OSCP preparation: methodology, lab practice, and time management

Format

The OSCP is a proctored practical exam lasting nearly a full day, followed by a separate period to submit a professional report. It includes standalone machines and an Active Directory set, with points awarded for documented access. OffSec updates the format, including the OSCP+ designation introduced in 2024, so read the current exam guide carefully.

Methodology over tricks

Most failures come from incomplete enumeration rather than missing exotic techniques. A strong methodology covers full port scans including UDP highlights, careful version and web enumeration, credential reuse checks, local privilege escalation checklists for Windows and Linux, and AD enumeration once inside.

• Full TCP scan plus top UDP ports
• Web: content discovery, technologies, parameters
• Credentials: reuse found passwords across services
• Local enumeration checklists for Windows and Linux
• AD: users, groups, sessions, attack paths

Lab: a timed practice block

Use OffSec’s Proving Grounds or another legal training platform. Do a three-machine block under exam-like conditions: two-hour time boxes, notes and screenshots for every step, and a break each time you switch. Afterward, write one finding as it would appear in the report and list which enumeration step would have saved the most time.

block 2026-11-02
machine | time box | outcome | key step | missed step
A | 2h | user + root | web parameter in old backup file | none
B | 2h | user only | password reuse from A config | did not check scheduled tasks early
C | 2h | none | - | skipped UDP 161; SNMP had info

Exam-day discipline

Set time boxes per target and switch when stuck, because fresh eyes often find the missed service. Take scheduled breaks, eat, and sleep if the format allows. Capture proof screenshots exactly as the exam guide requires, since undocumented access does not score.