worth 40 points:
Client #1 — 10 points
Client #2 — 10 points
Machine #3 — 20 points
Candidates are provided a username and password for the AD set, simulating an assumed-breach scenario.
The current practical exam lasts 23 hours and 45 minutes, followed by another 24 hours to submit the documentation.
This means your preparation needs to cover both exploitation and reporting.
Start Every OSCP Target With Enumeration
One of the biggest lessons from useful OSCP exam writeup material is simple:
Do not exploit before you understand the target.
Start by building an attack-surface map:
IP → Ports → Services → Versions → Applications → Users → Credentials → Potential Paths
For every open port, ask:
- What service is running?
- What version is exposed?
- Is authentication required?
- Is anonymous access available?
- Does the service expose additional information?
- Does it connect to another service?
- Are there usernames or credentials worth recording?
Prioritize evidence rather than running every tool you know.
If HTTP is available, enumerate the application.
If SMB is available, investigate shares and permissions.
If credentials appear, determine which services logically accept them.
If the target is domain joined, start thinking about its relationship with Active Directory.
The objective is to turn scan results into an attack hypothesis.
Enumeration Should Answer Questions
Avoid collecting hundreds of lines of output without interpreting them.
For example:
Finding: Web server on port 80.
That alone is not useful.
Turn it into:
Web Server → Technology → Application → Endpoints → Authentication → User Input → Potential Weakness
The same applies to SMB:
SMB → Shares → Permissions → Files → Users/Credentials → New Access
Every enumeration result should either produce another question or eliminate an attack path.
Preparing for OSCP+?
Our OSCP collection brings together standalone machine material, Active Directory sets, walkthrough resources, and exam-focused preparation material so you can compare multiple attack paths rather than depend on a single walkthrough.
✓ Standalone scenarios · ✓ Multiple AD Sets · ✓ Instant digital delivery · ✓ Free updates
Standalone Machine Methodology
The three standalone machines account for 60% of the available exam points, so you need a repeatable process.
Use:
Enumerate
↓
Prioritize Attack Surface
↓
Validate Vulnerability
↓
Initial Access
↓
Local Enumeration
↓
Privilege Escalation
↓
Evidence
↓
Document
After gaining initial access, do not immediately start trying privilege-escalation exploits.
First determine the current context.
Linux Privilege Escalation
Review areas such as:
- current user and groups;
- sudo permissions;
- SUID/SGID binaries;
- cron jobs;
- services;
- writable files and directories;
- configuration files;
- stored credentials;
- application credentials;
- unusual capabilities;
- running processes.
The objective is to understand:
Current User → Misconfiguration → Higher Privilege
Windows Privilege Escalation
On Windows, examine:
- current user;
- local groups;
- token privileges;
- services;
- scheduled tasks;
- filesystem permissions;
- stored credentials;
- application configuration;
- user profiles;
- network configuration.
Again, follow evidence.
Automated enumeration can help identify possibilities, but you should understand why a finding matters before attempting exploitation.
Active Directory Methodology
The AD section should be approached differently from standalone machines.
Think in relationships:
Identity → Group → Permission → Service → Host → Credential → Next Identity
Because the current OSCP+ AD environment provides starting credentials, authenticated enumeration becomes important immediately.
Map:
- domain users;
- groups;
- computers;
- SMB shares;
- service accounts;
- SPNs;
- accessible hosts;
- remote-management services;
- credentials;
- internal networks.
Do not focus exclusively on Domain Admin.
A normal user can expose a share.
That share can expose credentials.
Those credentials can unlock another client.
The new client can expose another identity.
That identity may provide the next step toward the Domain Controller.
The conceptual path becomes:
Provided Credentials
→ Authenticated Enumeration
→ Accessible Resource
→ Credential Discovery
→ Second Identity
→ Lateral Movement
→ Client Access
→ Additional Privilege / Credential
→ Domain Progression
This is why Active Directory attack-path reasoning matters more than memorizing individual commands.
Credential Management
During a long OSCP session, credentials become difficult to track.
Maintain a simple credential matrix:
| Identity | Source | SMB | WinRM | SSH | MSSQL | Privilege |
|---|---|---|---|---|---|---|
| User A | Initial access | ✓/✗ | ✓/✗ | — | — | User |
| User B | Config file | ✓/✗ | ✓/✗ | — | ✓/✗ | Unknown |
| Service Account | AD | ✓/✗ | ✓/✗ | — | ✓/✗ | Verify |
For every credential, record:
Credential → Identity → Discovery Source → Valid Service → Resulting Access
Do not blindly try every credential against every service.
Use the information you already have to determine where the account logically belongs.
