OffSec Certified Professional (OSCP)

Exam OSCP OffSec Advanced

OffSec's 24-hour hands-on exam: three standalone machines and an Active Directory set, then a written report. You book the exam with OffSec, on its own or with the PEN-200 course; passing earns OSCP, which does not expire, and OSCP+, which lasts three years. The StationX courses and labs here prepare you for it and are not OffSec material.

24 courses · 266 sections · 1301 lectures · 101 labs · ≈ 92 h of hands-on labs

All 101 OSCP hands-on labs on one page →

Free to start: the free lessons and guides for this roadmap →

Free resources to get you started

FreeOSCP Exam Guide
FreePenetration Testing Steps

Exam domains

Standalone machines (three, 20 points each) — 60%
Active Directory set (assumed breach) — 40%

Shares of the 100 exam points. There are no bonus points, so you need the Active Directory set. For exams sat from 1 December 2026, OffSec converts your points to a scaled score, so the pass mark is not a fixed points total; OffSec says the exam content and format do not change.

FreeTop Penetration Testing Methodologies

Try a free hacking lab: Recon to shell (~5 min) → A scripted simulation in your browser. No account needed.

The path

Start here →

Step 1 — Learn the OSCP approach

Enumerate exhaustively, exploit manually, document as you go.

24 courses · 266 sections · 1301 lectures

Learn

CourseOffensive Security Certified Professional (OSCP) Training (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 24 courses · 1301 lectures
- Learn Python & Ethical Hacking From Scratch (opens in a new tab)
  21 sections · 194 lectures
  1. Training Overview 2
  2. Section 1: Introduction 13
  3. Section 2: Writing a MAC Address Changer - Python Basics 13
  4. Section 3: MAC Changer - Algorithm Design 7
  5. Section 4: Programming a Network Scanner 16
  6. Section 5: Writing an ARP Spoofer 12
  7. Section 6: Writing a Packet Sniffer 8
  8. Section 7: Writing a DNS Spoofer 8
  9. Section 8: Writing a File Interceptor 7
  10. Section 9: Writing a Code Injector 14
  11. Section 10: Bypassing HTTPS 4
  12. Section 11: Writing an ARP Spoof Detector 3
  13. Section 12: Writing Malware 10
  14. Section 13: Writing Malware - Keylogger 8
  15. Section 14: Writing Malware - Backdoors 22
  16. Section 15: Writing Malware - Packaging 15
  17. Section 16: Website / Web Application Hacking 3
  18. Section 17: Website Hacking - Writing a Crawler 9
  19. Section 18: Writing a Program To Guess Login Information 3
  20. Section 19: Writing a Vulnerability Scanner 16
  21. Audio Version of Training 1
- Learn Ethical Hacking From Scratch (opens in a new tab)
  27 sections · 146 lectures
  1. Training Overview 2
  2. 1. Course Introduction 3
  3. 2. Setting up a Hacking Lab 6
  4. 3. Linux Basics 3
  5. 4. Network Hacking 5
  6. 5. Network Hacking - Pre Connection Attacks 4
  7. 6. Network Hacking - Gaining Access - WEP Cracking 5
  8. 7. Network Hacking - Gaining Access - WPA / WPA2 Cracking 5
  9. 8. Network Hacking - Gaining Access - Security 2
  10. 9. Network Hacking - Post Connection Attacks 1
  11. 10. Network Hacking - Post-Connection Attacks - Information Gathering 5
  12. 11. Network Hacking - Post Connection Attacks - MITM Attacks 16
  13. 12. Network Hacking - Detection & Security 4
  14. 13. Gaining Access To Computers 1
  15. 14. Gaining Access - Server Side Attacks 9
  16. 15. Gaining Access - Client Side Attacks 6
  17. 16. Gaining Access - Client Side Attacks - Social Engineering 20
  18. 17. Gaining Access - Hacking Outside The Local Network 4
  19. 18. Post Exploitation 7
  20. 19. Website Hacking 2
  21. 20. Website Hacking - Information Gathering 7
  22. 21. Website Hacking - File Upload, Code Execution & File Inclusion Vulns 6
  23. 22. Website Hacking - SQL Injection Vulnerabilities 11
