What the OSCP Actually Tests (And Why That Changes Everything)

Before discussing preparation, you need to recalibrate your mental model of what the OSCP is.

OSCP is much more CTF-like methodology and enumeration discipline than real-world pentest experience. This reframe matters enormously for how you prepare. The OSCP is not primarily testing whether you can execute a real-world penetration test engagement with client scoping, report writing polish, and business context awareness. It is testing whether you can:

• Enumerate targets thoroughly and systematically
• Identify exploitable attack surfaces from that enumeration
• Execute privilege escalation correctly once you have initial access
• Document your findings clearly enough to satisfy the report requirement

That's the entire exam in four bullet points. The implication is significant: a SOC analyst who prepares correctly for these specific skills has every realistic chance of passing, while a penetration tester with three years of experience but undisciplined enumeration habits might not.

You don't necessarily need prior pentest job experience to pass OSCP if you approach the preparation seriously and grind the right material.

The Preparation Path (One of many)

First 4 Months: Complete the HackTheBox CPTS (Certified Penetration Testing Specialist). This is a substantial commitment ; the material is massive but you could spend less than that.

Month 5: Complete the full OSCP PEN-200 course. After CPTS, most of PEN-200 feels like revision. The CPTS path covers overlapping material at comparable depth.

If you can, try also to Complete the HTB CWES (Certified Web Exploitation Specialist) course.

Month 6 - Month 9: Pure machine grinding; aim for approximately 150 machines across HackTheBox, Proving Grounds Practice, Proving Grounds Play, and VulnLab.

Two Weeks Before Exam: Pass the CWES exam, complete remaining machines, take a few days off.

First Weekend of Month 10: You should have received your OSCP test results.

The total active preparation window from starting CPTS to taking OSCP could be approximately nine months (in our current scenario). That context matters here because  the preparation is coming from "a SOC analyst role" without initially clarifying that CPTS and CWES are part of the preparation stack. 

The Resource Stack: What to Use and Why

HTB Academy Penetration Tester Path (Essential)

The most important part of your preparation could be the HTB Academy Penetration Tester path. This is the foundation of the CPTS certification and covers the full attack methodology that the OSCP expects.

The specific module that is flagged as the best Active Directory preparation: the Active Directory Enumeration and Attacks module from HTB Academy.  AD is a substantial component of the OSCP exam; don't underprepare for it.

The Machine List (Non-Negotiable Practice)

150 machines. This is the number that defines serious OSCP preparation in the current community consensus. Working through this list across multiple platforms matters because, OffSec and PG machines are a different ballgame. Initial foothold is a nightmare. The standard of enumeration just seems higher for OffSec.

HTB machines tend to reward creative exploitation. OffSec machines tend to reward deep, systematic enumeration. You need experience with both styles.

CWES (Optional for OSCP, Recommended Anyway)

You don't need HTB CWES for OSCP. Web exploitation is tested in OSCP but not at the depth CWES prepares you for. Include it if you want to build a genuinely strong web application skill set ; it will make the web-based machines easier and sets up future certification paths. Skip it if you're purely optimizing for OSCP pass rate on a time-constrained schedule.

PEN-200 Course

Complete it. If you've done CPTS first, a large portion will feel like revision, which is a good sign ; it means your preparation was sufficient. Don't skip modules assuming overlap. Go through everything methodically and use the lab time included with your subscription.

OSCP Notes

The OSCP study notes & guide V11 is an all-in-one preparation resource that reflects the latest exam structure, including the OSCP+ update. Candidates need to gain proficiency in enumeration, exploitation, privilege escalation, and reporting to succeed in the 24-hour practical exam.

The One Thing That Wins or Loses the Exam

The hardest part of the exam for many is enumeration. Privilege escalation could be relatively straightforward once you understand what you are dealing with, but enumeration is where you win or lose. Enumerate properly, enumerate deeply, enumerate consistently.

The exam pushes you to try-harder during enumeration and not expect that it's not worth it to turn every stone. Practically, what does deep enumeration mean?

For network services: don't stop at the first open port. Run full port scans. Check UDP. Enumerate every service version. Look for unusual ports that nothing obvious is listening on ; those are often where the foothold lives.

For web applications: directory brute force with multiple wordlists, not just one. Enumerate file extensions. Check for backup files. Look at response headers. Check robots.txt, sitemap.xml, and any configuration files that might be accessible.

For privilege escalation: run enumeration tools (LinPEAS, WinPEAS), but don't only run them. Manually check SUID binaries, writable cron jobs, services running as privileged users, and token privileges on Windows. The automated tools miss things.

When you're stuck: On one machine you could completely run out of enumeration ideas and just couldn't move forward. That happens. You move on, secure the points you can, and keep pushing. OSCP is designed to be passable without solving every machine. Banking points on the machines you can solve and managing time on the ones you can't is part of the exam strategy.

The SOC-to-OSCP Transition

The transferable skills from SOC work are real but specific. As a SOC analyst you understand:

• Network traffic patterns and what anomalous behavior looks like
• How attackers move through environments post-compromise (from analyzing alerts)
• Log analysis and the ability to read event data for behavioral signals
• The attacker mindset from the defensive side ; you know what defenders look for

What SOC work doesn't give you is hands-on offensive technique execution. You can know theoretically how Kerberoasting works from writing detection rules for it.

You cannot pass OSCP on that theoretical knowledge. You need to execute the technique under exam conditions, troubleshoot when it fails, and adapt when the environment doesn't behave as expected.

That gap is exactly what the preparation resources listed above close. The CPTS path and machine grinding convert defensive knowledge into offensive execution capability. 

Struggling With the Practice Machines: What to Do

Many OSCP candidates share privately: they've completed CPTS, purchased OSCP, and still can't solve Proving Grounds machines without walkthroughs.

To overcome this, study the basic enumeration technique well. Don't rush, take it slow, and trust the process. Most community-rated easy machines are really based on enumeration techniques and reading Nmap outputs.

If you're relying on walkthroughs for every machine, the problem is almost certainly enumeration depth, not exploitation knowledge. You're probably stopping too early — finding one or two services, noting them, and then going to the walkthrough when nothing obvious presents itself. The machine you "couldn't solve" often has a foothold sitting in a service you didn't enumerate thoroughly enough.

The prescription:

1. Before looking at any walkthrough, make sure you've scanned all 65,535 TCP ports, not just the default top 1,000.
2. For every service discovered, run service-specific enumeration scripts.
3. For any web service, run directory brute force before concluding there's nothing there.
4. Document every finding, even the seemingly irrelevant ones.

If you've done all of that and still can't find the foothold — then look at the walkthrough, but use it to understand what you missed in enumeration rather than just copying the exploit path.

Realistic Timeline Expectations

Starting from SOC background with no CTF experience: Allow 8–12 months of serious preparation. Not 8–12 months of casual study ; structured, consistent preparation involving course completion and machine grinding.

If CPTS is part of your path: 4–5 months for CPTS completion is reasonable given the material volume. Budget accordingly before starting the OSCP subscription.

Machine grinding phase: 90–120 days completing 100–150 machines from the LainKusanagi list.

Before the exam: Take a few days off. Exam performance on sleep debt is worse than exam performance after genuine rest.

The Bottom Line

The OSCP is achievable from a SOC background. The exam tests disciplined enumeration, methodology execution, and persistence not years of client-facing pentest work. 

The OSCP rewards methodical preparation and punishes shortcuts. If you're coming from a SOC role and willing to put in the work, the exam is genuinely within reach.

Start with the HTB Academy Penetration Tester path. Build the enumeration muscle memory. Grind the machines. The certificate follows.