Exam Strategy • Strategic / Crucial

OSCP 70-Points Exam Strategy: 24-Hour Time Management & Scoring Guide

Target Audience: Every OSCP candidate planning their 24-hour test-taking schedule and report strategy

> OffSec Exam Tactical Tip

If you are stuck on any single machine for more than 2 hours without new enumeration leads, step away from the desk, take a walk, and switch to a different target. Tunnel vision is the #1 killer in OSCP.

# OSCP Exam Point Breakdown & Path to 70 Points

Understanding the exact point distribution dictates where you must invest your mental energy during the first 6 hours of the exam.

Terminal Commands / Payload

OSCP Exam Structure Total Points = 100 (Pass threshold = 70)
--------------------------------------------------------------
1. Active Directory Set (3 Machines): 40 Points total
   - Target 1 (Domain User Initial Shell): 10 Points
   - Target 2 (Lateral Movement): 10 Points
   - Target 3 (Domain Controller - Full DA): 20 Points
   * NOTE: AD set is all-or-nothing (0 or 40 points in older rules, now partial scoring applies).

2. Standalone Independent Targets (3 Machines): 60 Points total
   - Standalone #1: Initial Shell (10 pts) + Root/Admin (10 pts) = 20 pts
   - Standalone #2: Initial Shell (10 pts) + Root/Admin (10 pts) = 20 pts
   - Standalone #3: Initial Shell (10 pts) + Root/Admin (10 pts) = 20 pts

FASTEST PASSING COMBINATIONS:
[Option A] AD Set (40 pts) + Standalone 1 Root (20 pts) + Standalone 2 User (10 pts) = 70 Points
[Option B] Standalone 1 Root (20) + Standalone 2 Root (20) + Standalone 3 Root (20) + 1 AD User (10) = 70 Points

# Optimal 24-Hour Timeline & Energy Schedule

Pacing prevents tunnel vision. A rigid schedule prevents wasting 8 hours staring at an unexploitable rabbit hole.

Terminal Commands / Payload

Hour 00:00 - 01:00: Nmap background scans on all targets. Read all port listings.
Hour 01:00 - 05:00: Focus 100% on Active Directory set. Initial foothold & BloodHound.
Hour 05:00 - 07:00: AD lateral movement to Domain Controller takeover (Lock in 40 pts).
Hour 07:00 - 07:30: MANDATORY 30-minute break. Eat high-protein meal and hydrate.
Hour 07:30 - 11:30: Standalone #1 (Enum -> User -> Root = 20 pts). Current: 60 pts.
Hour 11:30 - 13:30: Standalone #2 Initial Shell (10 pts). CURRENT TOTAL: 70 PTS (PASSED).
Hour 13:30 - 15:30: Standalone #2 Root (10 pts) = 80 Points (Safety Margin).
Hour 15:30 - 21:30: 6-Hour Sleep Window. Rest your brain before taking screenshots.
Hour 21:30 - 23:45: Screen verification check. Validate `ip a`, `whoami`, `proof.txt` on all pwned machines.

# The Proof Flag & Screenshot Rules You Cannot Violate

More candidates fail OSCP due to improper documentation and missing proof screenshots than technical lack of skill.

Terminal Commands / Payload

Mandatory Screenshot Requirement per Flag:
1. Open interactive command prompt on target.
2. Execute: ipconfig /all (Windows) or ip addr / ifconfig (Linux)
3. Execute: whoami
4. Execute: type proof.txt (Windows) or cat proof.txt (Linux)
5. Capture entire desktop window with local Kali clock visible.
6. Save both user.txt and proof.txt MD5 hashes inside the OffSec exam portal immediately.

Recommended Tools & Binaries

CherryTree Obsidian Flameshot AutoRecon OffSec Exam Portal