  24. 23. Website Hacking - Cross Site Scripting (XSS) Vulnerabilities 5
  25. 24. Website Hacking - Discovering Vulnerabilities Automatically 5
  26. 25. Bonus Section 1
  27. Audio Version of Training 1
- Learn Website Hacking / Penetration Testing From Scratch (opens in a new tab)
  21 sections · 103 lectures
  1. Training Overview 2
  2. Section 0: Course Introduction 1
  3. Section 1: Preparation - Creating a Hacking Lab 6
  4. Section 2. Preparation - Linux Basics 4
  5. Section 3. Website Basics 2
  6. Section 4. Information Gathering 9
  7. Section 5. File Upload Vulnerabilities 6
  8. Section 6. Code Execution Vulnerabilities 3
  9. Section 7. Local File Inclusion Vulnerabilities (LFI) 2
  10. Section 8. Remote File Inclusion Vulnerabilities (RFI) 4
  11. Section 9. SQL Injection Vulnerabilities 2
  12. Section 10. SQL Injection Vulnerabilities - SQLi In Login Pages 4
  13. Section 11. SQL injection Vulnerabilities - Extracting Data From The Database 4
  14. Section 12. SQL injection Vulnerabilities - Advanced Exploitation 11
  15. Section 13. XSS Vulnerabilities 6
  16. Section 14. XSS Vulnerabilities - Exploitation 14
  17. Section 15. Insecure Session Management 5
  18. Section 16. Brute Force & Dictionary Attacks 3
  19. Section 17. Discovering Vulnerabilities Automatically Using Owasp ZAP 2
  20. Section 18. Post Exploitation 12
  21. Audio Version of Training 1
- Learn Network Hacking From Scratch (WiFi & Wired) (opens in a new tab)
  15 sections · 69 lectures
  1. Training Overview 2
  2. Section 0. 1
  3. Section 1. Preparation - Setting Up The Lab 8
  4. Section 2. Network Basics 4
  5. Section 3. Pre-Connection Attacks 4
  6. Section 4. Gaining Access 1
  7. Section 5. Gaining Access - WEP Cracking 6
  8. Section 6. Gaining Access - WPA/WPA2 Cracking 8
  9. Section 7. Gaining Access - Security & Mitigation 2
  10. Section 8. Post Connection Attacks 3
  11. Section 9. Post Connection Attacks - Information Gathering 3
  12. Section 10. Post Connections Attacks - Man In The Middle Attacks (MITM) 17
  13. Section 11. Post Connection Attacks - Gaining Full Control Over Devices On The Same Network 7
  14. Section 12. ARP Poisonning Detection & Security 2
  15. Audio Version of Training 1
- Network Hacking Continued - Intermediate to Advanced (opens in a new tab)
  14 sections · 85 lectures
  1. Training Overview 2
  2. Introduction 2
  3. Back To Basics/Pre-Connection Attacks 7
  4. Gaining Access 6
  5. Gaining Access - Captive Portals 13
  6. Gaining Access - WPA & WPA2 Cracking - Exploiting WPS 5
  7. Gaining Access - WPA & WPA2 Cracking - Advanced Wordlist Attack 6
  8. Gaining Access - WPA & WPA2 Cracking - Evil Twin Attack 4
  9. Gaining Access - WPA & WPA2 Cracking - WPA/WPA2 Enterprise 5
  10. Post Connection Attacks 6
  11. Post Connection Attacks - Analysing Data Flows & Running Custom Attacks 10
  12. Post Connection Attacks - Writing Custom Scripts To Execute Own Attacks 14
  13. Post-Connection Attacks - Doing All Of The Above On HTTPS Websites 4
  14. Audio Version of Training 1
- The Complete Nmap Ethical Hacking Course: Network Security Assessment (opens in a new tab)
  15 sections · 57 lectures
  1. Training Overview 2
  2. Introduction 4
  3. Cheat Sheet 1
  4. Installing Nmap and Cloud Labs 3
  5. Nmap Basics, Target Specification & Port States 5
  6. Nmap Discovery and Ping Scanning 5
  7. Nmap Scan Techniques 5
  8. Nmap Port Specification, Service, Version & OS Detection 4
  9. Nmap Scripting Engine (NSE) 6
  10. Nmap Performance, Firewall and IDS Evasion 4
  11. Nmap Output and Extras 4
  12. Zenmap 4
  13. How Criminal Black Hats Use Nmap with Hacking Infrastructures 2
  14. Wrap up 2
  15. Preview Lectures 6
- Bash Scripting and Shell Programming (Linux Command Line) (opens in a new tab)
