OSCP Notes: Recon & Methodology Initial Access Cheat Sheet

OSCP Notes, Recon, and Methodology Initial Access Cheat Sheet

So, probably what's everyone’s first pitfall of the OSCP/exams, doing capture the flag, or the biggest hurdle is methodology. I was no different during the process. Before going further, I will assume everyone reading this knows the difference between TCP and UDP, the OSI model, basic protocols like 21 or 80, and what a subnet is. If not, you may need to review basic networking. I won’t go into the details of networking concepts because they are a prerequisite for the OSCP. Although this is a quick summary of what it is, if you get lost in these notes:

I wanted to combine both notes with recon/methodology, and once you master that, this test becomes a bit easier. However, does this stop any rabbit holes? No, sadly. You can fall into a hole, but getting a method down quickly during recon helps. Stick to a checklist and stick to this diagram:

                   ┌──────────────────────────────────────────┐
                   │        1. INFORMATION GATHERING          │
                   │------------------------------------------│
                   │ - Identify scope                         │
                   │ - Discover live hosts                    │
                   │ - Enumerate open ports & services        │
                   └──────────────────────────────────────────┘
                                       │
                                       ▼
┌─────────────────────────────────────────────────────────────────────────┐
│                         2. ENUMERATION                                  │
│-------------------------------------------------------------------------│
│ - Gather service details (versions, banners)                            │
│ - Inspect web apps, shares, endpoints                                   │
│ - Identify misconfigurations & exposed functionality                    │
└─────────────────────────────────────────────────────────────────────────┘
                                       │
                                       ▼
              ┌────────────────────────────────────────────────┐
              │             3. VULNERABILITY ANALYSIS          │
              │------------------------------------------------│
              │ - Map services to known weaknesses             │
              │ - Analyze configs, permissions, frameworks     │
              │ - Identify realistic attack paths              │
              └────────────────────────────────────────────────┘
                                       │
                                       ▼
      ┌────────────────────────────────────────────────────────────┐
      │                4. INITIAL ACCESS (FOOTHOLD)                │
      │------------------------------------------------------------│
      │ - Use legitimate testing methods to interact with targets  │
      │ - Leverage weaknesses found during enumeration             │
      │ - Gain low‑privilege shell or limited access               │
      └────────────────────────────────────────────────────────────┘
                                       │
                                       ▼
         ┌────────────────────────────────────────────────────────┐
         │                 5. PRIVILEGE ESCALATION                │
         │--------------------------------------------------------│
         │ - Local enumeration                                    │
         │ - Identify misconfigurations, weak perms, credentials  │
         │ - Escalate to higher privilege levels                  │
         └────────────────────────────────────────────────────────┘
                                       │
                                       ▼
       ┌───────────────────────────────────────────────────────────────┐
       │                  6. POST-EXPLOITATION                         │
       │---------------------------------------------------------------│
       │ - Access proof files                                          │
       │ - Gather required information                                 │
       │ - No persistence or destructive actions (per exam rules)      │
       └───────────────────────────────────────────────────────────────┘

This is why it's great to stick to a checklist while doing the exam. Things to really check for:

☐ Host Discovery

nmap -sn <range> (safe ping sweep / ARP scan in scope)

☐ Full TCP Port Scan

Identify open services
Document everything
Re‑scan suspicious hosts if needed

☐ Service Version Detection

Map:

OS
service versions
protocols
banners



☐ Document:

Web ports (80/443/8080/etc.)
FTP/SMB/SSH/RDP
Database services
Anything uncommon

Web Recon:
☐ Identify Web Stack
Use whatweb or similar technology enumerators:

Frameworks (PHP, ASP.NET, Django, WordPress, etc.)
Server type (Apache, Nginx, IIS)
CMS platforms
Known plugins/extensions
Version fingerprints (if visible)

☐ Check SSL/TLS (optional)

Certificate info
Expiration
Hostnames/SAN entries

☐ Note any interesting headers

Cookies
Server banners
Security headers
File types

☐ Run directory/file enumeration

dirsearch (or similar) against each web port
Check common directories (admin, uploads, backups)
Note file extensions (*.php, *.asp, *.txt, .bak)

☐ Manually visit interesting findings

Login pages
Admin panels
Hidden directories
Publicly accessible scripts
Documentation pages

☐ Check Static Files

robots.txt
sitemap.xml
changelog/readme files
exposed backups (.zip, .tar, .old)

☐ Check for:

Login pages
Forgot‑password pages
Registration portals
File upload functionality
Search boxes
Filtering/sorting features
Cookies & session tokens
Parameterized URLs
Hidden form fields

☐ Static file review

JavaScript
Config hints embedded in comments
Hardcoded references
Deprecated routes

This step finds items that commonly lead to footholds when misconfigured.
☐ SMB / File Shares

Check shares listing
Look for accessible files
Misconfigurations
Anonymous access

☐ FTP

Anonymous login?
Publicly accessible directories?
Version info

☐ SSH

Banner information
Weak key reuse indicators
OS fingerprinting

☐ Databases

Versions
Public interfaces
Login prompts

☐ Web Applications

Form functionality
Input points
Sessions/cookies
Upload areas
API endpoints

Low hanging fruit:
☐ Common weak points:

Outdated web apps or frameworks
Exposed admin dashboards
Default/guest access
Misconfigured services
Info disclosure pages
Accessible shares with credentials
Backup files containing hints
Old versions with known issues
Unrestricted upload functionality

☐ Check version history

Compare discovered versions against publicly known issues
(Research only—no disallowed automation.)

