OSCP Sheet — Master Index
Your vault organized by what phase of the exam you’re in — not by file type.
METHODology → ENUMERATE → EXPLOIT → POST-EXPLOIT (PrivEsc / Pivot / Lateral)
↓
TOOLS + COMMANDS + REFERENCE (supporting layers)
📌 Kill Chain — Start Here
| Phase | Hub | When to open |
|---|---|---|
| Methodology | Methodology | Starting a box — workflow & mindset |
| Enumeration | Enumeration | Understanding services, AD, networking |
| Exploitation | Exploitation | Web vulns, SQLi, LFI, buffer overflow |
| Post-Exploitation | Post-Exploitation | PrivEsc, pivot, lateral movement, shells |
📌 Supporting Layers
| Layer | Hub | Contents |
|---|---|---|
| Tools | Tools | Full tool docs — Nmap, Impacket, Hashcat, etc. |
| Commands | Commands | Quick command refs — Linux, Windows, Vim |
| Reference | Reference | Port lookup, external links, CVEs, misc |
📌 Most-Used Entry Points
| Situation | Go to |
|---|---|
| New box, don’t know where to start | Initial foothold → Recon tools |
| Open port, what do I do? | UseCases for ports |
| Port 5222 / XMPP / Jabber | Pidgin + UseCases for ports |
| Port 389 / LDAP | ldapsearch |
| Port 161 / SNMP (UDP) | snmpwalk |
| Ports 25/110/143 (mail) | Mail (SMTP POP3 IMAP) |
| Got low shell on Linux | Privilege escalation → Linux + Linux Tools |
| Got low shell on Windows | Privilege escalation → Windows PrivEsc |
SeBackupPrivilege in whoami /priv | SeBackupPrivilege |
SeRestorePrivilege in whoami /priv | SeRestorePrivilege · read path → SeBackupPrivilege |
| What is NTDS.dit / AD database? | NTDS.dit |
| Domain environment | AD + Active Directory tools · Credential Graph |
| ”What can I do with this hash/ticket?” | Credential Graph |
| Which attack path for this service? | Attack Path Graph |
| AD CS / certificate abuse | Certipy & Certify · AD CS ESC |
Kerberos from Linux (-k, getTGT, kinit) | Kerberos Setup - krb5.conf · Time Sync-Clock Skew |
| Kerberos from Windows shell | Rubeus |
| Need to reach internal network | Tunneling + Chisel |
| Session cookie / Flask JWT | Cookie Decoding |
| Move to another host | LatMovement + Impacket |
| Identified Nginx / Tomcat / IIS | Web Servers → Nginx · Tomcat · IIS |
Web path brute / exposed .git | Gobuster · Git & GitHub |
LFI / RFI on page= file= params | Local File Inclusion (LFI) · Remote File Inclusion (RFI) |
| GraphQL / API introspection | GraphQL - Bruno · Voyager |
| Backup zip / 7z extract | Archives - unzip 7z zip (7z x · zipinfo -v) |
| Chain grep/awk/find | Pipelines & Chaining |
📌 Folder Map
Sheet/
├── Sheet.md ← you are here
├── Methodology/ Initial foothold · Privilege escalation workflows
├── Enumeration/ AD, Kerberos, networking concepts
├── Exploitation/ SQLi, LFI, XSS, buffer overflow
├── Post-Exploitation/ PrivEsc, tunneling, lateral movement, shells
├── Tools/ Tool documentation (by category)
├── Commands/ Linux & Windows command cheatsheets
└── Reference/ Ports, links, CVEs, notes