This makes your testing cleaner and your notes much easier to follow later.
Re-Enumeration Is a Core OSCP Skill
When you obtain new access, the environment changes.
So enumerate again.
A useful loop is:
Enumerate → Gain Access → Re-enumerate → Correlate → Progress
Obtained another username?
Revisit authenticated services.
Obtained another password?
Check where that identity should logically authenticate.
Obtained root or SYSTEM?
Revisit protected files and credential stores.
Reached another domain machine?
Repeat domain and local enumeration.
Discovered another network interface?
Update your network map.
A common mistake is continuing to search for a new vulnerability when your newest credential or privilege level has already changed an earlier attack surface.
Pivoting and Internal Networks
Pivoting may also be relevant in the Active Directory environment.
After gaining access to a system, inspect:
Interfaces → Routes → DNS → Reachable Networks → Internal Hosts
If the compromised system can reach another subnet that your Kali machine cannot access directly, update your network map.
Think:
Kali → Compromised Host → Internal Network → Next Target
Do not pivot simply because another interface exists.
First determine whether the new network contains systems relevant to the attack path.
This keeps your methodology evidence-driven.
OSCP Reporting: Document While You Work
Reporting should begin during exploitation, not after it.
OffSec’s current authoritative objectives give Documenting Findings a 33% weighting, making it the largest individual objective domain.
Your notes should make every successful compromise reproducible.
For each target, maintain:
Enumeration
→ Vulnerability
→ Initial Access
→ Privilege Escalation
→ Proof
→ Commands
→ Screenshots
A technically competent reader should be able to reproduce your attack from the report.
That is the standard you should practice against.
Screenshot Discipline
Do not wait until the end of the exam to collect evidence.
When an important step succeeds:
stop → record command → capture output → take screenshot → continue
For proof files, follow OffSec’s current screenshot and interactive-shell requirements exactly.
OffSec warns that insufficient proof evidence or documentation can result in zero points for a target.
This makes evidence collection part of exploitation rather than an administrative task to complete later.
A Better OSCP Note Structure
Create one section per target.
For example:
Target
IP:
Hostname:
Operating System:
Open Ports:
Credentials:
Initial Access:
Privilege Escalation:
Proof:
Screenshots:
Commands:
Lessons Learned:
For Active Directory, add:
Domain:
Users:
Groups:
Service Accounts:
Credentials:
Compromised Hosts:
Routes:
Attack Path:
This structure reduces the amount of work required when converting raw notes into the final report.
Need More OSCP Practice Scenarios?
Use multiple standalone and Active Directory scenarios to practice the complete cycle:
Enumeration → Exploitation → Privilege Escalation → Documentation
→ Explore OSCP+ Exam Resources
OSCP Exam Dump vs Practical Preparation
Candidates searching for terms such as OSCP exam dump, OSCP dump PDF, OSCP exam writeup, or OSCP real exam questions are usually trying to reduce uncertainty before the exam.
But OSCP+ is performance based.
A static answer sheet cannot replace the ability to enumerate a new environment.
If you use walkthrough-style material during legitimate lab preparation, extract methodology rather than memorizing commands.
Ask:
Why was this port prioritized?
Which finding revealed the vulnerability?
Why did this exploit work?
What was missed during initial enumeration?
Why did this privilege-escalation path work?
What information enabled lateral movement?
What should have been documented immediately?
That transforms an OSCP exam writeup from a command list into a learning resource.
How to Learn From a Failed OSCP Attack Path
Getting stuck during practice is useful if you identify why.
After completing a lab with assistance, compare your methodology with the successful path.
Create a simple record:
| Problem | Why It Was Missed | Improvement |
|---|---|---|
| Hidden web content | Insufficient enumeration | Add content discovery |
| Virtual host | DNS/vhost enumeration skipped | Add vhost check |
| Credential reuse | Credentials not tracked | Maintain credential matrix |
| PrivEsc path | Local enumeration incomplete | Use structured checklist |
| AD relationship | No re-enumeration | Repeat after new identity |
| Pivot | Routes ignored | Check interfaces/routes |
Over time, this becomes your personal OSCP methodology.
The objective is not:
“Remember this machine.”
It is:
“Never miss this category of finding again.”
Time Management During OSCP+
The current OSCP+ practical exam lasts 23 hours and 45 minutes.
Do not interpret that as a requirement to work continuously for almost 24 hours.
Use checkpoints.
If a target produces no meaningful progress, review your enumeration before continuing to attack it.
Ask:
- Did I scan all relevant ports?
- Did I enumerate every discovered service?
- Did I inspect the web application manually?
- Did I miss virtual hosts or directories?
