Free OffSec Certified Professional (OSCP) Roadmap
OffSec's 24-hour hands-on exam: three standalone machines and an Active Directory set, then a written report. You book the exam with OffSec, on its own or with the PEN-200 course; passing earns OSCP, which does not expire, and OSCP+, which lasts three years. The StationX courses and labs here prepare you for it and are not OffSec material.
5 steps · 123 free videos · 38 free reads
Create your free account to open all 2,396 free items
The 161 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.
Before you start
Read these first
The free roadmap
5 steps, in order
The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.
Start here →
Step 1 — Learn the OSCP approach
Enumerate exhaustively, exploit manually, document as you go.
🔒 The full roadmap adds here: 23 full courses (Membership)
- Course · Learn Python & Ethical Hacking From Scratch · 🔒 Membership
- Course · Learn Ethical Hacking From Scratch · 🔒 Membership
- Course · Learn Website Hacking / Penetration Testing From Scratch · 🔒 Membership
- Course · Learn Network Hacking From Scratch (WiFi & Wired) · 🔒 Membership
- Course · Network Hacking Continued - Intermediate to Advanced · 🔒 Membership
- Course · Bash Scripting and Shell Programming (Linux Command Line) · 🔒 Membership
- Course · TCP/IP: The Complete Course · 🔒 Membership
- Course · Start Using Wireshark to Hack like a Pro · 🔒 Membership
- Course · Kali Linux Web App Pentesting Labs · 🔒 Membership
- Course · Learn Burp Suite, the Nr. 1 Web Hacking Tool · 🔒 Membership
- Course · Ethical Hacking - Hands-On Training - Part I · 🔒 Membership
- Course · Ethical Hacking - Capture the Flag Walkthroughs - v1 · 🔒 Membership
- Course · Ethical Hacking - Capture the Flag Walkthroughs - v2 · 🔒 Membership
- Course · Microsoft Windows Server 2019 - Hands-on Training Part I · 🔒 Membership
- Course · Microsoft Windows Server 2019 - Hands-on Training Part II · 🔒 Membership
- Course · Hands-on Penetration Testing Labs 1.0 · 🔒 Membership
- Course · Hands-on Penetration Testing Labs 2.0 · 🔒 Membership
- Course · Hands-on Penetration Testing Labs 3.0 · 🔒 Membership
- Course · Hands-on Penetration Testing Labs 4.0 · 🔒 Membership
- Course · Intermediate Ethical Hacking Hands-on Training · 🔒 Membership
- Course · The Complete Pentesting & Privilege Escalation Course · 🔒 Membership
- Course · Linux Command Line From A Hacker's Perspective · 🔒 Membership
- Course · Ethical Hacking - Capture the Flag Walkthroughs - v3 · 🔒 Membership
Try a free hacking lab: Recon to shell (~5 min) → A scripted simulation in your browser. No account needed.
Step 2 — Linux and command line fluency
Live in a shell — non-negotiable for the exam.
