Free OSCP study course: the Breachroad Academy Pentester Path

If you are searching for an OSCP course or study path, you probably need more than another list of tools. You need a sequence that connects networking and Linux to enumeration, web applications, privilege escalation, Active Directory, pivoting, evidence and the final report.

The Breachroad Academy Pentester Path is designed as that knowledge map. It currently contains 38 modules, 404 sections and about 382 hours of material. It begins with the fundamentals and ends with “OSCP+ Exam Operations and Knowledge Capstone.” Access is free, every section has a defined purpose and each module concludes with an explained knowledge check.

One qualification matters: the Academy is an independent Breachroad course, not official OffSec training. It does not issue the OSCP certification, and it does not replace authorised PEN-200 content or hands-on practice in legal labs. It builds and organises the knowledge that a candidate must then apply under time pressure.

What OSCP is and what it actually demands

OSCP is a certification of practical ethical-hacking and penetration-testing ability. Under the current OffSec Exam Guide, the OSCP+ assessment takes place in a private VPN, gives the candidate 23 hours and 45 minutes for the technical work, and provides another 24 hours to upload documentation.

The current structure has three stand-alone machines worth 60 points in total and a three-host Active Directory set worth 40. A passing score is 70. Access alone is not enough: OffSec requires proof and a professional report from which a technically competent reader can reproduce the work.

That is why preparation cannot be a command catalogue. Candidates need five layers of capability:

1. A technical model — understanding networks, systems, applications, identity and trust boundaries.
2. A method — moving from observation to hypothesis, test and conclusion.
3. Tool fluency — using tools efficiently while understanding what their output means.
4. Evidence discipline — keeping every significant step reproducible and reportable.
5. Performance under pressure — setting priorities, time limits, breaks and target-switching rules.

The Pentester Path structures the first four and helps establish a system for the fifth. Pressure tolerance still requires practice and full simulations.

How the OSCP study path is organised from beginner level

The curriculum does not begin with an exploit. It first explains what makes a penetration test legal, how scope and Rules of Engagement work, and why a minimal safe proof is better than uncontrolled action. That matters for OSCP too: technique without method leads to wasted time, inconsistent evidence and a weak report.

Stage 1: foundations, systems and methodology

The opening modules cover cybersecurity fundamentals, the penetration-testing process, workstation setup, Windows, Linux, networking, notes, evidence and reporting. You learn to separate a fact from a hypothesis, maintain a timeline and record a result so that you can reproduce it the next day.

For a beginner, this bridges the gap between “I know several commands” and “I can conduct a coherent assessment.” For an administrator or developer, it reorganises existing knowledge from an attacker’s perspective.

Stage 2: reconnaissance and enumeration

The next group covers OSINT, Nmap, network protocols and common services. Memorising every switch is not the objective. The useful questions are: what do I know, what remains unknown, which test yields the most information, and what result would disprove my current hypothesis?

This habit reduces random tool use. Both an exam and a real engagement reward a complete attack-surface model, not a single scan performed at the beginning.

Stage 3: web applications

The path covers web information gathering, proxies, content discovery, authentication, SQL injection, XSS, path traversal, file inclusion, uploads, command injection, advanced web attacks, APIs and business logic.

Each topic is presented as a mechanism and a decision. Rather than memorising one payload, you learn the input context, trust boundary, minimum confirmation, impact, remediation and detection opportunities. That knowledge transfers to an application you have never seen before.

Stage 4: access, credentials and movement

Modules on file transfers, shells, Metasploit, password attacks, common services and pivoting connect initial access to the rest of an engagement. The material explains what a tool does and where its output stops being authoritative. Automation should support analysis, not make every decision for the candidate.

Pivoting is taught as a flow: source, listener, tunnel, destination interface and service. That model makes it possible to diagnose a failure instead of copying the next unrelated example.

Stage 5: Active Directory

Active Directory represents 40 percent of the current OSCP+ points, so it cannot be an afterthought. The Academy covers the domain model, Kerberos, NTLM, shares, SPNs, ACLs, delegation, group relationships, attack paths and lateral movement.

The intended outcome is not a list of techniques but an access graph: who can do what, on which host, for what reason, and what the next safe test should be. Every new account or permission changes the context and should trigger fresh enumeration.

Stage 6: Linux and Windows privilege escalation

Dedicated modules teach a systematic escalation process. On Linux that includes areas such as sudo, SUID, capabilities, scheduled jobs, services, secrets and the kernel. On Windows it covers services, permissions, tokens, registry settings, scheduled tasks, credentials and local administrative boundaries.

