Regaan/ LAB

Instrument 09 · OSCP / enumeration / field notes

Pentest Commands

TARGET SESSION17% evidence complete

Progress is earned by recorded evidence. Do not store passwords or exam secrets.

EVIDENCE ROUTER0 commands checked · 1/6 milestones
NEXT ACTIONCapture evidence for SSH.
PRIVILEGE SIGNALWaiting for boundary evidence
CURRENT PHASEEnumeration
ASSESSMENT MAPevidence controls progress
01DiscoveryEstablish the complete reachable attack surface.Evidence found
02EnumerationInterrogate every discovered service before forming a hypothesis.Current
03FootholdRecord the evidence, files and access path—not plaintext secrets.Waiting
04Local enumerationRe-enumerate from the target's perspective after access.Waiting
05Privilege boundaryFollow evidence from permissions, services, tasks and binaries.Waiting
06ProofCapture required proof and the target address in the same evidence set.Waiting
SERVICE PLAN2 recognized · 0 unclassified
22
SSHversion · auth methods · known accounts
SSH verbose connectionssh -vvv -p 22 user@10.10.10.10
SSH with private keychmod 600 id_rsa; ssh -i id_rsa -p 22 user@10.10.10.10
NEXTSSH verbose connection
80 / 443
HTTP / HTTPSheaders · content · vhosts · technology
Response headerscurl -k -sS -D - -o /dev/null http://10.10.10.10/
Technology fingerprintwhatweb -a 3 http://10.10.10.10/
FFUF directoriesffuf -u http://10.10.10.10/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -fc 404
Virtual-host discoveryffuf -u http://10.10.10.10/ -H 'Host: FUZZ.target.htb' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -fs 0
NEXTResponse headers
LOCAL ENUMERATIONUnknown

Select Linux, Windows or Active Directory after establishing access. The notebook will load the relevant local evidence groups.

FIELD NOTESavoid plaintext credentials
GTFOBINS REFERENCEauthoritative link

Record the permission boundary first, then review the maintained GTFOBins entry. This Lab does not mirror escape commands.

Open tar / sudo on GTFOBins ↗
EXAM POLICYchecked 23 Sep 2026
VERIFYTechnical usefulness does not imply exam permission.
Official exampleRestrictedFeature-dependentVerify

OffSec currently prohibits automatic exploitation, mass vulnerability scanners and AI chatbots. Nmap and its scripting engine are named examples, but a feature that performs prohibited behavior remains prohibited. Metasploit and Meterpreter are restricted to one selected target.

Nmap --script vulnFEATURE-DEPENDENT — inspect every selected NSE script and compare its behavior with the current rules.
Official exam guide ↗Official tool FAQ ↗