🔒 The full roadmap adds here: hands-on labs 1–37 of 101 (Infrastructure Labs)
- Lab 1 of 101 · Getting Started with Linux Command Line Fundamentals [Getting Started] · 🔒 Infrastructure Labs
- Lab 2 of 101 · Search Linux Manpages by Using the Command Line [Guided] · 🔒 Infrastructure Labs
- Lab 3 of 101 · Display Manpage Information by Using Sections [Guided] · 🔒 Infrastructure Labs
- Lab 4 of 101 · Can You Navigate and Search in a Manpage? [Advanced] · 🔒 Infrastructure Labs
- Lab 5 of 101 · Configure the Display of a File [Guided] · 🔒 Infrastructure Labs
- Lab 6 of 101 · Search for Files by Using Wildcards [Guided] · 🔒 Infrastructure Labs
- Lab 7 of 101 · Can You Create Files from Parts of Other Files? [Advanced] · 🔒 Infrastructure Labs
- Lab 8 of 101 · Sort Files [Guided] · 🔒 Infrastructure Labs
- Lab 9 of 101 · Can You Use the Grep and Sort Commands Together? [Advanced] · 🔒 Infrastructure Labs
- Lab 10 of 101 · Can You Extract, Label, and Organize Data? [Expert] · 🔒 Infrastructure Labs
- Lab 11 of 101 · Edit Text Files in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 12 of 101 · Backup and Restore Files with Tar in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 13 of 101 · Backup and Restore Files with CPIO in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 14 of 101 · Can You Manage Directories and Files in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 15 of 101 · Manage Storage in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 16 of 101 · Configure Links in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 17 of 101 · Can You use Find and Locate to Search for Files in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 18 of 101 · Configure Standard Permissions in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 19 of 101 · Can You Configure Kickstart Installations in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 20 of 101 · Can You Configure a Yum Repository in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 21 of 101 · Manage Services in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 22 of 101 · Can You Configure Advanced Permissions in Linux? [Expert] · 🔒 Infrastructure Labs
- Lab 23 of 101 · Create and Manage Linux Users and Groups [Guided] · 🔒 Infrastructure Labs
- Lab 24 of 101 · Can You Create a Scheduled Linux Backup Script? [Advanced] · 🔒 Infrastructure Labs
- Lab 25 of 101 · Can You Perform a Network Vulnerability Assessment by Using Nmap? [Advanced] · 🔒 Infrastructure Labs
- Lab 26 of 101 · Getting Started with Linux System Administration Tasks [Getting Started] · 🔒 Infrastructure Labs
- Lab 27 of 101 · Control Data Streams in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 28 of 101 · Assign Environment and Shell Variables in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 29 of 101 · Simplify Linux Administration Tasks by Using Xargs [Guided] · 🔒 Infrastructure Labs
- Lab 30 of 101 · Edit Data by Using Linux Command-Line Tools [Guided] · 🔒 Infrastructure Labs
- Lab 31 of 101 · Perform Linux Command-Line Operations by Using File Test and Relational Operators [Guided] · 🔒 Infrastructure Labs
- Lab 32 of 101 · Perform Linux Command-Line Operations by Using Boolean and Arithmetic Operators [Guided] · 🔒 Infrastructure Labs
- Lab 33 of 101 · Automate Administration Tasks by Using Linux Shell Scripts [Guided] · 🔒 Infrastructure Labs
- Lab 34 of 101 · Perform Conditional Decision Making in a Linux Shell Script [Guided] · 🔒 Infrastructure Labs
- Lab 35 of 101 · Can You Use Linux Command-Line Tools to Simplify Administration Tasks? [Advanced] · 🔒 Infrastructure Labs
- Lab 36 of 101 · Can You Perform Command-Line Tasks by Using Shell Operators and a Shell Script? [Advanced] · 🔒 Infrastructure Labs
- Lab 37 of 101 · Can You Manipulate Data and Create a Shell Script in Linux ? [Expert] · 🔒 Infrastructure Labs
Step 3 — Exploitation and privilege escalation
The standalone machines: a foothold, then root or SYSTEM, on Linux and Windows.
