The offensive security tools I actually relied on while preparing for and passing OSCP, organized by the job they solve.
Hey everyone. I just officially passed the OSCP, and now that I'm on the other side of it, I want to give back the way I wish more people had: not with a giant generic tool dump, but with the honest shortlist that actually carried me, organized by what you're actually trying to do.
This page is the hub for the entire toolkit. Each section starts with the job you're trying to accomplish, the tool I reach for, and why. As the series grows, each section will link to a dedicated deep dive covering my actual workflow, the commands I run, what I'm looking for in the output, and the mistakes that cost me time while learning it.
One thing that matters more than any tool here: know your exam rules. Automated exploitation tools like sqlmap are off-limits, and Metasploit is restricted to a single target. Confirm the current OffSec restrictions before you sit the exam.
Port Scanning
Nmap
Everything starts here, and most people rush it. Nmap is the foundation the whole box builds on, so know your scan flags cold and read the output line by line instead of skimming it. The service you overlook now is the foothold you miss later. Step one on every single target.
Deep dive coming soon.
Web Enumeration and Directory Busting
ffuf
Once you find an HTTP or HTTPS service, ffuf is how you uncover what the app doesn't advertise. Fast, clean, and reliable for finding hidden paths, files, and endpoints, and a good wordlist plus ffuf is what turns a boring web port into your way in.
Deep dive coming soon.
Manual Web Application Testing
Burp Suite
This is where hands-on web testing actually happens. Proxy the traffic, send requests to Repeater, and manipulate them by hand to understand how the app really behaves. Manual is the name of the game on this exam, and Burp is how you work manually.
Deep dive coming soon.
Network and AD Enumeration
NetExec (nxc)
This is your new best friend. NetExec is a straight-up AD Swiss army knife, and it shines brightest on SMB. Enumerate hosts, validate creds across the whole network at once, and spider shares to hunt for loot sitting in plain sight. It'll even do RPC-based user enumeration, rpcclient-style, so you can pull valid usernames without switching tools.
Deep dive coming soon.
Password Attacks and Spraying
NetExec and Hydra
Two tools, two jobs. For spraying a known password across a domain or validating creds at scale, NetExec does it cleanly and tells you exactly what each cred unlocks. For brute forcing a login on a specific service (SSH, FTP, HTTP forms), Hydra is the workhorse. Between them you cover both "does this password work anywhere" and "can I force my way into this one service."
Deep dive coming soon.
Credential Access and Lateral Movement
Impacket
The toolkit you keep coming back to. secretsdump for pulling hashes, psexec for shells, and a full set of scripts for ticket and authentication attacks. Once you understand what each script does, Impacket is how you turn creds or a hash into real movement across a domain.
Deep dive coming soon.
Cracking Looted Hashes
John the Ripper
For the hashes you pull along the way that you can't pass directly. Feed them to John, crack what you can, and reuse the plaintext. Password reuse across a domain is real, so a cracked hash often feeds straight back into NetExec or Impacket and opens a door you couldn't reach before.
Deep dive coming soon.
Tunneling and Pivoting
Ligolo-ng
This is where a lot of people lose the AD set. Instead of forwarding one port at a time like you would with a traditional port-forwarding workflow, you bring up a tun interface and route the target subnet through it. Anything the pivot can reach on that routed network becomes accessible through the tunnel, without building a new port forward for every service. Once I understood that mental model, I stopped wanting to pivot any other way.
Deep dive coming soon.
Linux Privilege Escalation Enumeration
LinPEAS and pspy
LinPEAS is an enumeration script that surfaces likely Linux privilege escalation paths so you know where to look. pspy solves a different problem: it lets a low-privileged user watch processes and scheduled tasks appear in real time, which is how you catch a cron job or recurring script that normal enumeration won't show you.
Deep dive coming soon.
Windows Privilege Escalation Enumeration
WinPEAS and PrivescCheck
WinPEAS and PrivescCheck are Windows privilege escalation enumeration tools that help surface misconfigurations, weak permissions, exposed credentials, vulnerable services, and other potential paths to higher privileges.
Deep dive coming soon.
SeImpersonate to SYSTEM
SigmaPotato
If SeImpersonatePrivilege shows up on a service account, Potato-style escalation immediately moves to the top of my list. SigmaPotato is my preferred modern Potato implementation, usually my first attempt because the setup is simple and, on a compatible target, it can turn that privilege into SYSTEM very quickly.
Deep dive coming soon.
Tools don't pass the OSCP. Understanding does. Every tool on this list is only as good as your grasp of what it's doing and why, so lean on them to work faster, not to skip the fundamentals. Master the concepts and these just make you quicker at proving them.
That's the toolkit that carried me, organized the way you'll actually use it. This hub grows as the series does, so each section will link to its full deep dive as I publish them. For the full box writeups and methodology behind all of this, that's what the rest of the blog is for.
Good luck on the exam. You've got this.
