My 2 year OSCP journey is finally over!

griffondggriffondg Member Posts: 39 ■■□□□□□□□□
in Other Security Certifications
Received the glorious email this morning that I had finally passed. As the title states, I signed up for 90 days of access back in April of 2015. Was gung ho for a couple of months and then work, family, life intervened and I sort of half-assed my effort for the next 9-10 months, getting an extension or two but not really making more than token progress. Finally got serious about a year ago and took the exam...and failed hard. Took it THREE more times and came close to passing but couldn't get over the hump (insanity is doing the same thing over and over again and expecting different results). Put it aside again until February this year and I decided to start over from scratch in the labs and purchased 90 days. That was a very good decision and I learned so much more this time and really dedicated every waking moment out of work (and some at work!) to perfecting my methodology. Took the exam this weekend and got two full shells and two partial shells so I knew it would be VERY close, depending on how they score the partial shells. Including the 10 points for lab report and exercises I figured I had a minimum of 65 points and a maximum of 75, so was sweating waiting to get the email. Obviously I had enough.

It's frankly embarrassing to tell people you failed an exam multiple times, but let me tell you it's all worth it now.
· Share on FacebookShare on Twitter

Comments

  • UnixGuyUnixGuy Mod Posts: 4,570 Mod
    Well done! you didn't give up, and you got what you wanted. Now it's safe to say that your material very well

    Congratulations!!
    Certs: GSTRT, GPEN, GCFA, CISM, CRISC, RHCE

    Learn GRC! GRC Mastery : https://grcmastery.com 

    · Share on FacebookShare on Twitter
  • JoJoCal19JoJoCal19 Mod Posts: 2,835 Mod
    Congrats on the pass man! Good on never giving up!
    Have: CISSP, CISM, CISA, CRISC, eJPT, GCIA, GSEC, CCSP, CCSK, AWS CSAA, AWS CCP, OCI Foundations Associate, ITIL-F, MS Cyber Security - USF, BSBA - UF, MSISA - WGU
    Currently Working On: Python, OSCP Prep
    Next Up:​ OSCP
    Studying:​ Code Academy (Python), Bash Scripting, Virtual Hacking Lab Coursework
    · Share on FacebookShare on Twitter
  • SaSkillerSaSkiller Member Posts: 337 ■■■□□□□□□□
    Congratulations. How would you say your methodology changed?
    OSWP, GPEN, GWAPT, GCIH, CPT, CCENT, CompTIA Trio.
    · Share on FacebookShare on Twitter
  • griffondggriffondg Member Posts: 39 ■■□□□□□□□□
    Thanks guys!
    SaSkiller wrote: »
    Congratulations. How would you say your methodology changed?

    When it comes down it, passing the exam comes down to methodology and enumeration - you can get away with poor methodology in the labs but it will kill you on the exam. What do I mean by that?
    1. I used to scan a system and see something intersting like a web app running on port 80 and I was off to the races, looking for login pages, potential sql injection, etc and could easily spend hours going down a rabbit hole only to find out that there was another obvious atatck vector I overlooked because I jumped in without looking at the big picture on the server. There is an awesome post on the offsec forums where they break down an attack on one of the lab servers and it really opened my eyes.
    2. For privilege escalation don't just run one of the common priv esc scripts out there and expect it to do the work for you. They are good but they have limits and you need to understand how to manually enumerate a target.
    3. Don't assume just because a tool tells you X service is running on X port that it's true. You can make a banner say ANYTHING so always investigate all open ports even if they appear uninteresting. I can't go into specifics but let's just say this one bit me.
    · Share on FacebookShare on Twitter
  • NetworkNewbNetworkNewb Member Posts: 3,298 ■■■■■■■■■□
    Congrats Griffon!
    · Share on FacebookShare on Twitter
  • JoJoCal19JoJoCal19 Mod Posts: 2,835 Mod
    griffondg wrote: »
    Thanks guys!


    There is an awesome post on the offsec forums where they break down an attack on one of the lab servers and it really opened my eyes.

