A little over a year ago I signed up for this Offensive Security Certified Professional (OSCP) course. But you may have noticed I have not posted my review or my certificate.
This was because I started the course but after a while I become frustrated with the material and myself.
I did not know much about penetration testing at this point. I knew it existed as I was asked in an interview for a security analyst if I can do this. My answer of course was no! So when I googled for this topic OSCP stood out. So I signed up later to realize it could be better to start with something a little more basic.
I ended up taking this path towards trying to achieve OSCP:
- OSPC – started and stopped from Offsec
- Junior Penetration Testing Student from elearnsecurity
- Virtual Hacking Labs from Virtual Hacking Labs
- Penetration Testing Professional from elearnsecurity
- OSPC – in progress from Offsec
The other reason why I stopped was the OSCP training materials were so out dated and all of the mistakes in the documentation were never updated. This was very frustrating for a leaner having to check the Offsec forums constantly to find the errata fixes. This was a lot and half way through I just stopped.
Then in December 2019 I had seen that Offsec (by the way Offsec is short hand for Offensive Security) had updated the training materials and were now also including active directory attacks. Of course this meant I had to buy the updated materials + lab time + an exam.
But I decided this was an incomplete in my mind and it has to be finished so I signed up again.
I sat the exam on Monday 4th May 2020 at 5 am. This was a 24 hour exam which was also proctored. 24 was over really quickly, it is very easy to get lost in the time before I knew it I got my first machine as System but it was 8 am already.
I got stuck time and time again though-out the exam but as Offsec say “Try Harder” So I kept it up. I did not let myself get bogged down, when I got mad with myself I would simply switch to a new box to attack. I found work-spaces very useful for managing this.
Most of my work came at about 11pm when I had some random brain sparks which pieced together what I had missed. Before this I was prepared to fail thinking “I will do better next time”. But then after getting root on the 2 medium boxes plus the buffer overflow box I was 5 point away to pass.
So I continued with the last 2. By the end I managed local on the hard box which was 25 points. So i hope that local is worth at least 5 points. OK I am pretty confident that local is worth at least 5.
I got absolutely no where on the the final box 10 point box. Nothing really annoying I could not get into it. I also tried Metasploit with this one but the application was the wrong version for any exploit I could find. I tried until the end.
After the exam I slept for about 8 hours then started my report. The report did not take to long but I did come across missing screenshots or enumeration that I should have saved. This is poor work on my side but I was so tired after the 24 hour exam. I really think they should give you 48 hours for the report.
Anyway the report is submitted and I received a confirmation email that they have received it. It is now a waiting game. I have the feeling that I am right on the line for passing but that report may let me down.
Time will tell up to 10 days for results.
So i got my result back which is hard to admit but I failed my first OSCP attempt. I believe that I had enough points to clear the technical requirements so I must have failed based on the report.
I have to wait 4 weeks before I am able to retake the exam. I will do this again but in order to achieve more I will prepare a template for the report and gather more details about the attack vectors and methodology I take.
It is always disappointing when you fail something. But even when OSCP it is considered as expected. It is hard to get back and keep going but as offsec say try harder.