  15 sections · 44 lectures
  1. Training Overview 2
  2. Bash Programming Course Overview and Downloads 2
  3. Shell Scripting in a Nutshell 5
  4. Return Codes and Exit Statuses 4
  5. Shell Functions 4
  6. Shell Script Checklist and Template 2
  7. Wildcards 7
  8. Case Statements and Logic 3
  9. Logging 3
  10. While Loops 4
  11. Debugging Your Bash Programs 4
  12. Data Manipulation and Text Transformations with Sed 1
  13. Shell Scripts Used to Create This Course 1
  14. Slides 1
  15. Bonus Section 1
- TCP/IP: The Complete Course (opens in a new tab)
  6 sections · 19 lectures
  1. Training Overview 2
  2. Start Here 1
  3. The TCP/IP Suite Section 6
  4. Introduction to IP Addressing 4
  5. Introduction to Network Addressing 5
  6. Summary of Course 1
- Start Using Wireshark to Hack like a Pro (opens in a new tab)
  12 sections · 39 lectures
  1. Course Overview 2
  2. Introduction 1
  3. Course Setup: First Steps of Protocol Analysis 3
  4. Network Communication at the Packet Level 4
  5. TCP/IP Foundation 4
  6. Starting your First Capture 3
  7. Working with Capture Files in Wireshark 4
  8. Analyzing Packet Captures 2
  9. Examining Protocol Communication 3
  10. Bonus Capture Files 4
  11. The Steps of Professional Hacking 8
  12. Audio Version of the Training 1
- Kali Linux Web App Pentesting Labs (opens in a new tab)
  2 sections · 27 lectures
  1. Training Overview 2
  2. Web App Pentesting Labs 25
- Learn Burp Suite, the Nr. 1 Web Hacking Tool (opens in a new tab)
  4 sections · 12 lectures
  1. Training Overview 2
  2. Setup 3
  3. The Tool 6
  4. Congrats! 1
- Ethical Hacking - Hands-On Training - Part I (opens in a new tab)
  20 sections · 74 lectures
  1. Course Overview 1
  2. Building Your Virtual Lab Environment Using VirtualBox 8
  3. Section: Troubleshooting VirtualBox 4
  4. Section: Passive Reconnaissance 6
  5. Active Scanning with Nmap 8
  6. Section: Scanning for Vulnerabilities Using Nessus 3
  7. Scanning for Vulnerabilities Using OpenVAS 2
  8. Section: Exploiting Microsoft Windows 3
  9. Section: MSFVENOM 5
  10. Section: Exploiting Linux 5
  11. Section: Social Engineering 1
  12. Section: BASH Scripting for Pentesters 2
  13. Section: Password Cracking 3
  14. Section: Pentesting Wireless Networks 5
  15. Section: Web Based Application Attacks 4
  16. Section: Browser Exploitation Framework (BeEF) 2
  17. Section: Remaining Anonymous 3
  18. Capture the Flag Walkthrough - Mr. Robot 4
  19. Capture the Flag Walkthrough – Stapler 4
  20. Audio Version of Training 1
- Ethical Hacking - Capture the Flag Walkthroughs - v1 (opens in a new tab)
  8 sections · 19 lectures
  1. Training Overview 2
  2. Section 1: Course Overview 1
  3. Section 2: Building Your Virtual Lab Environment Using VirtualBox 1
  4. Section 3: CTF - Easy Beginner Level - Basic Pentest 3
  5. Section 4: CTF - Beginner to Intermediate Level - DeRPnStiNK 3
  6. Section 5: CTF - Beginner to Intermediate level - Stapler 4
  7. Section 6: CTF - Intermediate level - Mr. Robot 4
  8. Audio Version of Training 1
- Ethical Hacking - Capture the Flag Walkthroughs - v2 (opens in a new tab)
  8 sections · 21 lectures
  1. Training Overview 2
  2. Section 2: Building Your Virtual Lab Environment Using VirtualBox 2
  3. Section 3: Troubleshooting VirtualBox 2
  4. Section 4: Capture the Flag Walkthrough - Toppo 3
  5. Section 5: Capture the Flag Walkthrough – Lampiao 4
  6. Section 6: Capture the Flag Walkthrough - DC-1 4
  7. Section 7: Capture the Flag Walkthrough - SickOS 1.1 3
  8. Audio Version of Training 1
- Microsoft Windows Server 2019 - Hands-on Training Part I (opens in a new tab)
  14 sections · 74 lectures
  1. Training Overview 1
  2. Section 1: Course Overview 1
  3. Section 2: Building Your Virtual Lab Environment Using VirtualBox 6