    Unless it violates their ToS, if you could copy that post scrub any specific machine identifying information, and post it here that would be awesome. It would really help to understand the flow of attack and way to attack the machines in the lab.
    Have: CISSP, CISM, CISA, CRISC, eJPT, GCIA, GSEC, CCSP, CCSK, AWS CSAA, AWS CCP, OCI Foundations Associate, ITIL-F, MS Cyber Security - USF, BSBA - UF, MSISA - WGU
    Currently Working On: Python, OSCP Prep
    Next Up:​ OSCP
    Studying:​ Code Academy (Python), Bash Scripting, Virtual Hacking Lab Coursework
    · Share on FacebookShare on Twitter
  • griffondggriffondg Member Posts: 39 ■■□□□□□□□□
    JoJoCal19 wrote: »
    Unless it violates their ToS, if you could copy that post scrub any specific machine identifying information, and post it here that would be awesome. It would really help to understand the flow of attack and way to attack the machines in the lab.

    The post is so detailed that I don't really think I can do it justice by summarizing. Seriously, it's 3 pages of forum posts dedicated to exploiting one machine!
    · Share on FacebookShare on Twitter
  • JoJoCal19JoJoCal19 Mod Posts: 2,835 Mod
    griffondg wrote: »
    The post is so detailed that I don't really think I can do it justice by summarizing. Seriously, it's 3 pages of forum posts dedicated to exploiting one machine!

    Can you give me a thread number or title? Will be signing up after my CISA and PMP exams are done in the next 2 months or so and would like to reference it.
    Have: CISSP, CISM, CISA, CRISC, eJPT, GCIA, GSEC, CCSP, CCSK, AWS CSAA, AWS CCP, OCI Foundations Associate, ITIL-F, MS Cyber Security - USF, BSBA - UF, MSISA - WGU
    Currently Working On: Python, OSCP Prep
    Next Up:​ OSCP
    Studying:​ Code Academy (Python), Bash Scripting, Virtual Hacking Lab Coursework
    · Share on FacebookShare on Twitter
  • dialecticaldialectical Member Posts: 55 ■■□□□□□□□□
    I would fail this exam no matter how many times I took it. Not embarrassing. This is a serious achievement!

    Also you have something to talk about if asked in an interview about "a time that you overcame failure".
    · Share on FacebookShare on Twitter
  • griffondggriffondg Member Posts: 39 ■■□□□□□□□□
    JoJoCal19 wrote: »
    Can you give me a thread number or title? Will be signing up after my CISA and PMP exams are done in the next 2 months or so and would like to reference it.

    It's at htttps://forums.offensive-security.com. Once you register for the course you will get access to it under: Pentesting With Kali > Lab Machines > Public Network > 10.11.1.71 and it's the sticky at the top of the page.

    Good luck!
    · Share on FacebookShare on Twitter
  • griffondggriffondg Member Posts: 39 ■■□□□□□□□□
    dialectical wrote: »
    I would fail this exam no matter how many times I took it. Not embarrassing. This is a serious achievement!

    Also you have something to talk about if asked in an interview about "a time that you overcame failure".

