Offensive Security Experienced Pentest (OSEP/OSCP) | Red Team

This advanced-level course is designed to help cybersecurity professionals prepare for the PEN 300: OSEP (Offensive Security Experienced Penetration Tester) certification by Offensive Security. The OSEP certification focuses on evasion techniques, advanced post-exploitation, and red team operations in real-world, hardened environments.

The course includes six expertly structured domains, each simulating hands-on attack chains and penetration testing scenarios. Through challenging multiple-choice and select-all-that-apply questions, students will reinforce critical skills such as payload development, antivirus evasion, credential access, lateral movement, and full kill-chain operations. Each domain includes topics directly mapped to PEN-300 labs and objectives.

Domain 1: Client-Side Exploitation & Execution Theory

This domain lays the foundation for modern client-side attacks. Students will exploit vulnerabilities in Microsoft Office and JScript-based environments, understand Windows internals, and craft obfuscated payloads to bypass basic antivirus protection.

Key Areas:

• Memory management, shellcode, and Windows API concepts

• Office macro exploitation and social engineering

• JScript and HTA-based payload execution

• Static AV evasion techniques and simple packers

Domain 2: Injection, Migration, and Advanced Antivirus Evasion

This domain teaches advanced evasion and stealth. Students will explore deep process injection, memory-only execution, and AV/EDR evasion techniques using custom crypters and signature bypasses. Application whitelisting restrictions will be bypassed using trusted binaries.

Key Areas:

• DLL and shellcode injection (reflective, hollowing, early bird)

• Inline hooking and direct syscall usage

• AV/EDR bypass using encryption, staging, and API unhooking

• AppLocker/SRP bypass via LOLBins and signed proxy execution

Domain 3: Network Evasion, Kiosk Breakouts & Lateral Movement

This domain simulates perimeter defense bypass, restricted environment exploitation, and initial steps in post-compromise network movement. You will use covert channels to tunnel through firewalls and escape kiosk-mode systems, followed by lateral movement across Windows networks.

Key Areas:

• DNS tunneling, SOCKS proxies, and port forwarding tools (e.g., chisel)

• Kiosk breakout via allowed binaries and USB payloads

• Windows trust abuse: SMB, WinRM, PsExec, and WMI

• Kerberos ticket attacks and token impersonation

Domain 4: Linux & Windows Post-Exploitation and Credential Access

Focusing on post-compromise dominance, this domain teaches the manipulation of Linux and Windows hosts. Learners will extract credentials, escalate privileges, establish persistence, and move laterally across multi-OS environments.

Key Areas:

• Linux and Windows persistence (cron, WMI, registry, startup abuse)

• Credential dumping using Mimikatz, memory analysis, and SAM extraction

• SSH key abuse and sudo misconfigurations

• Multi-platform lateral movement strategies

Domain 5: SQL Server and Active Directory Attacks

Students will exploit Microsoft SQL Server and Active Directory environments to escalate privileges and gain domain control. This includes command execution via SQL injection and privilege abuse in domain-wide trust relationships.

Key Areas:

• xp_cmdshell and linked server exploitation

• Lateral movement via MSSQL misconfigurations

• Kerberoasting, AS-REP Roasting, and unconstrained delegation

• DCSync, GPO abuse, and full domain compromise

Domain 6: Complex Multi-Stage Attacks & Red Team Simulation

This final domain simulates real-world red team operations. Students will apply the techniques from earlier domains to craft full kill chains involving phishing, evasion, pivoting, credential theft, and exfiltration within hardened enterprise environments.

Key Areas:

• Multi-vector attack chaining and pivoting

• Red team OPSEC and blue team evasion

• Advanced tooling (Cobalt Strike, Sliver, Covenant)

• End-to-end offensive campaigns across segmented networks

Who Should Enroll?

This course is designed for experienced penetration testers, red team operators, and OSCP-certified professionals preparing for the OSEP certification. It is also valuable for blue teamers seeking deeper insight into offensive TTPs.

Disclaimer:

This course is not affiliated with, endorsed by, or sponsored by Offensive Security. OSEP/OSCP® and OffSec® are registered trademarks of Offensive Security.

This course is designed solely to help learners prepare for Offensive Security certifications by offering complementary knowledge and practice. No official materials or proprietary content from OffSec are used.