🔒 The full roadmap adds here: hands-on labs 38–63 of 101 (15 labs in Membership · 11 labs in Infrastructure Labs)
- Lab 38 of 101 · Basics of Metasploit · 🔒 Membership
- Lab 39 of 101 · Client-Side Exploitation with Social Engineering · 🔒 Membership
- Lab 40 of 101 · Cybersecurity Testing with Core Impact · 🔒 Membership
- Lab 41 of 101 · Evasive Maneuvers and Post Exploitation · 🔒 Membership
- Lab 42 of 101 · Intro To Linux - Backing Up, Compression, and Scheduling · 🔒 Membership
- Lab 43 of 101 · Intro to Linux - Routing and SSH Tunnels · 🔒 Membership
- Lab 44 of 101 · Linux Exploitation · 🔒 Membership
- Lab 45 of 101 · Network Miner · 🔒 Membership
- Lab 46 of 101 · Open Source Password Cracking · 🔒 Membership
- Lab 47 of 101 · Pentesting & Network Exploitation - Linux Target Analysis Labs · 🔒 Membership
- Lab 48 of 101 · Pentesting & Network Exploitation: DMZ Exploitation · 🔒 Membership
- Lab 49 of 101 · Pentesting & Network Exploitation: LAN Exploitation · 🔒 Membership
- Lab 50 of 101 · Pentesting & Network Exploitation: Windows Target Analysis Labs · 🔒 Membership
- Lab 51 of 101 · Post Exploitation and Pivoting · 🔒 Membership
- Lab 52 of 101 · Windows Exploitation · 🔒 Membership
- Lab 53 of 101 · Perform Open System Intelligence (OSINT) Gathering [Guided] · 🔒 Infrastructure Labs
- Lab 54 of 101 · Exploit Common Windows Flaws [Guided] · 🔒 Infrastructure Labs
- Lab 55 of 101 · Gain Remote Access to a Windows System [Guided] · 🔒 Infrastructure Labs
- Lab 56 of 101 · Perform Post-Exploit Activities [Guided] · 🔒 Infrastructure Labs
- Lab 57 of 101 · Exploit Flawed Code [Guided] · 🔒 Infrastructure Labs
- Lab 58 of 101 · Discover and Exploit Targets by Using Metasploit [Guided] · 🔒 Infrastructure Labs
- Lab 59 of 101 · Schedule and Perform Network Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
- Lab 60 of 101 · Can You Find Flaws with OSINT and Vulnerability Scanning? [Advanced] · 🔒 Infrastructure Labs
- Lab 61 of 101 · Can You Exploit Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 62 of 101 · Can You Exploit Windows with Metasploit and Code Analysis? [Advanced] · 🔒 Infrastructure Labs
- Lab 63 of 101 · Can You Perform Open-source Intelligence (OSINT)-Gathering Operations? [Expert] · 🔒 Infrastructure Labs
Step 4 — Web attack chains
Get a foothold through the web layer.
🔒 The full roadmap adds here: hands-on labs 64–90 of 101 (Membership)
- Lab 64 of 101 · Web 201 - Lab 1: Recon Tools · 🔒 Membership
- Lab 65 of 101 · Web 201 - Lab 2.1: Detecting and Exploiting Hard to Find SQL injections · 🔒 Membership
- Lab 66 of 101 · Web 201 - Lab 2.2: Advanced Sqlmap · 🔒 Membership
- Lab 67 of 101 · Web 201 - Lab 2.3: Manual Blind SQL Injection · 🔒 Membership
- Lab 68 of 101 · Web 201 - Lab 2.4: NoSQL Injection · 🔒 Membership
- Lab 69 of 101 · Web 201 - Lab 3.1: Cross Site Scripting Filter Evasion · 🔒 Membership
- Lab 70 of 101 · Web 201 - Lab 3.2: Exploiting Misconfigured CORS · 🔒 Membership
- Lab 71 of 101 · Web 201 - Lab 4: Advanced OS Command Injection · 🔒 Membership
- Lab 72 of 101 · Web 201 - Lab 5: Advanced Local File Inclusion · 🔒 Membership
- Lab 73 of 101 · Web 201 - Lab 6: Advanced CSRF · 🔒 Membership
- Lab 74 of 101 · Web 201 - Lab 7.1: XXE to Obtain Arbitrary Files · 🔒 Membership
- Lab 75 of 101 · Web 201 - Lab 7.2: Out of Band XXE Attacks · 🔒 Membership
