Last Minute Checks/Timelines/Game Plan Before OSCP Exam
Huge thanks for loving my notes series and making the repo. I genuinely want everyone to pass, including me. I'll add this article to the repo too for last-minute tips/timeline before test/game plan. Seriously, thank you. I have always struggled with writing; this is not only the best outlet for it, but it has also gotten me to really love it. Even if I add a dump photo to the content, it's gotten me to overcome a lot of fear and anxiety.
Now that I've got that out of the way, if you are getting closer to test time, this should be your game plan within the next 12–14 days.
Day 12–14 until exam:
Don’t do any harder boxes if you have already finished labs like Secura, OSCP A, B, and C, while getting an 87–100%. You now have a solid foundation. I would instead try the easy/middle boxes from proving grounds play or hacksmarter off the Lainkusanagi list:
https://docs.google.com/spreadsheets/d/18weuz_Eeynr6sXFQ87Cd5F0slOj9Z6rt/htmlview#
This is to keep your mind fresh with methodology. If you have been putting in the work over the 60-90 days leading up to it, the harder boxes will only leave you stumped and frustrated. In this stage, the idea around these boxes is to get that solid foundation fresh and ready to go. You know the attack vectors at this point, and you can experiment with what worked and what didn’t. There’s no need to overextend the boxes.
If you didn’t do well on the OSCP mock exams, give yourself another 4–6 weeks of prep. You really should nail down the concept of what is being tested on. It’s also okay to use Metasploit more than once on this mock exam; don’t do all the rules for the mock exam. Understand the attack vector, and if it did work in Metasploit, then there’s a GitHub repo you can try. Go back to the material and do the labs in these sections from Offsec/HTB:
- Information Gathering
2. Scanning for vulnerabilities
3. Web attacks and SQLI — skip sqlmap
4. PrivEsc
5. Password Attacks
7. AD Enumeration, Authentication, and Lateral Movement
Take another stab at the mock tests. Also, they don’t need to be taken in 24 hours. Time yourself; if you are taking more than 1:30–2 hours on a box, then you are not nailing down a concept.
Another tip: it’s okay to troubleshoot with AI. Don’t make this a habit, but while you’re studying and a command isn’t clicking, use it and make a note of it if it was successful. But the more you use it, the more of a rabbit hole you will go down. Use it to help you remember commands to make notes on, create checklists, or troubleshoot scripts beforehand. But rely on your instincts. The more you can work a problem out, the easier the process will become. Treat this like a puzzle game, and you’ll most certainly pass.
Another tip: it's okay to troubleshoot with AI. Don’t make this a habit, but while you’re studying and a command isn't clicking, use it and make a note of it if it was successful. But the more you use it, the more of a rabbit hole you will go down. Use it to help you remember commands to make notes on, create checklists, or troubleshoot scripts beforehand. But rely on your instincts. The more you can work a problem out, the easier the process will become. Trythis like a puzzle game, and you’ll most certainly pass.Days 9–8 until exam:
NO MORE BOXES! At this stage, your methodology should be nailed down. So make a mind map, still work on that repo/tools ready, and review.
Review all your notes, and make a repo if you haven’t already, or somewhere you can access them. If you have gotten any extra books for the exam, like the black book (highly recommend these ones):
Do a light review of these, along with the notes from HTB/Offsec. If you have a Kindle account, they’re most likely to be free. Plus, these are books allowed on the test. You don’t want to be scattered with these books, so label down the important sections.
Get The Husky Hacker’s stories in your inbox
Join Medium for free to get updates from this writer.
You want to focus on any notes and organization for the test day. Now, if you're struggling with a concept, don’t do a box; revisit the labs for step-by-step instructions. Get the process down. If still confused or it's not clicking, schedule your test another week out until you are comfortable.
Days 7–3 until test time:
Go over all the boxes you have worked on in the proving grounds and the labs, and record your notes. Update your notes and the previous attacks you've seen, and have the commands ready in Notion, Cherry Tree, Obsidian, or GitHub. Separate them (if you haven’t already) by common network, webattack, AD attack, etc.
Review the process, focus on what worked vs what didn’t. Look into your methodology on where to strengthen. That way, you know what to look for.
Spend only about 2–4 hours a day on it, and relax your mind. You want to go fresh into it as much as possible.
Imagine a fresh Kali instance, make sure tools like BloodHound are ready to use. Make sure snapshots are taken in case you have to revert to a backup image. Update Kali.
Days 2–1 until test time:
Make sure your webcam is working and that you can connect to the VPN. Make sure backups are ready and test a restore. Remember, OffSec only supports Windows. Sadly, if things go south, they can help the Windows but not the Mac or Linux. You can use them, but it’s just better to use Windows (which is dumb, I have beef with Windows 11). Run Windows updates.
After updates are done, you can test backup images. Stay off your computer. Your notes should be ready, and you need to relax. Even if it's your first time testing. It’s not a multiple-choice test; it's hands-on with a report. It's all open notes.
Also, why I built this is for everyone, copy its tools and commands I've seen so far:
Along with all the cheat sheet articles.
Rest the brain, come with a fresh mindset. The day before, get 8–10 hours of sleep. Seriously, get some sleep.
Day of the exam:
Avoid energy drinks, and save them for hours 10–12 in the exam if you know you are close to finishing. A cup of coffee is ok.
This is going to sound weird, but before you take the test, raise your arms into a V.
It’s called the power pose, and Dr. Amy Cuddy's study suggested that high-power poses could increase testosterone (the dominance hormone) and decrease cortisol (the stress hormone). She can explain it better than I could, but the results are still the results.
During the exam, you can bring whatever snack you want, watch whatever you want, like The Simpsons, etc. Just prepare for the journey. Use the Pomodoro method during the exam.
Also, use this in your studies.
If you’re not making progress on a box within 1:30–2 hours, move to a different spot. And set the timer to an hour, take 10-minute breaks. Let the proctor know when you are taking a break; they’re pretty good about allowing break times.
Once you get the 70–100 points and get good snapshots, you have 24 hours after the exam to submit your report. Take that day off as well; that way, you can be 100% focused on it and use their template. After sending it in, it should be golden.
Thank you for reading! Good luck, and I am excited to take this exam soon. Remember, you got this, don’t overthink it. You’re always one command/exploit from passing it.
