Skip to content

OSCP / OSCP+ (PEN-200) — Coverage Map

This page is Step 2 of the repo's how to prepare a certification method: the contract between you and the exam. For OSCP the contract is different from a knowledge exam: OffSec publishes no weighted domain list, the exam is the lab, and the authoritative scope is the PEN-200 course outline plus the OSCP+ exam guide. This map lists everything this hub teaches, grouped by the hub's six skill areas (a teaching breakdown, not an OffSec-defined syllabus), so you can line it up against OffSec's own outline and see what is covered, what is thin, and what is missing.

The rows are the section headings that exist in this hub's six skill-area pages — nothing more. Official module numbers or names are not reproduced here (the hub does not carry OffSec's outline, and this page will not invent it), so the first column is yours to fill.

How to fill it in:

  1. Open the official PEN-200 course outline on OffSec's course page (https://www.offsec.com/courses/pen-200/ — linked from what is OSCP) and the OSCP+ exam guide. Whether OffSec offers the outline as a PDF or a web page is not specified in this hub's sources — record whatever identifier OffSec uses (module number or module name).
  2. Walk the outline module by module. For each one, find the matching row below and write the module identifier in the first column. One module may span several rows, and one row may cover several modules — record all of them.
  3. Any module with no matching row goes in the gaps table at the end, marked "gap", with a note on where you will learn it. Expect gaps: this hub is conceptual and defence-mapped by design (no exploit code, no weaponised playbooks), so the hands-on depth comes from the course labs and authorised practice platforms.
  4. Then score every row 0–3 (the scale is in Step 3 of the method). For a hands-on exam, Practised? means done on a machine, from your own notes, and written up — not read.

There are no per-skill weights: the exam's only published split is by points (AD set of 3 machines = 40, three standalone machines = 60, 70 to pass) — see exam structure. That makes skill areas 5 and 6 (and 4, which every machine needs) the highest-value rows.

How to use

  • Before studying: fill the first column and the self-score column; the zeros and ones are your syllabus, and a 3 means cold, under time, from your notes.
  • During the study loop: after each skill-area page, revisit its rows — raise the score, tick Practised? only after a machine, and use Notes for the machine name and the date.
  • Before booking: the readiness gate in the hub README needs the AD set end-to-end, a mixed standalone set, a full report and a 24-hour dress rehearsal; every row here should be at 2 or 3 first.
  • Where a row has a ↳, it is a subsection of the row above it; score it separately only if the outline treats it as its own module.
  • Rows link straight to the section, so this page doubles as the hub's fastest index.

Coverage map

Skill area 1 — Enumeration & information gathering

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ Passive vs. active reconnaissance S1 → section __ ☐
____ The enumeration workflow S1 → section __ ☐
____ Port and service enumeration S1 → section __ ☐
____ Per-service deep dives S1 → section __ ☐
____ Tools and their purpose S1 → section __ ☐

Skill area 2 — Web application attacks

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ The common root cause S2 → section __ ☐
____ The web attack surface (defense view) S2 → section __ ☐
____ The attack classes S2 → section __ ☐
____ ↳ SQL injection (SQLi) S2 → subsection __ ☐
____ ↳ File inclusion — LFI and RFI S2 → subsection __ ☐
____ ↳ Unrestricted file upload S2 → subsection __ ☐
____ ↳ Command injection S2 → subsection __ ☐
____ ↳ Directory (path) traversal S2 → subsection __ ☐
____ ↳ Authentication / access bypass S2 → subsection __ ☐
____ Tools and their purpose S2 → section __ ☐
____ Defense in depth S2 → section __ ☐

Skill area 3 — Password & client-side attacks

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ Two ways in: credentials and the client S3 → section __ ☐
____ Password attacks S3 → section __ ☐
____ ↳ Online attacks — guessing against a live service S3 → subsection __ ☐
____ ↳ Offline attacks — cracking captured hashes S3 → subsection __ ☐
____ ↳ Why long + unique beats "complex" S3 → subsection __ ☐
____ Client-side attacks (concept) S3 → section __ ☐
____ Defenses (layered) S3 → section __ ☐
____ Tools and their purpose S3 → section __ ☐

Skill area 4 — Privilege escalation (Linux & Windows)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ The mental model: enumerate, then escalate S4 → section __ ☐
____ Linux privilege escalation — what to look for and why S4 → section __ ☐
____ Windows privilege escalation — what to look for and why S4 → section __ ☐
____ The unifying defense: least privilege and PAM S4 → section __ ☐

Skill area 5 — Active Directory attacks

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ The AD attack chain — and where defenses sit S5 → section __ ☐
____ Enumeration — the recon stage S5 → section __ ☐
____ Credential attacks (conceptual) S5 → section __ ☐
____ Lateral movement S5 → section __ ☐
____ Domain compromise S5 → section __ ☐
____ Why this maps cleanly to defense S5 → section __ ☐

Skill area 6 — Pivoting & tunneling

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ Why an attacker pivots S6 → section __ ☐
____ Forwarding concepts (no commands) S6 → section __ ☐
____ The defense: segmentation and controlled admin paths S6 → section __ ☐
____ Pivot vs. jump host — same shape, opposite intent S6 → section __ ☐

Cross-cutting exam skills

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ How the 100 points are distributed (AD set 40, standalone 60) Exam structure __ ☐
____ Proof flags: local.txt and proof.txt Exam structure __ ☐
____ The report: a deliverable you can fail on Exam structure __ ☐
____ Proctoring and integrity Exam structure __ ☐

Gaps you found

One row per official objective that has no matching row above. Decide where you will learn it (another page in this repo, the exam body's own material, a lab) and add that source to your plan.

Official objective What is missing Where you will learn it

Sources