// pass the exam

The OSCP Roadmap

Every stage of the exam, mapped to the exact notes I reach for.

Recon & Enumeration 3 Service Enumeration 10 Web Exploitation 26 Password Attacks 2 Shells & File Transfers 2 PrivEsc — Linux 42 PrivEsc — Windows 38 Active Directory 49 Pivoting & Tunneling 29 Report & Methodology 3 Misc 9

01
Recon & Enumeration
3 notes
Host discovery, port scans, general recon — always start here.
// curated guides
02
Service Enumeration
10 notes
Per-service deep dives — FTP (21), SSH (22), Telnet (23), SMTP (25/465/587), DNS (53), TFTP (69), Finger (79), Kerberos (88), POP3 (110/995), RPC/Portmap (111), MSRPC (135), NetBIOS (137/138), IMAP (143/993), SNMP (161/162), LDAP (389/636), HTTPS (443), SMB (139/445), IPMI (623), Rsync (873), MSSQL (1433), Oracle TNS (1521), NFS (2049), Docker API (2375/2376), MySQL (3306), RDP (3389), PostgreSQL (5432), WinRM (5985/5986), VNC (5900), X11 (6000), Redis (6379), IRC (6667), CouchDB (5984), Elasticsearch (9200), Memcached (11211), MongoDB (27017).
📁FTPport 211
- 📡Network Services Cheatsheetguide
🔐SSHport 220
// no notes yet — add one in Notion and it'll land here
📟Telnetport 230
// no notes yet — add one in Notion and it'll land here
✉️SMTPport 25 / 465 / 5871
- ✉️SMTP — Enumeration & Attacksguide
🌐DNSport 530
// no notes yet — add one in Notion and it'll land here
📤TFTPport 690
// no notes yet — add one in Notion and it'll land here
☝️Fingerport 790
// no notes yet — add one in Notion and it'll land here
🎟️Kerberosport 880
// no notes yet — add one in Notion and it'll land here
📬POP3port 110 / 9950
// no notes yet — add one in Notion and it'll land here
🔗RPC / Portmapport 1110
// no notes yet — add one in Notion and it'll land here
🪟MSRPCport 1350
// no notes yet — add one in Notion and it'll land here
🖧NetBIOSport 137 / 1380
// no notes yet — add one in Notion and it'll land here
📥IMAPport 143 / 9930
// no notes yet — add one in Notion and it'll land here
📊SNMPport 161 / 1620
// no notes yet — add one in Notion and it'll land here
🏛️LDAPport 389 / 6360
// no notes yet — add one in Notion and it'll land here
📂SMBport 139 / 4450
// no notes yet — add one in Notion and it'll land here
🔒HTTPSport 4432
- 📡Ident (Tcp 113)guide
- 📡Miscguide
🖥️IPMIport 6230
// no notes yet — add one in Notion and it'll land here
🔁Rsyncport 8730
// no notes yet — add one in Notion and it'll land here
🗄️MSSQLport 14331
- 🗄️MSSQL Attacks (1433)guide
🅾️Oracle TNSport 15210
// no notes yet — add one in Notion and it'll land here
💽NFSport 20490
// no notes yet — add one in Notion and it'll land here
🐳Docker APIport 2375 / 23760
// no notes yet — add one in Notion and it'll land here
🐬MySQLport 33060
// no notes yet — add one in Notion and it'll land here
🖱️RDPport 33890
// no notes yet — add one in Notion and it'll land here
🐘PostgreSQLport 54320
// no notes yet — add one in Notion and it'll land here
💻WinRMport 5985 / 59860
// no notes yet — add one in Notion and it'll land here
🖼️VNCport 59000
// no notes yet — add one in Notion and it'll land here
🪟X11port 60000
// no notes yet — add one in Notion and it'll land here
🟥Redisport 63790
// no notes yet — add one in Notion and it'll land here
💬IRCport 66670
// no notes yet — add one in Notion and it'll land here
🛋️CouchDBport 59840
// no notes yet — add one in Notion and it'll land here
🔎Elasticsearchport 92000
// no notes yet — add one in Notion and it'll land here
🧠Memcachedport 112110
// no notes yet — add one in Notion and it'll land here
🍃MongoDBport 270170
// no notes yet — add one in Notion and it'll land here
📡Other Servicesport —5
03
Web Exploitation
26 notes
OWASP Top 10 in practice — SQLi, XSS, SSRF, LFI/RFI, XXE, IDOR, SSTI, command/file-upload, auth bypass, JWT/OAuth, API/GraphQL, deserialization, path traversal, CMS (WordPress/Drupal/Joomla), WebDAV, and app-server bugs (Tomcat, IIS, Jenkins, Spring, Log4j).
// curated guides
04
Password Attacks
2 notes
Hash cracking, wordlists, spraying, brute force, credential re-use.
// curated guides
- 🔑Password Attacks Cheatsheetguide
- 🗝️Credentials Attack Chainguide
06
Shells & File Transfers
2 notes
Reverse/bind shells, TTY upgrades, file-transfer tricks, webshells.
// curated guides
- 🐚Shells & Payloadsguide
- 📤File Transfer Cheatsheetguide
07
PrivEsc — Linux
42 notes
Sudo, SUID, capabilities, cron, kernel, GTFOBins, LinPEAS.
// curated guides
08
PrivEsc — Windows
38 notes
WinPEAS, token abuse, service misconfig, UAC bypass, potato family.
// curated guides
09
Active Directory
49 notes
AD attack paths, Kerberos, BloodHound, ACLs, trusts, DCSync/DCShadow.
// curated guides
10
Pivoting & Tunneling
29 notes
Port forwarding, SOCKS, chisel, ligolo, proxychains, SSH tunnels.
// curated guides
13
Report & Methodology
3 notes
Exam report template, methodology, mental models, checklists.
// curated guides
99
Misc
9 notes
Notes that didn't match any category yet. Rename them or add keywords.
// curated guides

// full index

Looking for something specific? Search the full knowledge base.

Open notes →