OSCP+ Review — I Failed the First Time, Passed on the Second, and Here’s Everything I Learned

This is my honest review of the OSCP+ certification — including the attempt I failed, the methodology that got me through the second time, and every tool I had ready before I started.

If you're preparing for the OSCP, bookmark this. I'm giving you the exact framework I used.

Who Am I

I'm Mohammed Salah Khaleel, a security researcher from Iraq. Before attempting the OSCP, I had already discovered 4 CVEs (registered through CISA), been acknowledged by the USDA for vulnerability disclosure, and ranked 8th in the Iraqi Ministry of Interior National CTF Competition — without AI assistance.

The OSCP was not my first step into cybersecurity. It was the formalization of years of hands-on experience. That context matters — because even with that background, I still failed the first time.

The First Attempt — The One I Failed

The exam went well. I was making progress. I captured 6 flags. I had roughly 8 hours remaining and needed just one more flag to pass.

And I gave up.

To this day, I don't understand why. Maybe it was mental fatigue. Maybe it was the pressure of the proctored environment. Maybe I convinced myself the remaining target was impossible.

Whatever it was — it taught me the most important lesson of my OSCP journey:

Never give up. Even if you have 5 minutes left on the clock.

Five minutes is enough to try one more payload. One more directory. One more credential. The flag I needed might have been one command away.

The Second Attempt — 20 Hours, 8 Flags

On my second attempt, I changed my approach entirely. Not the technical skills — the mindset and the methodology.

I passed in 20 consecutive hours with 8 flags. The questions were completely different from the first attempt — OffSec rotates them — so there's no advantage to memorizing the first exam. You start fresh every time. That's actually liberating: a failed first attempt means nothing technically. It's a clean slate.

My Methodology — Step by Step

Here's exactly how I approached the exam. No specific targets or vulnerabilities — just the framework.

Phase 1: Full Port Scan — Everything at Once

The very first thing I did when the exam started was scan all targets simultaneously. Don't scan one machine, work on it, then scan the next. Scan everything in parallel. While nmap runs on the remaining targets, you're already working on the first one.

I used a fast full-port scan first:

nmap -p- --min-rate 5000 -T4 <TARGET> -oN ports.txt

nmap -p- --min-rate 5000 -T4 <TARGET> -oN ports.txt

Then a detailed scan on discovered ports:

nmap -p <discovered_ports> -sV -sC -A -O <TARGET> -oN detailed.txt

nmap -p <discovered_ports> -sV -sC -A -O <TARGET> -oN detailed.txt

This two-step approach is fast — and once you finish it, you have the complete picture. No surprises later.

Phase 2: Enumerate Everything

If you find a web service — immediately start directory brute-forcing with ffuf or dirsearch in the background while you manually browse the application. Look at every page. Read every piece of text. Check "About Us" and "Contact" pages for usernames. Check the page source for comments.

Search every service version for known CVEs. Even if the version doesn't match exactly — try the exploit anyway. Many exploits work across minor version differences. If it doesn't work, modify the script. If you can't modify it, write your own. This is why you need basic Python skills.

SMB open? Look for accessible shares. Download every file. Read everything — even seemingly boring documents might contain credentials.

FTP allows anonymous login? Log in. Download every file. Inspect them all.

Found usernames? On a login page, in a contact form, in an "About" section — collect them all. Build a custom wordlist. Try variations: uppercase, lowercase, first initial + last name, first name + number. Try them against every service with top 100 passwords. Don't stop.

Think like a black hat. Every piece of information is a potential key.

Phase 3: Get the Shell

Once you find your way in — through a CVE exploit, a web vulnerability, weak credentials, or a misconfiguration — get a stable shell. You'll usually land as a low-privilege service account. That's normal. That's expected.

Phase 4: Local Enumeration and Privilege Escalation

This is where many people lose time. Here's my approach:

On Linux:

1. Run linpeas.sh — but don't just run it, read every single line of the output
2. Check sudo -l — if anything shows up, check GTFOBins immediately
3. Look for cron jobs running as root — are the scripts writable?
4. Find SUID binaries — check each one against GTFOBins
5. Check internal open ports — services that aren't exposed externally might be running locally
6. If you find MySQL running internally, try connecting as root with no password
7. Check bash history, environment variables, config files — credentials hide everywhere

On Windows:

1. Run winpeas.exe — again, read everything
2. Check whoami /priv — certain privileges are immediate escalation paths
3. Run SharpUp.exe audit and PowerUp.ps1 — these find service misconfigurations
4. Check PowerShell history — it survives across sessions and often contains passwords in plain text
5. Look for internal services — check open ports from inside the machine
6. If you find any password — try it with every username on every service. Don't stop.

Build user lists. Every username you find goes into a list. Every password goes into another list. Try every combination. Spray everything.