  4. Section 3: Troubleshooting VirtualBox 2
  5. Section 4: Building a Windows Server Domain Using PowerShell 7
  6. Section 5: Domain Naming System (DNS) 8
  7. Section 6: Configuring the Dynamic Host Configuration Protocol (DHCP) 11
  8. Section 7: Active Directory Administration 5
  9. Section 8: Server 2019 Administration 11
  10. Section 9: Group Policy 7
  11. Section 10: Disk Management 4
  12. Section 11: Firewall Administration 4
  13. Section 12: Troubleshooting 6
  14. Audio Version of Training 1
- Microsoft Windows Server 2019 - Hands-on Training Part II (opens in a new tab)
  13 sections · 46 lectures
  1. Training Overview 1
  2. Section 1: Course Overview 1
  3. Section 2: Building your Virtual Lab Environment Using VirtualBox 6
  4. Section 3: Troubleshooting VirtualBox 2
  5. Section 4: Building a Windows Server Domain Using PowerShell 7
  6. Section 5: Windows Deployment Services 2
  7. Section 6: Operations Master Roles (FSMO) 3
  8. Section 7: Disaster Recovery 5
  9. Section 8: Monitoring Server 2019 3
  10. Section 9: Server 2019 Advanced Administration 6
  11. Section 10: IIS 5
  12. Section 11: Cerificates Services 4
  13. Audio Version of Training 1
- Hands-on Penetration Testing Labs 1.0 (opens in a new tab)
  2 sections · 20 lectures
  1. Training Overview 2
  2. Hands-on Labs 18
- Hands-on Penetration Testing Labs 2.0 (opens in a new tab)
  2 sections · 19 lectures
  1. Training Overview 2
  2. Introduction 17
- Hands-on Penetration Testing Labs 3.0 (opens in a new tab)
  2 sections · 17 lectures
  1. Training Overview 2
  2. Introduction 15
- Hands-on Penetration Testing Labs 4.0 (opens in a new tab)
  2 sections · 16 lectures
  1. Training Overview 2
  2. Section 1: Introduction 14
- Intermediate Ethical Hacking Hands-on Training (opens in a new tab)
  16 sections · 65 lectures
  1. Section 1: Course Overview 1
  2. Section 2: Building Your Virtual Lab Environment Using VirtualBox 8
  3. Section 3: Troubleshooting VirtualBox 2
  4. Section 4: NMap 2
  5. Section 5: Enumerating a Windows 10 Target 2
  6. Section 6: Reverse Shells, Privilege Escalation and Persistent Backdoors. 7
  7. Section 7: Powershell Empire 6
  8. Section 8: Post Exploitation of Microsoft Windows 5
  9. Section 9: Program Scripting 2
  10. Section 10: Practical Pentesting Labs 9
  11. Section 11: Auditing Wireless Networks 5
  12. Section 12: Wireshark 5
  13. Section 13: Web APP Penetration Testing 7
  14. Section 14: Anonymity - Remaining Anonymous While Pentesting 1
  15. Section 15: CTF - SQL Injection to Shell Walkthrough 2
  16. Audio Version of Training 1
- The Complete Pentesting & Privilege Escalation Course (opens in a new tab)
  10 sections · 63 lectures
  1. Training Overview 2
  2. Introduction 2
  3. Bandit 14
  4. Wakanda 5
  5. Mr. Robot 6
  6. Fristi Leaks 5
  7. Linux Privilege Escalation 14
  8. Windows Privilege Escalation 10
  9. Arctic 4
  10. Closing 1
- Linux Command Line From A Hacker's Perspective (opens in a new tab)
  9 sections · 55 lectures
  1. Training Overview 2
  2. Section 1: Introduction 1
  3. Section 2: What Linux Is 4
  4. Section 3: Setup The Environment The Right Way 8
  5. Section 4: The Midtest 1
  6. Section 5: Kali Linux and Its Tricks 6
  7. Section 6: Kali Linux Commands and Their Hacking Tricks 30
  8. Section 7: The Final Test - Harden Your Knowledge 2
  9. Audio Version of the Training 1
- Ethical Hacking - Capture the Flag Walkthroughs - v3 (opens in a new tab)
  8 sections · 17 lectures
  1. Training Overview 1
  2. Course Overview 1
  3. Virtual Lab Environment 2
  4. Troubleshooting VirtualBox 2
  5. Capture the Flag - EVM: 1 4
  6. Capture the Flag - INFOSEC: Prep OSCP 3
  7. Capture the Flag - SQL Injection to Shell Walkthrough 3
  8. Audio 1