- Did I discover credentials that were never reused?
- Did new access change an earlier service?
- Did I forget an internal network?
- Did I document what already worked?
When necessary, temporarily move to another target.
Returning later with a clearer attack map can be more productive than repeatedly testing the same assumption.
Current OSCP+ Tool Restrictions Matter
Do not build your preparation workflow around tools that cannot be used during the real exam.
OffSec’s current exam guide prohibits several categories of automated assistance, including mass vulnerability scanners and AI chatbots during the exam and reporting phase.
OffSec’s current FAQ lists tools such as BloodHound Community/Legacy, SharpHound, PowerView, Rubeus, evil-winrm, CrackMapExec, Mimikatz, Impacket, and PrintSpoofer as permitted provided they are not used for restricted actions.
Tool policies can change.
Always check the official rules shortly before your exam instead of relying on an old OSCP writeup.
How to Know When You’re Ready
You are approaching OSCP+ readiness when you can consistently:
- enumerate unfamiliar services systematically;
- identify likely attack paths without immediately opening a walkthrough;
- troubleshoot public exploits;
- obtain and stabilize shells;
- perform structured Linux privilege escalation;
- perform structured Windows privilege escalation;
- enumerate Active Directory with provided credentials;
- track users and credentials;
- understand lateral-movement relationships;
- recognize when pivoting may be necessary;
- re-enumerate after gaining new access;
- maintain usable notes while attacking;
- reproduce your own exploitation process;
- convert those notes into a professional report.
The goal is not to know every exploit.
The goal is to have a methodology for situations you have never seen before.
OSCP Exam Writeup FAQ
What is an OSCP exam writeup?
An OSCP exam writeup generally refers to documentation describing an OSCP-style penetration-testing workflow. For legitimate preparation, it is most useful when it teaches enumeration, exploitation, privilege escalation, Active Directory methodology, and reporting rather than attempting to provide memorized exam answers.
How long is the current OSCP+ exam?
OffSec currently provides 23 hours and 45 minutes for the practical exam and another 24 hours for documentation submission.
How many machines are on OSCP+?
The current structure contains three standalone machines and a three-machine Active Directory set, for six machines in total.
How many points are required to pass?
The current passing requirement is 70 out of 100 points.
How important is reporting?
Very important. OffSec’s current authoritative objectives allocate 33% to Documenting Findings, and the official exam guide requires detailed, reproducible documentation.
Should I use an OSCP exam dump?
For legitimate preparation, prioritize labs, methodology, walkthrough analysis, Active Directory practice, privilege escalation, and reporting. OSCP+ evaluates practical performance, so memorizing static answers does not build the skills needed for an unfamiliar environment.
Can I use ChatGPT during the OSCP+ exam?
No. OffSec’s current exam rules explicitly prohibit AI chatbots during both the exam and reporting phase. Use AI-assisted study only outside the exam where permitted by OffSec’s policies.
What is the best way to use OSCP walkthroughs?
Attempt the target independently first. When stuck, use the minimum hint required to continue. After completing the target, study the entire path and identify which enumeration or reasoning step you originally missed.
Final OSCP+ Methodology
A strong OSCP Exam Writeup Guide ultimately reduces to a repeatable process:
1. Enumerate completely.
Understand the target before attacking it.
2. Prioritize evidence.
Choose attack paths based on findings rather than guessing.
3. Obtain initial access.
Understand why the vulnerability works.
4. Re-enumerate locally.
A shell is the beginning of another enumeration phase.
5. Escalate privileges.
Follow evidence toward root or administrative access.
6. Map Active Directory relationships.
Connect identities, credentials, services, hosts, and permissions.
7. Re-enumerate after every new security context.
New access changes the attack surface.
8. Document immediately.
Capture commands, evidence, screenshots, and reasoning while the information is fresh.
The transferable OSCP methodology is:
Enumerate → Understand → Exploit → Re-enumerate → Escalate → Correlate → Document
Learn that process rather than one machine.
Ready to Practice for OSCP+?
Get access to our OSCP preparation collection with standalone machine resources, multiple Active Directory sets, walkthrough material, and exam-focused preparation resources.
✓ Standalone machine practice
✓ Multiple Active Directory sets
✓ Attack-path walkthrough resources
✓ Instant digital delivery
✓ Free updates included
For the latest exam structure, reporting requirements, tool restrictions, and submission rules, always check the official OffSec OSCP+ Exam Guide.
Use penetration-testing techniques only against systems you own or are explicitly authorized to assess.
Get the material: OSCP exam material
Learn https://niccs.cisa.gov/resources/cybersecurity-certifications