Phase 5: Active Directory

If the exam includes an AD set, the methodology shifts entirely:

1. Enumerate with BloodHound — collect data, import it, look for paths to Domain Admin
2. Check ACL permissions — GenericAll, WriteDACL, WriteOwner are your targets
3. Password spray — but check the lockout policy first (net accounts)
4. Kerberoasting and AS-REP Roasting — offline cracking of service account passwords
5. Lateral movement — every new credential opens new doors. Pivot. Spray again. Repeat.

The Tools I Had Ready Before the Exam

Don't download tools during the exam. Have everything prepared, organized, and tested beforehand.

Enumeration

• nmap — Port scanning and service detection
• gobuster / ffuf — Directory and subdomain brute-forcing
• wpscan — WordPress enumeration
• whatweb — Web technology fingerprinting
• snmpwalk / snmp-check — SNMP enumeration
• smbclient — SMB share enumeration
• rpcclient — RPC enumeration
• netexec (nxc) — Credential validation and spraying

Exploitation

• evil-winrm — WinRM shell client
• impacket suite — secretsdump, psexec, wmiexec, and more
• msfvenom — Payload generation
• hydra — Brute-forcing login services
• john / fcrackzip — Password cracking
• xfreerdp — RDP client

Privilege Escalation — Linux

• linpeas.sh — Automated Linux enumeration
• pspy — Process monitoring without root
• linux-exploit-suggester — Kernel exploit finder

Privilege Escalation — Windows

• winpeas.exe — Automated Windows enumeration
• SharpUp.exe — Windows privesc audit
• PowerUp.ps1 — Windows privesc audit (PowerShell)
• GodPotato / PrintSpoofer — Token impersonation to SYSTEM
• mimikatz — Credential extraction

Active Directory

• BloodHound + SharpHound — AD data collection and path visualization
• PowerView.ps1 — AD enumeration
• Rubeus — Kerberos attacks
• kerbrute — Username and password spraying via Kerberos
• Certify / certipy-ad — ADCS attacks

Pivoting

• Ligolo-ng — Tunneling and pivoting
• chisel — Alternative tunneling

Utilities

• rlwrap + netcat — Reverse shell listeners
• python3 http.server — File transfer
• impacket-smbserver — Serve files to Windows targets via SMB

The Mistakes That Cost Me — So They Don't Cost You

1. Giving up with time remaining

I said it once and I'll say it again. Never. Give. Up. Not with 8 hours left. Not with 8 minutes left.

2. Not organizing information

Every piece of information you find — a username, a password, an internal IP, a service version — write it down immediately. Keep notes organized. When you're 15 hours into an exam, your memory is unreliable. Your notes aren't.

3. Not trying every credential everywhere

Found a password on one service? Try it on every other service with every username you have. This sounds obvious — but under pressure, people forget. Credential reuse is your best friend in the OSCP.

4. Skipping the report

The exam is one thing. The report is another. You can capture every flag and still fail if your report isn't detailed enough. Write your report as you go — screenshot everything, document every step, explain your reasoning. Don't wait until the 24-hour exam is over to start documenting.

5. Not finishing the course labs

Complete every single lab exercise in the course material. Solve all the exam-practice questions within the curriculum. The course content is sufficient — OffSec designed it to prepare you for the exam. Don't skip it.

What I'd Tell Someone Starting Today

Before the exam:

• Complete the entire course — videos and labs. OffSec now focuses primarily on video content and hands-on labs
• Understand basic Python — you'll need to modify exploits
• Prepare all your tools in advance — organized by category
• Practice the methodology, not individual techniques
• Master privilege escalation — both Linux and Windows. Download linpeas, winpeas, and know how to read their output line by line

During the exam:

• Scan everything first. Work while scans run in the background
• Don't get stuck on one target. If you're blocked for more than an hour, move on and come back
• Document everything as you go — screenshots, commands, outputs
• Think like a black hat. Every service is an opportunity. Every piece of data is a potential credential
• Don't give up. I mean it.

After the exam:

• Your report is your final answer. Make it clean, detailed, and professional
• Include every step with the finest detail
• Make it easy to follow — the reviewer should be able to reproduce your entire attack path

Is the OSCP Worth It?

Absolutely. The OSCP isn't just a certification — it's a methodology. It teaches you to think systematically: enumerate, exploit, escalate, pivot, repeat.

The exam doesn't test whether you can use a specific tool or exploit a specific vulnerability. It tests whether you can think. Whether you can take a black box and methodically break into it using nothing but your skills, your tools, and your persistence.

I passed on my second attempt. The questions were completely different. My methodology was the same — just better.

The OSCP is a beautiful exam. A prestigious certification. And it's worth every hour of struggle.

Mohammed Salah Khaleel is a Security Researcher from Iraq. He holds 10 OffSec certifications (OSCP, OSED, OSEP, OSDA, OSWA, OSTH, OSIR, OSWP, OSCC, OSCC-SJD), has 4 registered CVEs, was acknowledged by the USDA for vulnerability disclosure, and ranked top 8 in the Iraqi Ministry of Interior National CTF Competition. Follow him on GitHub and Medium.