This bundle collects third-party hacking courses sold by StationX; it is not OffSec's PEN-200. Start with Learn Ethical Hacking From Scratch, then follow the steps below: each names the courses in the bundle for its part of the exam.

Free resources

Step 2 — Linux and command line fluency

Live in a shell — non-negotiable for the exam.

37 labs

Learn

CourseCovered in Offensive Security Certified Professional (OSCP) Training (opens in a new tab)opens on courses.stationx.net — Linux and shell sections 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 24 courses · 1301 lectures — for this step:
- Bash Scripting and Shell Programming (Linux Command Line) (opens in a new tab)
  15 sections · 44 lectures
  1. Training Overview 2
  2. Bash Programming Course Overview and Downloads 2
  3. Shell Scripting in a Nutshell 5
  4. Return Codes and Exit Statuses 4
  5. Shell Functions 4
  6. Shell Script Checklist and Template 2
  7. Wildcards 7
  8. Case Statements and Logic 3
  9. Logging 3
  10. While Loops 4
  11. Debugging Your Bash Programs 4
  12. Data Manipulation and Text Transformations with Sed 1
  13. Shell Scripts Used to Create This Course 1
  14. Slides 1
  15. Bonus Section 1
- Linux Command Line From A Hacker's Perspective (opens in a new tab)
  9 sections · 55 lectures
  1. Training Overview 2
  2. Section 1: Introduction 1
  3. Section 2: What Linux Is 4
  4. Section 3: Setup The Environment The Right Way 8
  5. Section 4: The Midtest 1
  6. Section 5: Kali Linux and Its Tricks 6
  7. Section 6: Kali Linux Commands and Their Hacking Tricks 30
  8. Section 7: The Final Test - Harden Your Knowledge 2
  9. Audio Version of the Training 1