    If you want it bad enough you can pass it so don't sell yourself short!
    I'll have to remember that the next time I'm in an interview, lol
    · Share on FacebookShare on Twitter
  • MooseboostMooseboost Member Posts: 778 ■■■■□□□□□□
    Congrats on the pass man. That is definitely some persistence.
    · Share on FacebookShare on Twitter
  • Blade3DBlade3D Member Posts: 110 ■■■□□□□□□□
    Congrats man, this seems to be the exact same thing happening to me. I signed up for 90 days back in July or August of 2015, didn't get through much. I then signed up for 30 days 2 more time in the next 5-6 months and didn't accomplish anything really. I've been considering getting another 30 days, busting my ass, and getting through it. This is a cert that really interests me, it's just hard to dedicate the time.
    Title: Sr. Systems Designer
    Degree: B.S. in Computing Science, emphasis Information Assurance
    Certifications: CISSP, PSP, Network+, Security+, CySA+, OSWP
    · Share on FacebookShare on Twitter
  • griffondggriffondg Member Posts: 39 ■■□□□□□□□□
    Thanks guys
    Blade3D wrote: »
    Congrats man, this seems to be the exact same thing happening to me. I signed up for 90 days back in July or August of 2015, didn't get through much. I then signed up for 30 days 2 more time in the next 5-6 months and didn't accomplish anything really. I've been considering getting another 30 days, busting my ass, and getting through it. This is a cert that really interests me, it's just hard to dedicate the time.
    I totally understand. I have a wife and 3 kids so finding time and motivation was always a struggle. In the end I just forced myself to dedicate time and effort to it to get it done. If I were you I would set an exam date to force yourself to get prepared. Even if you fail you will learn so much during the exam and hey, the retakes are only $60 each. Believe me, I know ;)
    · Share on FacebookShare on Twitter
  • ChilltechChilltech Member Posts: 8 ■□□□□□□□□□
    Congrats man! No shame in failing trying to achieve something great. much respect.icon_thumright.gif
    · Share on FacebookShare on Twitter
  • Blade3DBlade3D Member Posts: 110 ■■■□□□□□□□
    Thanks, I've been considering reupping after my vacation this weekend. I could spend June working on it and take it the 4th extended weekend. I'm leaning heavily towards doing this, just don't want to waste anymore money. I passed the CISSP almost 2 months ago so I need to start working on something. I'm also considering getting a Master's degree from WGU but I don't really have the money at this time, thinking I'll wait and hopefully find a new job that would pay for most of it.
    Title: Sr. Systems Designer
    Degree: B.S. in Computing Science, emphasis Information Assurance
    Certifications: CISSP, PSP, Network+, Security+, CySA+, OSWP
    · Share on FacebookShare on Twitter
  • chrisonechrisone Member Posts: 2,278 ■■■■■■■■■□
    griffondg wrote: »
    It's frankly embarrassing to tell people you failed an exam multiple times

    its only embarrassing if you quit and gave up after failing. icon_thumright.gif

    Congrats on your victory! It was a long and tough road but I am sure you learned a few things about how to stay focused etc
    Certs: CISSP, EnCE, OSCP, CRTP, eCTHPv2, eCPPT, eCIR, LFCS, CEH, SPLK-1002, SC-200, SC-300, AZ-900, AZ-500, VHL:Advanced+
    2023 Cert Goals: SC-100, eCPTX
    · Share on FacebookShare on Twitter
  • Dr. FluxxDr. Fluxx Member Posts: 98 ■■□□□□□□□□
    You would probably make one of the best teachers out there as a tutor for the exam.
    Id say youre a valuable asset.
    · Share on FacebookShare on Twitter
  • griffondggriffondg Member Posts: 39 ■■□□□□□□□□
    Thanks for the love, guys! I mainly posted my story so others in the same boat know that it's possible to tame this beast if you really want it. Just received my certificate in the mail yesterday and let me state again it's all worth it :)
    · Share on FacebookShare on Twitter
  • LonerVampLonerVamp Member Posts: 518 ■■■■■■■■□□
    Grats on the hard work, learning, and win! :)
    Security Engineer/Analyst/Geek, Red & Blue Teams
    OSCP, GCFA, GWAPT, CISSP, OSWP, AWS SA-A, AWS Security, Sec+, Linux+, CCNA Cyber Ops, CCSK
    2021 goals: maybe AWAE or SLAE, bunch o' courses and red team labs?
    · Share on FacebookShare on Twitter
  • JasminLandryJasminLandry Member Posts: 601 ■■■□□□□□□□
    Congrats on the pass! Good to know you didn't give up and kept going at it.
    · Share on FacebookShare on Twitter
  • golab011golab011 Registered Users Posts: 2 ■□□□□□□□□□
    Did you met that "lazy admin" too ? :)
    · Share on FacebookShare on Twitter
  • griffondggriffondg Member Posts: 39 ■■□□□□□□□□
    golab011 wrote: »
    Did you met that "lazy admin" too ? :)

    I did on the exam before and didn't get I but after looking at my notes I think I figured out how to get a shell and was hoping to get it again.
    · Share on FacebookShare on Twitter
  • golab011golab011 Registered Users Posts: 2 ■□□□□□□□□□
    I also thought same after first encounter, but second time met him again without success
    · Share on FacebookShare on Twitter
  • Paolo264Paolo264 Member Posts: 13 ■□□□□□□□□□
    Never ever ring the bell... well done.
    CISSP | CRISC | ISO27001 Lead Implementer
    · Share on FacebookShare on Twitter
Sign In or Register to comment.