Passing the OSCP with 100 points, a full-time job, and a relationship

Somehow, I passed the OSCP first time and rooted all the machines! It feels weird not having labs to do in the evening, and having free time to binge TV shows with my partner. There's finally time to get through my backlog of video games and side projects.

This post is just to describe my experience with PWK-200 and obtaining the OSCP certification -- it's not a guide or anything.

Firstly, some disclaimers. I was only full-time for the first 60 days, and part-time for the last 30 days of my lab access. My relevant working knowledge is in web application security and Android security, though not as a penetration tester (more like a secure software developer). Before starting PWK-200 I had done a few CTFs (maybe 10), and held the GIAC Certified Incident Handler and GIAC Certified Forensics Examiner certifications. Those GIAC certifications were not that helpful for PWK-200.

Prior Preparation

In terms of preparation specifically for PWK-200, I did essentially none. Already being comfortable with Linux, networking, software development, and essential security concepts helped with picking up concepts in the course, I think. If anyone else were to take the 90-days-or-nothing approach I'd recommend being comfortable with the command line and the aforementioned topics.

Balancing Time

Almost every weekend was spent with my girlfriend. Saturdays usually didn't involve much study time, which is what the Sundays were reserved for. Most of my time in the PWK-200 environment was during weekdays after work hours. At-least 3 hours (typically more) were spent on it every night (missing one occasionally), and hobbies and side projects were dropped to focus on it; burnout started creeping in at about 60 days.

For me, 90 days was tight, and it didn't help that I spent too long on the lab report, which I didn't finish nor submit! PWK-200 is certainly a time dedication to consider before purchasing.

Approach

The course exercises are worth going through, though with 90 days I believe doing labs is more valuable. Whilst I did complete and document all the exercises, it took me about 60 days (way too long). During the last 30 days I was able to do around 40 labs including two of the available active directory sets. My exam date was set for one week after my lab access ended, during which I spent time doing some of TJ Null's list of OSCP-like proving grounds labs. This was definitely worth doing.

During those last 30 days I decided completing labs was more important than documenting them, which is why my lab report didn't get finished.

Documenting/Reporting

I used this template to produce my lab report and exam report. Course notes were taken with Obsidian, which was used as a cheatsheet for common commands that were needed. During the labs and exam, notes and evidence for machines were stored in CherryTree.

Exam Experience

Of course, I can't reveal anything about the exam contents, but I can say it took me about 14 hours to exploit enough to pass; having started at 12 in the afternoon and rooting five of six machines at 3AM, I took a three hour nap and rooted the final machine in the morning. The Active Directory set took me considerably more time than the individual machines.

Some time was spent after each machine looking through my screenshots and logged console output to make sure there was enough evidence for the report. For each machine I created an outline of the steps to reproduce and ensured all the screenshots/commands needed to replicate the steps were there, though not much time was spent on writing during the exam. My headings for each section were set up beforehand so as not to waste time on it.

Review

PWK-200 and the OSCP exam are demanding but you definitely learn a lot throughout (unless you're already a penetration tester I suppose). If I were to do it again I'd likely do some prior preparation before starting PWK-200 to make it less stressful, but if I weren't in a relationship I think starting without preparation would have been fine.

Overall, a rewarding experience that was worth the time and effort :)