Practise

Infra LabsLinux Command Line Introduction — 18 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Getting Started with Linux Command Line FundamentalsLevel: Getting StartedDuration: 1 h
- Search Linux Manpages by Using the Command LineLevel: GuidedDuration: 30 min
- Display Manpage Information by Using SectionsLevel: GuidedDuration: 30 min
- Can You Navigate and Search in a Manpage?Level: AdvancedDuration: 45 min
- Configure the Display of a FileLevel: GuidedDuration: 30 min
- Search for Files by Using WildcardsLevel: GuidedDuration: 30 min
- Can You Create Files from Parts of Other Files?Level: AdvancedDuration: 45 min
- Sort FilesLevel: GuidedDuration: 30 min
- Can You Use the Grep and Sort Commands Together?Level: AdvancedDuration: 45 min
- Can You Extract, Label, and Organize Data?Level: ExpertDuration: 1 h
- Edit Text Files in LinuxLevel: GuidedDuration: 30 min
- Backup and Restore Files with Tar in LinuxLevel: GuidedDuration: 30 min
- Backup and Restore Files with CPIO in LinuxLevel: GuidedDuration: 30 min
- Can You Manage Directories and Files in Linux?Level: AdvancedDuration: 45 min
- Manage Storage in LinuxLevel: GuidedDuration: 30 min
- Configure Links in LinuxLevel: GuidedDuration: 30 min
- Can You use Find and Locate to Search for Files in Linux?Level: AdvancedDuration: 45 min
- Configure Standard Permissions in LinuxLevel: GuidedDuration: 30 min
Infra LabsLinux System Administration — 19 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Can You Configure Kickstart Installations in Linux?Level: AdvancedDuration: 45 min
- Can You Configure a Yum Repository in Linux?Level: AdvancedDuration: 45 min
- Manage Services in LinuxLevel: GuidedDuration: 30 min
- Can You Configure Advanced Permissions in Linux?Level: ExpertDuration: 1 h
- Create and Manage Linux Users and GroupsLevel: GuidedDuration: 30 min
- Can You Create a Scheduled Linux Backup Script?Level: AdvancedDuration: 45 min
- Can You Perform a Network Vulnerability Assessment by Using Nmap?Level: AdvancedDuration: 45 min
- Getting Started with Linux System Administration TasksLevel: Getting StartedDuration: 1 h
- Control Data Streams in LinuxLevel: GuidedDuration: 30 min
- Assign Environment and Shell Variables in LinuxLevel: GuidedDuration: 30 min
- Simplify Linux Administration Tasks by Using XargsLevel: GuidedDuration: 30 min
- Edit Data by Using Linux Command-Line ToolsLevel: GuidedDuration: 30 min
- Perform Linux Command-Line Operations by Using File Test and Relational OperatorsLevel: GuidedDuration: 30 min
- Perform Linux Command-Line Operations by Using Boolean and Arithmetic OperatorsLevel: GuidedDuration: 30 min
- Automate Administration Tasks by Using Linux Shell ScriptsLevel: GuidedDuration: 30 min
- Perform Conditional Decision Making in a Linux Shell ScriptLevel: GuidedDuration: 30 min
- Can You Use Linux Command-Line Tools to Simplify Administration Tasks?Level: AdvancedDuration: 1 h
- Can You Perform Command-Line Tasks by Using Shell Operators and a Shell Script?Level: AdvancedDuration: 1 h
- Can You Manipulate Data and Create a Shell Script in Linux ?Level: ExpertDuration: 1 h

Free resources

Step 3 — Exploitation and privilege escalation

The standalone machines: a foothold, then root or SYSTEM, on Linux and Windows.

26 labs

Learn

CourseCovered in Offensive Security Certified Professional (OSCP) Training (opens in a new tab)opens on courses.stationx.net — exploitation and escalation sections 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 24 courses · 1301 lectures — for this step:
- The Complete Pentesting & Privilege Escalation Course (opens in a new tab)
  10 sections · 63 lectures
  1. Training Overview 2
  2. Introduction 2
  3. Bandit 14
  4. Wakanda 5
  5. Mr. Robot 6
  6. Fristi Leaks 5
  7. Linux Privilege Escalation 14
  8. Windows Privilege Escalation 10
  9. Arctic 4
  10. Closing 1