The essential skill is recognising prerequisites and validating the finding. An enumeration script may produce a lead, but the candidate must explain why a path works, the access it provides and how to document the proof.

Stage 7: exploits, defensive context and the complete engagement

The advanced part of the path covers public-exploit research and safe triage, adaptation and debugging, client-side attack surface, AV and EDR, white-box review, cloud and hybrid identity foundations, containers and Kubernetes.

Not every area has equal weight in the exam, but each strengthens professional judgement. Learners practise distinguishing a functioning PoC from a reliable finding, considering remediation and detection, and running an enterprise network test as one coherent engagement.

The last module brings together OSCP+ exam operations, point strategy, time management, evidence, report rules and the final knowledge check.

How to use the Academy when OSCP+ is the goal

Diagnose first instead of choosing topics by intuition

An experienced administrator may move quickly through operating-system foundations but discover gaps in web security. A web developer may understand HTTP yet struggle with networking and Active Directory. Complete knowledge checks and record wrong decisions. They should determine the revision order.

Keep one note system from the first module

For every mechanism, record the prerequisite, signal, validation method, expected result, alternative explanation, minimum proof and remediation. In a lab, add the host address, identity, time and exact steps. A good report is assembled during the work, not reconstructed after the session ends.

Pair knowledge with authorised practice

The Academy intentionally requires no lab downloads or external training accounts. That keeps the knowledge accessible, but OSCP is a practical exam. After learning a module, practise the corresponding area only in systems you are explicitly authorised to test: official labs, an isolated environment you own, or a training platform whose terms permit the activity.

Measure gates, not consumed content

Completing 404 sections does not automatically equal readiness. Better gates include:

• producing a service map and ordered hypotheses for an unknown host within 30 minutes;
• completing two consecutive machines without a walkthrough;
• reproducing a path the next day using only your notes;
• writing a report with complete evidence, commands, output and impact;
• running a full timed simulation with breaks and final PDF export;
• exceeding the target threshold in two consecutive simulations, not just once.

Use the 12-week OSCP+ study plan for a schedule and the OSCP+ exam report guide for evidence discipline.

Common mistakes in OSCP preparation

Collecting tools instead of building a process. A tenth enumeration script will not help if the first result is not interpreted.

Postponing report practice. A candidate can reach the technical objective and lose points through missing evidence. Start reporting with the first machine.

Skipping fundamentals. Weak DNS, routing, operating-system permissions or HTTP knowledge will reappear as blockers across several later topics.

Learning only from walkthroughs. A solution feels obvious after someone else has chosen the correct hypothesis. Independent sessions need wrong turns, a time limit and a deliberate analysis reset.

Failing to revisit material. Recognising a technique in a lesson does not guarantee that you can apply it one week later. Return to failed questions and reproduce critical reasoning from memory.

Using prohibited resources during the exam. The current Exam Guide prohibits AI chatbots in OSCP+. A tool that assists study before the exam is not necessarily permitted during the assessment. Always review the rules shortly before the scheduled date.

Can a free course meaningfully support OSCP preparation?

The price of content does not determine preparation quality. What matters is coverage, factual accuracy, sequencing, knowledge checks and transfer into independent practice. Breachroad Academy supplies a structured map, worked scenarios with remediation and detection, and a knowledge check after every module. That reduces chaos and makes gaps visible earlier.

No honest course can guarantee a result. OSCP assesses work in an unfamiliar environment, documentation and decision-making under pressure. The useful model is:

Academy structures knowledge → authorised labs build fluency → simulations test readiness → the current Exam Guide defines the rules.

Start with one path instead of another random tutorial

If you are new, open the first module and follow the sequence. If you already have experience, review the curriculum, complete the checks and create a gap-based plan. You do not need a perfect lab or one hundred browser tabs on day one.

Start the free Pentester Path in Breachroad Academy and use it as the central map for your preparation. Our 2026 OSCP+ exam guide explains the current format, scoring and restrictions in more detail.

The Pentester Path is independent Breachroad material. OSCP, OSCP+ and PEN-200 belong to the OffSec ecosystem; curricula, prices and rules may change. The current vendor documentation governs the exam.

Primary sources: OffSec OSCP+ Exam Guide, OffSec PEN-200. The 38-module, 404-section and 382-hour figures come from the current Breachroad Academy curriculum on October 21, 2026.