> For the complete documentation index, see [llms.txt](https://dudisamarel.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dudisamarel.gitbook.io/oscp-notes/oscp-methodology.md).

# OSCP Methodology

## Find the foothold

### Host Discovery

The first go to is to search hosts available on the given subnet.

[Host Discovery](/oscp-notes/misc/information-gathering/active-reconnaissance/host-discovery.md)

### Port Scanning

After finding the hosts are available , the next step will be to scan the open ports in order to identify target exposed services. 

[Port scanning](/oscp-notes/misc/information-gathering/active-reconnaissance/port-scanning.md)

### Identify a vulnerable service

There are many possible attack vectors:

#### Web service

* Brute-force directories and files.
* Brute-force subdomains.
* Read source pages and search for comments or libraries\frameworks vulnerable version.
* Leverage [Web attacks](/oscp-notes/web-attacks/wordpress.md).

#### File services

[SMTP - 25](/oscp-notes/misc/information-gathering/active-reconnaissance/smtp-25.md) or [External Enumeration](/oscp-notes/windows/enumeration/external-enumeration.md#smb-1) can be useful for  phishing attacks.

To generate the phishing use [Client Side](/oscp-notes/windows/client-side.md) attacks or generate exe using [Metasploit](/oscp-notes/misc/metasploit.md#msfvenom).

#### SSH

When SSH is open try brute-force it - [Password attacks](/oscp-notes/misc/password-attacks.md#hydra).

Search for the SSH private key `.ssh/id_rsa` using pwned machine or web vulnerability like [Directory Traversal](/oscp-notes/web-attacks/directory-traversal.md).

## Privilege escalation

### Linux

First enumerate the system - [Local Enumeration](/oscp-notes/windows/enumeration/local-enumeration.md) 

Then exploit any attack vector in order to escalate to root - [Local Privileges Escalation](/oscp-notes/linux/local-privileges-escalation.md)

### Windows

First enumerate the system - [Local Privilege Escalation](/oscp-notes/windows/local-privilege-escalation.md)

Then exploit any attack vector to escalate to admin - [Local Privilege Escalation](/oscp-notes/windows/local-privilege-escalation.md)

### Active directory compromise

1. Enumerate the system - [Local Privilege Escalation](/oscp-notes/windows/local-privilege-escalation.md)
2. Exploit any attack vector to escalate to root - [Local Privilege Escalation](/oscp-notes/windows/local-privilege-escalation.md)
3. Credential Harvesting - [Mimikatz Basics](/oscp-notes/windows/mimikatz-basics.md)
4. Move between ad machines - [Lateral Movement](/oscp-notes/windows/lateral-movement.md)
5. Until getting Domain Admin or DC Sync privilege Repeat 1.
6. [DC Sync](/oscp-notes/windows/authentication-attacks/dc-sync.md)