Practise

LabsPentesting and Network Exploitation — 15 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Basics of MetasploitDuration: 2 h
- Client-Side Exploitation with Social EngineeringDuration: 1 h
- Cybersecurity Testing with Core ImpactDuration: 1 h
- Evasive Maneuvers and Post ExploitationDuration: 1 h
- Intro To Linux - Backing Up, Compression, and SchedulingDuration: 1 h
- Intro to Linux - Routing and SSH TunnelsDuration: 2 h
- Linux ExploitationDuration: 1 h
- Network MinerDuration: 1 h
- Open Source Password CrackingDuration: 1 h
- Pentesting & Network Exploitation - Linux Target Analysis LabsDuration: 2 h
- Pentesting & Network Exploitation: DMZ ExploitationDuration: 1 h
- Pentesting & Network Exploitation: LAN ExploitationDuration: 2 h
- Pentesting & Network Exploitation: Windows Target Analysis LabsDuration: 1 h
- Post Exploitation and PivotingDuration: 2 h
- Windows ExploitationDuration: 2 h
Infra LabsOperating System Exploits — 11 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Perform Open System Intelligence (OSINT) GatheringLevel: GuidedDuration: 30 min
- Exploit Common Windows FlawsLevel: GuidedDuration: 30 min
- Gain Remote Access to a Windows SystemLevel: GuidedDuration: 30 min
- Perform Post-Exploit ActivitiesLevel: GuidedDuration: 30 min
- Exploit Flawed CodeLevel: GuidedDuration: 30 min
- Discover and Exploit Targets by Using MetasploitLevel: GuidedDuration: 30 min
- Schedule and Perform Network Vulnerability ScansLevel: GuidedDuration: 30 min
- Can You Find Flaws with OSINT and Vulnerability Scanning?Level: AdvancedDuration: 45 min
- Can You Exploit Windows?Level: AdvancedDuration: 45 min
- Can You Exploit Windows with Metasploit and Code Analysis?Level: AdvancedDuration: 45 min
- Can You Perform Open-source Intelligence (OSINT)-Gathering Operations?Level: ExpertDuration: 1 h

Free resources

Step 4 — Web attack chains

Get a foothold through the web layer.

27 labs

Learn

CourseCovered in Offensive Security Certified Professional (OSCP) Training (opens in a new tab)opens on courses.stationx.net — web attack sections 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 24 courses · 1301 lectures — for this step:
- Learn Website Hacking / Penetration Testing From Scratch (opens in a new tab)
  21 sections · 103 lectures
  1. Training Overview 2
  2. Section 0: Course Introduction 1
  3. Section 1: Preparation - Creating a Hacking Lab 6
  4. Section 2. Preparation - Linux Basics 4
  5. Section 3. Website Basics 2
  6. Section 4. Information Gathering 9
  7. Section 5. File Upload Vulnerabilities 6
  8. Section 6. Code Execution Vulnerabilities 3
  9. Section 7. Local File Inclusion Vulnerabilities (LFI) 2
  10. Section 8. Remote File Inclusion Vulnerabilities (RFI) 4
  11. Section 9. SQL Injection Vulnerabilities 2
  12. Section 10. SQL Injection Vulnerabilities - SQLi In Login Pages 4
  13. Section 11. SQL injection Vulnerabilities - Extracting Data From The Database 4
  14. Section 12. SQL injection Vulnerabilities - Advanced Exploitation 11
  15. Section 13. XSS Vulnerabilities 6
  16. Section 14. XSS Vulnerabilities - Exploitation 14
  17. Section 15. Insecure Session Management 5
  18. Section 16. Brute Force & Dictionary Attacks 3
  19. Section 17. Discovering Vulnerabilities Automatically Using Owasp ZAP 2
  20. Section 18. Post Exploitation 12
  21. Audio Version of Training 1
- Kali Linux Web App Pentesting Labs (opens in a new tab)
  2 sections · 27 lectures
  1. Training Overview 2
  2. Web App Pentesting Labs 25
- Learn Burp Suite, the Nr. 1 Web Hacking Tool (opens in a new tab)
  4 sections · 12 lectures
  1. Training Overview 2
  2. Setup 3
  3. The Tool 6
  4. Congrats! 1

