oscp-methodology

Guides OSCP exam preparation with enumeration frameworks, privilege escalation vectors, and AD attack chains.

Updated Jun 5, 2026
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill oscp-methodology-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oscp-methodology
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/oscp-methodology
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill oscp-methodology-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Preparing for the OSCP/PEN-200 certification requires a repeatable penetration testing methodology, and candidates often fail due to poor enumeration habits, weak time management, or incomplete reporting rather than lack of technical knowledge. ## Core Features & Use Cases - Enumeration Framework: Applies the 3 attack vectors model (vulnerable versions, misconfigurations, sensitive information) with Nmap workflows and per-service checklists for ports 21 through 27017. - Privilege Escalation Playbooks: Covers 7 Linux vectors (sudo, SUID, capabilities, cron, credentials, internal ports, kernel) and 6 Windows vectors (token abuse, service misconfig, AlwaysInstallElevated, credential hunting). - AD Attack Chain & Exam Strategy: Walks through BloodHound enumeration, Kerberoasting, ADCS exploitation, delegation abuse, and DCSync, plus a 23h45m exam time plan and reporting checklist. - Use Case: During a practice lab, you gain a foothold on a Linux machine and feel stuck. Load the linux-privesc reference to systematically check sudo -l, SUID binaries, capabilities, and cron jobs before resorting to kernel exploits. ## Quick Start Ask the agent to walk you through the OSCP enumeration methodology for a target machine with open ports 22, 80, and 445.

Frequently Asked Questions about oscp-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prepare for the OSCP exam methodology?▼

Follow a repeatable cycle: enumerate the 3 attack vectors (vulnerable versions, misconfigurations, sensitive information), analyze, prioritize, attack, then re-enumerate. Spend 80% of time on enumeration and prioritize the AD set since it is worth 40 points.

What is the OSCP passing score and exam structure?▼

OSCP+ requires 70 out of 100 points. The exam includes an AD set worth 40 points (3 machines) and three standalone machines worth 20 points each, split between local access and proof flags. Partial credit combinations can reach passing.

How do I escalate privileges on Linux during OSCP?▼

Check vectors in priority order: sudo -l for NOPASSWD entries, SUID/SGID binaries via GTFOBins, Linux capabilities with getcap, cron jobs monitored with pspy64, credential hunting in config files, and internal listening ports. Kernel exploits are a last resort.

Is Metasploit allowed in the OSCP exam?▼

Metasploit is allowed on only one target machine during the exam. Auxiliary modules like scanners and fuzzers do not count toward this restriction. SQLMap and commercial tools like Burp Pro and Nessus are prohibited entirely.

What tools are recommended for Active Directory attacks in OSCP?▼

BloodHound with bloodhound-python for domain mapping, Impacket suite for Kerberoasting and AS-REP roasting, Certipy for ADCS exploitation, and netexec for SMB enumeration and password spraying. Run BloodHound collection early with the -c All flag.

Why do OSCP candidates fail despite compromising machines?▼

Poor reporting is a leading cause of failure. Screenshots must show IP, hostname, and flag in the same interactive terminal frame, and every step must be reproducible with exact commands. Web shell or RDP screenshots are not accepted as proof.