OSCP+: a practical technical 12-week plan that works

A 12-week OSCP+ study plan must develop more than techniques. It needs to improve enumeration speed, note quality and the ability to reproduce a complete compromise. OffSec’s official plan estimates roughly 20–24 hours per week and concludes with an exam simulation on a retired OSCP set.

This roadmap retains the PEN-200 scope while adding measurable gates. If fewer hours are available, extend it to 24 weeks instead of skipping practice.

Week 1: methodology and enumeration

Build templates for hosts, services, credentials and evidence. Practise Nmap, DNS, SMB, SMTP and SNMP, but attach a next hypothesis to every result.

Gate: produce a service map and a probability-ordered test list for an unknown host within 30 minutes. Every command in the notes should be reproducible.

Weeks 2–3: web applications and SQL injection

Cover directory traversal, LFI/RFI, uploads, command injection, XSS, APIs and SQL injection. Go beyond memorised payloads. Identify the execution context: path, shell, SQL expression, parser and process privilege.

Gate: move from a raw HTTP request to a minimal confirmed PoC without an automated scanner. Preserve the request and response required for reporting.

Weeks 4–6: Linux and Windows privilege escalation

On Linux, systematically inspect sudo, SUID, capabilities, scheduled jobs, services, mounts, secrets and kernel versions. On Windows, examine services, ACLs, tokens, scheduled tasks, registry, installers, credentials and local vulnerabilities.

Treat scripts as enumerators, not oracles. Validate every finding manually and understand its prerequisite.

Gate: complete two machines consecutively—one per operating system—without walkthroughs, with a full report and a four-hour limit per host.

Week 7: passwords and AV evasion

Practise targeted wordlists, hash identification, cracking, Pass-the-Hash and Net-NTLMv2. For AV, understand static and behavioural detection rather than relying on one loader.

Gate: for every discovered secret, identify its format, a safe validation method and systems where reuse is plausible.

Week 8: pivoting and tunnels

Practise local, remote and dynamic forwarding with SSH, socat, sshuttle, plink and netsh. Diagram the packet path: source, listener, tunnel and destination.

Gate: scan a service in a second subnet and run a multi-connection tool through the tunnel without exposing a listener broadly.

Weeks 9–10: Active Directory

Cover Kerberos, NTLM, SPNs, shares, ACLs, delegation, group relationships, PowerShell, WMI, WinRM, PsExec, Pass-the-Hash, Overpass-the-Hash, Pass-the-Ticket and Golden Ticket in labs.

The access graph matters most. Track principal, credential source, privileges, reachable hosts and the next step. Re-enumerate after every movement.

Gate: complete a three-host chain from the supplied identity to the domain objective, then reproduce it the next day using only your notes.

Week 11: assemble the pieces

Attempt mixed scenarios without a technology hint. Train target switching when one hypothesis stops producing evidence. Define a limit such as 90 minutes without a new signal before resetting enumeration.

Build the exam checklist, directory scaffolding, basic recon script and OSCP+ report template. Automate organisation, not judgement.

Week 12: full simulation

OffSec recommends attempting OSCP A, B or C in under 24 hours. Preserve exam-like conditions: permitted resources, deliberate breaks, real-time evidence and report writing after the technical portion.

After the simulation, measure:

points gained within the time limit;
time to first flag;
time lost on unsupported hypotheses;
steps that cannot be reproduced;
screenshot and proof-panel completeness;
time needed for the final PDF.

The daily learning system

End each session with a short retrospective: what was missed, which clue led to the solution and how to recognise it again. The next day, reproduce the critical step from memory before reading notes.

Avoid collecting hundreds of context-free commands. A small runbook with prerequisites, expected output and error interpretation is far more useful.

When to book

Book when two consecutive simulations exceed 70 points, reports are produced without chaos and a missing exploit does not stop further enumeration. Read the current OSCP+ exam guide immediately before the date because requirements and submission workflow can change.

Sources: OffSec PEN-200 Learning Plan — 12 Week, PEN-200 Syllabus, OSCP+ Exam Guide.