Practise

LabsAdvanced Web Application Exploitation — 14 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Web 201 - Lab 1: Recon ToolsDuration: 1 h
- Web 201 - Lab 2.1: Detecting and Exploiting Hard to Find SQL injectionsDuration: 1 h
- Web 201 - Lab 2.2: Advanced SqlmapDuration: 2 h
- Web 201 - Lab 2.3: Manual Blind SQL InjectionDuration: 2 h
- Web 201 - Lab 2.4: NoSQL InjectionDuration: 1 h
- Web 201 - Lab 3.1: Cross Site Scripting Filter EvasionDuration: 1 h
- Web 201 - Lab 3.2: Exploiting Misconfigured CORSDuration: 1 h
- Web 201 - Lab 4: Advanced OS Command InjectionDuration: 1 h
- Web 201 - Lab 5: Advanced Local File InclusionDuration: 1 h
- Web 201 - Lab 6: Advanced CSRFDuration: 1 h
- Web 201 - Lab 7.1: XXE to Obtain Arbitrary FilesDuration: 1 h
- Web 201 - Lab 7.2: Out of Band XXE AttacksDuration: 1 h
- Web 201 - Lab 8: Server Side Request ForgeryDuration: 1 h
- Web 201 - Lab 9: Insecure Deserialization in Python and JavaDuration: 1 h
LabsIntroduction To OWASP Top Ten — 13 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- OWASP Top Ten 2025 - A01 Broken Access ControlsDuration: 1 h
- OWASP Top Ten 2025 - A02 Security MisconfigurationDuration: 1 h
- OWASP Top Ten 2025 - A03 Software Supply Chain FailuresDuration: 1 h
- OWASP Top Ten 2025 - A04 Cryptographic FailuresDuration: 1 h
- OWASP Top Ten 2025 - A05 InjectionDuration: 1 h
- OWASP Top Ten 2025 - A06 Insecure DesignDuration: 1 h
- OWASP Top Ten 2025 - A07 Authentication FailuresDuration: 1 h
- OWASP Top Ten 2025 - A08 Software or Data Integrity FailuresDuration: 1 h
- OWASP Top Ten 2025 - A09 Security Logging & Alerting FailuresDuration: 1 h
- OWASP Top Ten 2025 - A10 Mishandling of Exceptional ConditionsDuration: 1 h
- OWASP Top Ten 2025 - CapstoneDuration: 3 h
- OWASP Top Ten 2025 - Capstone (pt.1)Duration: 1 h 30 min
- OWASP Top Ten 2025 - Capstone (pt.2)Duration: 1 h 30 min

Free resources

Step 5 — Active Directory attack chain

From a standard domain user to domain admin: enumerate, roast, pass the hash, move laterally. The AD set is 40 of the 100 exam points.

11 labs

Learn

CourseCovered in Offensive Security Certified Professional (OSCP) Training (opens in a new tab)opens on courses.stationx.net — Windows Server sections: how a domain is built and run 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 24 courses · 1301 lectures — for this step:
- Microsoft Windows Server 2019 - Hands-on Training Part I (opens in a new tab)
  14 sections · 74 lectures
  1. Training Overview 1
  2. Section 1: Course Overview 1
  3. Section 2: Building Your Virtual Lab Environment Using VirtualBox 6
  4. Section 3: Troubleshooting VirtualBox 2
  5. Section 4: Building a Windows Server Domain Using PowerShell 7
  6. Section 5: Domain Naming System (DNS) 8
  7. Section 6: Configuring the Dynamic Host Configuration Protocol (DHCP) 11
  8. Section 7: Active Directory Administration 5
  9. Section 8: Server 2019 Administration 11
  10. Section 9: Group Policy 7
  11. Section 10: Disk Management 4
  12. Section 11: Firewall Administration 4
  13. Section 12: Troubleshooting 6
  14. Audio Version of Training 1
- Microsoft Windows Server 2019 - Hands-on Training Part II (opens in a new tab)
  13 sections · 46 lectures
  1. Training Overview 1
  2. Section 1: Course Overview 1
  3. Section 2: Building your Virtual Lab Environment Using VirtualBox 6
  4. Section 3: Troubleshooting VirtualBox 2
  5. Section 4: Building a Windows Server Domain Using PowerShell 7
  6. Section 5: Windows Deployment Services 2
  7. Section 6: Operations Master Roles (FSMO) 3
  8. Section 7: Disaster Recovery 5
  9. Section 8: Monitoring Server 2019 3
  10. Section 9: Server 2019 Advanced Administration 6
  11. Section 10: IIS 5
  12. Section 11: Cerificates Services 4
  13. Audio Version of Training 1

StationX has no Active Directory attack course or lab yet: no lab here practises Kerberoasting, BloodHound or pass-the-hash. The Windows Server courses above show how a domain works and the free guides below teach the attacks; the labs practise discovery and lateral movement.

Practise