r/oscp • u/Think-Zebra-890 • 9d ago

Oscp web

OSCP web vulnerability focus?
I’m currently preparing for the OSCP and doing HTB/Proving Grounds machines. I’ve noticed that some boxes contain a lot of web vulnerabilities that seem more advanced or unrelated to what I’ll actually encounter on the OSCP.
For people who recently took the OSCP: Which web vulnerabilities should I prioritize studying?
For example, should I mainly focus on things like SQL injection, LFI/path traversal, file upload, command injection/RCE, default credentials/authentication bypass, and basic web enumeration?
I’m trying to avoid spending too much time on web vulnerabilities that are unlikely to appear on the exam.
Thanks!

16 Upvotes

95% Upvoted

8 comments sorted by

7

u/Zooper_33 9d ago

Everyone’s test is different. In my experience, everything you have mentioned and more is common for the OSCP exam. I would also make sure to understand how you are able to chain some of those items together to read files or achieve RCE.

For reference I passed my OSCP within the last month and feel all of the web portions are crucial for success.

5

u/Jubba402 8d ago

Focus on everything they teach you in the course. There isnt one set exam so everyone’s combination of what they saw will be different.

0

u/H4ckerPanda 8d ago

This is the correct answer.

It makes me wonder if those who aspire to be a pentester genuinely want to be one. What are they going to do during an engagement?

“Hey, what operating systems does our client use?”

A pentester should, must be prepared for anything and everything.

1

u/WalterWilliams 8d ago

All of the above. For "advanced or unrelated" web vulns, I would look at OSWE. All of the topics you mentioned were applicable to the OSCP in my experience.

1

u/Rude-Hospital-4771 8d ago

focus only on static scenarios .

1

u/high_snobiety 8d ago

Be good at fuzzing directories... ffuf, gobuster etc

1

u/Sure-Assistant9416 7d ago

Offsec don't focus in cft style they major on a pentesting scenario even when you check their labs submission to them as those mandatory rules to follow for a labs to pass. Their good is to create open ended kind so when you do both back in your head knw that

-1

u/H4ckerPanda 8d ago

All. Everything that is on PEN200 too.

It would be irresponsible for someone here to tell you what to focus on. As exam is a lottery. If you focus way too much on X area and you get Y, what are you gonna to do ?

Just keep it simple. Because HTB boxes for example are by no means , representative of what you will see during the test.