One of the questions I see almost every week goes something like this:
"I've completed dozens of Proving Grounds machines. I've worked through my HTB machine. I still need hints sometimes and occasionally peek at walkthroughs. My OSCP exam is coming up... am I actually ready?"
I understand the anxiety because almost every serious OSCP candidate reaches this point.
And here's the truth.
I don't think anyone ever feels completely ready.
I've spoken to candidates who passed on their first attempt, candidates who needed two attempts, and even experienced penetration testers who walked into the exam convinced it would be straightforward. Almost all of them admitted they felt the same uncertainty before clicking "Start Exam."
The problem is that most people use the wrong metric to measure readiness.
Stop Counting Machines
The cybersecurity community loves numbers.
"I've rooted 100 machines."
"I finished TJ Null."
"I completed every PG Practice box."
Those numbers sound impressive, but they don't answer the only question that actually matters.
What happens when you get stuck?
That's the real OSCP exam.
Anyone can follow a walkthrough and reproduce an exploit after watching someone else demonstrate it.
The exam measures something completely different.
Can you sit in front of a target for two hours with no obvious attack path and still continue thinking logically?
Can you step back, start enumerating again, question your assumptions, and eventually discover something you missed?
That skill, not exploitation, is what separates candidates who pass from candidates who panic.
Walkthroughs Aren't the Enemy
One of the biggest misconceptions I see is people believing that using walkthroughs automatically means they're not ready.
I don't agree.
Walkthroughs are excellent teachers but only if you use them correctly.
If you read a walkthrough, copy the commands, collect the flag, and move on to the next machine, you've learned almost nothing.
Instead, I recommend treating every walkthrough like an incident postmortem.
Ask yourself:
- Why didn't I discover this attack path?
- What part of my enumeration failed?
- What assumption caused me to stop looking?
More importantly, could I reproduce this machine tomorrow without reading the walkthrough again?
That last question is critical.
One technique I recommend is what I call the 24-hour rule.
If you needed a hint today, reset the machine tomorrow. Don't look at your notes. Don't look at the walkthrough. See if you can compromise the machine entirely from memory and methodology.
If you can, then the lesson has become yours. If you can't, you probably memorized commands instead of understanding the process.
Enumeration Wins the Exam
Whenever candidates ask me what the hardest part of OSCP is, they're usually expecting me to say privilege escalation or Active Directory.
Most of the time, I don't. Enumeration is where candidates quietly lose the exam.
Think about your own workflow.
You launch Nmap.
You find ports 22, 80, and 445.
Now what?
Strong candidates don't stop there. Every open port immediately becomes multiple investigation paths.
A web server isn't simply "port 80." It's directory brute forcing.
Virtual host discovery. Technology fingerprinting. Source code inspection. Backup files. Response headers. Configuration files.
The same applies to SMB, LDAP, Kerberos, WinRM, MSSQL, FTP, or any other exposed service.
Every discovered service should trigger an almost automatic checklist. The goal is to build muscle memory for investigation.
Automation Helps and Thinking Wins
I absolutely recommend using tools like LinPEAS, WinPEAS, Seatbelt, JAWS, and other enumeration frameworks.
They save time. They identify low-hanging fruit.
But here's where candidates become overconfident. They assume the tool has already done the thinking.
It hasn't. I always encourage analysts to manually verify important findings. Check SUID binaries yourself. Review scheduled tasks. Inspect service permissions. Understand why a privilege escalation works rather than simply executing it. Automation accelerates methodology. It should never replace methodology.
The Hidden Skill Nobody Talks About
The OSCP exam is as much psychological as it is technical. I've seen candidates spend twelve hours finding a single foothold before suddenly compromising the remaining environment within the next two hours.
I've also seen candidates root multiple machines quickly and then completely freeze after hitting one difficult target. Neither scenario is unusual. Momentum changes constantly during the exam.
The worst thing you can do is convince yourself you're failing simply because the first few hours went badly. OSCP rewards persistence. Not speed.
Mock Exams Matter More Than You Think
If you have access to the official challenge sets like A, B, and C, treat them like the real exam.
Don't casually solve them over multiple evenings. Simulate exam conditions. No hints. No Discord. No Google. No walkthroughs. Strict time limits. The goal isn't simply passing the challenge.
The goal is learning how your brain behaves under pressure. Do you panic? Do you tunnel vision? Do you stop documenting? Do you begin skipping enumeration? Those habits become very obvious during realistic simulations.
Your Notes Become Your Second Brain
One piece of advice that almost every successful candidate repeats is surprisingly simple.
Write better notes. Not because you'll forget commands. You'll forget your thinking. During the exam, stress affects memory far more than most people expect. Well-organized notes let you recover instantly.
Instead of wondering, "How did I enumerate LDAP last month?" you simply open your notes and continue working.
Your notes shouldn't just contain commands. They should answer three questions:
- What am I looking at?
- Why am I running this command?
- What should I investigate based on the results?
That's how notes become operational instead of becoming a collection of copied cheat sheets.
Here's the Question I Would Ask Instead
If you asked me whether you're ready for OSCP, I wouldn't ask how many machines you've completed.
I'd ask something much simpler. Can you attack an unfamiliar machine without immediately reaching for a walkthrough? Can you remain methodical after three hours without progress? Can you identify what your enumeration missed after reviewing a hint? Can you explain why an exploit works instead of simply executing it?
If your answer is becoming "yes" more often than "no," then you're probably much closer than you think. Because passing the OSCP has never been about memorizing hundreds of exploits. It's about becoming the kind of penetration tester who refuses to stop asking one more question, checking one more service, or investigating one more possibility before giving up.
That's the mindset the exam rewards. Everything else is just practice.
0 comments