Offensive Security Certified Professional (OSCP) is the certification for Penetration Testing with Kali Linux, the world's first hands-on InfoSec certification . Thank you for opting to take the “Offensive Security—PWB” extended lab . Please read the Offensive Security Lab Introduction PDF before starting the labs. Every material that they give has a watermark of the students Id and his other details, so in case the materials are found online, they can track back to the.
|Language:||English, Spanish, French|
|Genre:||Children & Youth|
|ePub File Size:||15.57 MB|
|PDF File Size:||8.75 MB|
|Distribution:||Free* [*Sign up for free]|
Submitting your course exercises, PWK lab report, along with your exam report, may have its benefits. For example, up to 5 points may be earned by submitting. Getting Comfortable with Kali Linux. -‐ Finding Your Way Around Kali. -‐ Booting Up Kali Linux. -‐ The Kali Menu. -‐ Find, Locate, and. At the end of this module, the student should be able to comfortably use the BackTrack. Linux Distribution, including Service management, tool location.
If you are not a subscriber and want to download this magazine click here. This site uses Akismet to reduce spam. Learn how your comment data is processed. Please login or Register to access downloadables Download. We're proud of how the material turned out and we would like to share them with those of you who do not participate in the course itself we recommend you do that though.
Each machine has certain objectives that you need complete in order for your points to count.
Finally - December 16th came around. I woke up around AM - ate some breakfast, drank some tea, and went for a walk to relax and catch my thoughts.
By I was sitting at my desk, all my workspaces in Kali were configured the way I liked, OneNote was set up for the exam, and I queued up a few hours of Deadmau5 and some Drum and Bass to play in my headphones as I worked.
I took 15 minutes to read everything and make a mental note on what I needed to do. By I was off and taking on the first machine. Once reset, I was able to exploit the machine and attained a root shell!
I was a nervous wreck, and the butterflies in my stomach were acting up, but by 12PM I had two machines rooted with 35 points under my belt! At this point I decided to step away for an hour and take a small break. After a relaxing break, and some food in me, an hour later I was able to attain a limited shell on another device using an actually pretty complex and interesting method.
Shortly after, I was able to attain a high privilege shell, brining me to 55 points! In all honesty I overcomplicated the process and missed a critical piece of information - I only found it when I went back and enumerated again! I enumerated all I could but kept coming up with blanks or kept going down rabbit holes. After about an hour of hitting dead ends I opted to take a small 1 hour break to eat and watch some TV.
Once my break was over, I got back and started enumerating again, and quickly spotted something while using Burp. After a few hours of trial and error, by 11PM I was able to get a limited shell, brining me up to Oh man, was I ecstatic - I did a victory lap around the house and played the Try Harder song to celebrate! All I needed was a root shell and I pass, easy! For the next 4 hours I was at another roadblock.
Nothing seemed to work. I found myself bouncing back between the privilege escalation and the other machine, hoping to find a way to get the final limited shell, or to attain root. By 2AM I gave up trying to get root and made up my mind that I need the other limited shell to pass. At this point I was exhausted, 18 hours into the exam and I was so close!
The vulnerability that I was trying to exploit was never taught in the OSCP, it was never found in the labs - I only knew of it because of my studies! I took a step back, and took a few minutes to breathe and make some tea. And it worked! I ran another Nikto scan on a directory and it bestowed me with a simple vulnerability. A quick Google search led me to a few thing and after some trial and error, by 3AM I had another limited shell, brining me up to Wrapping it Up At this point I called it quits, I went back to gather all the screenshots and to make sure that I had all the requirements.
By 4AM I was happily asleep - knowing that I passed! I woke up around 1PM the next day and began working on my report which was about 89 pages long and pretty detailed. I submitted my report at around 4AM Monday morning - I went to a concert with my brother that evening haha - and by Tuesday morning I got my response that I passed! I was informed by other offsec guys to Join offsec IRC channel, here I was taught that one must ask questions related with topics not discuss the particular machine and ping admins if needed help.
Every Machine tested was meant to test or teach you different attack vectors and skills. Sometimes failure to find vulnerabilities or understand the machine makes me feel to quit. Try Harder!! Try hard, get back to basics and start enumerating again.
A couple of weeks passed by and I was able to get r00t on more machines 20 machines but by pain,sufferance, and difficulty. The Course is there to teach basics you need to start enumerating and attacking. Search and learn yourself through Google.
At times I was tired of typing msfvenom shells commands so felt the need to fix this so created a small script to make my work easy.
Later found a better script by g0tmi1k but I prefer to use my own because of easiness. So if anyone knows to bash scripting or programming they can automate their work. Whenever I am stuck on any VM, ran Metasploit, openvas scanner and was able to crack machines with those results.
Make sure you practice manual methods because the use of vulnerability scanner and Metasploit is banned in the exam. Buffer overflow is one of the topics that I think offsec did a very good job at explaining it. I did found some of the basic stack BO vulnerable apps thorugh googl and succesfully exploited them. As soon I got r00t on some of the hard machines like pain, fc4, I was confident that I will be able to crack the exam and ooked my exam date.
I am not kidding this exam was intense and gave me a hard time. Except for 2 machines I was not able to get or understand anything else. Even after planning, I was shocked to see how my brain was failing to follow that routine. This was a horrible mistake. Eventually, I received an email from Offsec saying I failed.
I realized I am not ready for OSCP decided to learn, understand and practice more but this failure led me to avoid that practice. After a while, I got a full-time job which made me lazy enough that I was only reading walkthroughs of vulnhub vms. Somehow I found hackthebox - An online platform to test and advance your skills in penetration testing and cyber security.