This stage is about choosing a path, not executing it.
☐ Identify realistic footholds

Logic vulnerabilities
Authentication weaknesses
Misconfigurations
Poor access control
Exposed functionality
Version‑related issues

☐ Prioritize by:

Accessibility
Likelihood
Stability
Simplicity
OSCP scoring strategy

☐ Document chosen path

Why it’s likely
What evidence supports it
What next steps would be

These are all things to consider, and each is valid. I also wanted to have this written down so everyone can review it.

So add this to your notes:

Initial Recon & Access:
☐ Scan all TCP ports.
☐ Enumerate web server with all your relevant wordlists.
☐ Do proper fingerprinting with -sV -sC,  nmap vuln scan, wappalyzer, whatweb, check CMS, check server headers, nc -nvv, check every TCP port etc.
☐ Check for public exploits on exploitDB and google.
☐ Rescan if you're stuck, verify tools are working properly and you're running them properly.
☐ Check UDP ports.

Web Enumeration:
☐ Enumerate web server with all relevant wordlists (dirsearch/gobuster).
☐ Try multiple extensions: .php, .asp, .html, .txt, .bak.
☐ Identify tech using Wappalyzer, whatweb, webanalyze.
☐ Check for CMS (WordPress, Drupal, Joomla, etc.).
☐ Enumerate plugins/themes if CMS exists.
☐ Check robots.txt, sitemap.xml, changelog, readme, backup files.
☐ Inspect JavaScript sources for hidden paths.
☐ Look at default credentials lists for known web apps (safe research).
☐ Identify login panels, admin areas, upload features, API endpoints.
☐ Screenshot each interesting page.
☐ Check all response headers.
☐ Check verbose error messages or debug traces if present.
☐ Inspect API responses for hidden fields or metadata.
☐ Look for stack traces, server paths, or framework leaks.
☐ Check cookies for session type, flags, structure.
☐ Search for version numbers exposed in HTML comments.

Service Enumeration:
☐ For every open port: check banner, version, and basic functionality.
☐ Run nmap -sV -sC default scripts for initial coverage.
☐ Run nmap vuln scan (safe script categories only).
☐ Manually check banners with nc -nvv, telnet, curl, etc.
☐ Enumerate SMB shares (anonymous? listable?).
☐ Enumerate FTP (anonymous login? directory listing?).
☐ Enumerate SSH (banner, version, OS hints).
☐ Enumerate email services if present (POP3, IMAP, SMTP).
☐ Check for RPC, RDP, VNC, redis, memcached.
☐ Try safe SNMP enumeration if port 161 is open.
☐ Check for printers, cameras, or other unusual services.
☐ Perform version research for each exposed service.

Host:
☐ Identify login portals (SSH, RDP, Web UI).
☐ Enumerate potential username patterns from

File:
☐ Enumerate directories thoroughly (deep wordlist passes).
☐ Switch wordlists: small → medium → large → extensions → forced browsing.
☐ Look for:
Configuration files
Export logs
SQL dumps
Archive files
Admin tools
Hidden directories
☐ Explore every link, button, and form manually.

Low hanging fruit:
☐ Look for outdated CMS/framework versions.
☐ Look for anonymous/guest access on services.
☐ Look for open file shares with readable configs.
☐ Look for exposed backups (zip, tar, old files).
☐ Try safe upload test (file type + size constraints).
☐ Browse old endpoints (deprecated routes).
☐ Check for default admin pages.
☐ Check for password reuse indicators (username hints, comments).
☐ Check for open databases that accept connections but require no creds.
☐ Look for world‑readable directories or misconfigured shares.

Rescanning:
☐ Rescan if stuck—enumeration accuracy matters.
☐ Adjust Nmap timing (T2/T3 vs T4/T5 as appropriate).
☐ Try different scanners or wordlists.
☐ Validate that:

You used root/admin privileges where needed
Tools aren’t firewalled or timing out
Your VPN/connection is stable
☐ Re-run targeted scans on “weird” ports.
☐ Check for changes after interacting with services.

Mental OSCP Rules:
☐ Don’t jump machines randomly—finish full enumeration first.
☐ Document EVERYTHING, especially oddities.
☐ If stuck: redo your recon, expand your enumeration, and stay systematic.
☐ Remember: Enumeration → Enumeration → Enumeration.
☐ Identify the machine’s likely role (dev box, file server, CMS host).
☐ Infer the privilege model (is there a backend DB? AD? internal API?).
☐ Build a list of:
Potential misconfigurations
Weak authentication points
Development artifacts
Exposed internal logic
☐ Prioritize targets based on simplicity and feasibility.

I also know that AD needs to be enumerated, but that will be its own section. But all things need to be considered here initially: you will probably find an odd port and want to banner grab, check the website with common attacks, and fuzz where you can. For example, with LFI, can I see /etc/passwd, and then could I see someone’s SSH keys?

Really understanding the workflow and checking, hey, did I check for everything? That’s where a lot of people miss a step. Now, is this a lot? Yes, but think of it as a workflow rather than just checking the box. Your biggest enemy is time on the test.