OSCP One Month in, First Thoughts
Skip first paragraph if you dont care about my background.
Whenever I read threads about taking certs I always wonder the backgrounds of the people taking it so I thought I would provide it. Currently in my 30's started on a helpdesk in my 20s moved to network engineering primarily worked on firewalls did routing and switching got a bunch of Cisco certs 5+ years was "senior network engineer". Wanted career change moved into a SOC, worked a year there and then took over a security engineer position, primary blue team stuff, implemented SIEMs, incident response products blah blah. Company paid for SANS certifications, was able to knockout GCIA due to my network background pretty easily, GCIH and CEH came after, 7-8 months ago I took GPEN and passed. As for GPEN, this test IMO was very easy if you made an index, I really feel like someone could pass it without doing any labs and not really retaining the information but thats another matter.
_________________
The OSCP contains a PDF document with videos and access to their lab, PDF is like 375 pages. I now fully understand why people complain about the PDF and "lack" of information. The PDF from the very beginning encourages outside research, literally a 50-50% split at minimum. I have no problem with this concept however it is frustrating when trying to learn a concept following the PDF and hitting a wall. For example, the PDF will say "Do X and you will get Y", if you then follow what it says you "Do X and get Z". I was confused at first and spent a large amount of time banging my head against walls re-installing VM's thinking I was missing something, then reading further in the PDF you realize you are supposed to run into these problems and research how to get around them. This isn't really clear and is re-enforced by the try harder method. I think a disclaimer or something saying "not all exercises will work out the box" would alleviate some stress on people. I get that "its a pentest you will always run into walls" but people are used to a study guide so it would save some people headaches if that was reinforced.
After about a week of going all over the place I found a rhythm I liked, my plan was to fully complete all exercises in the PDF first then step into the lab. I had already rooted a couple boxes using metasploit but decided to focus on exercises first. Some of the exercises were very difficult for me and from what I see on OSCP forums they are difficult for everyone. Buffer overflows for example are a totally foreign concept to me in terms of actual coding. From GPEN we did some buffer overflow exercises but they were normally run via metaploit and were more "fire and forget", we didnt use immunity debugger in the GPEN class. I have a very limited background with coding (CS degree but it was years ago), I literally would have to google the syntax for hello world in any programming language but I am doing well with being able to read python which appears to be critical. From what I am seeing in exploit-db and most of the exercises you can do almost anything with python. Any metasploit exploit that I am able to get working I have been trying to find python versions or write my own which will be beneficial for the exam.
I have now finished the PDF with the exception of one buffer overflow exercise which is causing me problems but I am slowly learning the ins and outs of debugging programs which is something I never did previously. I am very excited to get into the labs and start popping more boxes. The most important thing that has helped me is really planning out enumeration scripts and a process. I think time management is critical, when I started messing around with a box Id realize ive spent 3-4 hours running scripts back and forward having to retake notes and it really wastes time. When the exam is X number of machines and you have 24 hours time management is critical.
The last thing I will mention is access to the OSCP forums, in the forums you can post questions and read about others experience with each individual machine, this is good and bad, its bad imo because you could just use the forums to find every single answer to a lab machine, a large number of times someone posts the exact exploit needed to get in or they mention it in the title of a post which is annoying if you want to find out yourself. The good thing about this is if you are stuck or having problems you can go and get hints from the forums that are much more in detail that "try harder". IMO the forums should be a "last resort" and can give you a hint in the right direction, if you do nothing but read all the forum posts I think you will find the exam extremely difficult.
This has kind of become a rambling post but I will be happy to provide more updates or answer any questions that don't break the rules of the OSCP.