- Lab 76 of 101 · Web 201 - Lab 8: Server Side Request Forgery · 🔒 Membership
- Lab 77 of 101 · Web 201 - Lab 9: Insecure Deserialization in Python and Java · 🔒 Membership
- Lab 78 of 101 · OWASP Top Ten 2025 - A01 Broken Access Controls · 🔒 Membership
- Lab 79 of 101 · OWASP Top Ten 2025 - A02 Security Misconfiguration · 🔒 Membership
- Lab 80 of 101 · OWASP Top Ten 2025 - A03 Software Supply Chain Failures · 🔒 Membership
- Lab 81 of 101 · OWASP Top Ten 2025 - A04 Cryptographic Failures · 🔒 Membership
- Lab 82 of 101 · OWASP Top Ten 2025 - A05 Injection · 🔒 Membership
- Lab 83 of 101 · OWASP Top Ten 2025 - A06 Insecure Design · 🔒 Membership
- Lab 84 of 101 · OWASP Top Ten 2025 - A07 Authentication Failures · 🔒 Membership
- Lab 85 of 101 · OWASP Top Ten 2025 - A08 Software or Data Integrity Failures · 🔒 Membership
- Lab 86 of 101 · OWASP Top Ten 2025 - A09 Security Logging & Alerting Failures · 🔒 Membership
- Lab 87 of 101 · OWASP Top Ten 2025 - A10 Mishandling of Exceptional Conditions · 🔒 Membership
- Lab 88 of 101 · OWASP Top Ten 2025 - Capstone · 🔒 Membership
- Lab 89 of 101 · OWASP Top Ten 2025 - Capstone (pt.1) · 🔒 Membership
- Lab 90 of 101 · OWASP Top Ten 2025 - Capstone (pt.2) · 🔒 Membership
Step 5 — Active Directory attack chain
From a standard domain user to domain admin: enumerate, roast, pass the hash, move laterally. The AD set is 40 of the 100 exam points.
🔒 The full roadmap adds here: hands-on labs 91–101 of 101 (Infrastructure Labs)
- Lab 91 of 101 · Perform Open Source Intelligence [Guided] · 🔒 Infrastructure Labs
- Lab 92 of 101 · Use Network Tools to Perform Discovery Scanning and Network Reconnaissance [Guided] · 🔒 Infrastructure Labs
- Lab 93 of 101 · Perform Vulnerability Scanning by using Greenbone Security Assistant (GSA) [Guided] · 🔒 Infrastructure Labs
- Lab 94 of 101 · Explore Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
- Lab 95 of 101 · Evaluate the Risk of Password Cracking to Your IT Environment [Guided] · 🔒 Infrastructure Labs
- Lab 96 of 101 · Perform Lateral Movement [Guided] · 🔒 Infrastructure Labs
- Lab 97 of 101 · Take Advantage of Anti-Forensic Techniques [Guided] · 🔒 Infrastructure Labs
- Lab 98 of 101 · Can You Perform OSINT Techniques to Unveil Hidden Network Details and Service Information? [Advanced] · 🔒 Infrastructure Labs
- Lab 99 of 101 · Can You Explore Vulnerabilities in Systems, Network Traffic, and Passwords? [Advanced] · 🔒 Infrastructure Labs
- Lab 100 of 101 · Can You Perform Lateral Movement and Post-exploit Activities? [Advanced] · 🔒 Infrastructure Labs
- Lab 101 of 101 · Can You Perform Information Gathering, Credentialed Vulnerability Access, and Attack a Boundary Server? [Expert] · 🔒 Infrastructure Labs
Exam and next steps
Before the exam
Do it hands-on
The full OffSec Certified Professional (OSCP) roadmap
The same steps with every course and the hands-on labs, and your progress tracked.
The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytimeAdvanced
AI-Driven Security Engineering
Become the Cyber Security Expert the AI Era Needs.
StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”
Explore the AI Master’s →Create your free account to open all 2,396 free items
The 161 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.