Sources, review date and section shortcuts
Key claims reviewed: October 19, 2026. This is an editorial practice reference, not a measured “most used” ranking or a report of a personal pass. Exam feature restrictions and required proof take priority over any checklist. Commands were not executed during this review.
Exam rules · Nmap project manual
Go straight to: Twenty patterns · Proof
Build a command reference around questions you can answer and evidence you can explain. The twenty patterns below are an editorial lab checklist. They are not an official OSCP usage ranking, a list of permitted features, or evidence of a personal pass.
Use the examples only in your own lab or an expressly authorized target scope. Replace TARGET with the specific address assigned to that exercise. Keep network ranges explicit and save the conditions under which an observation was made.
Start With Scope and Tool Restrictions
Keep the current exam guide beside your personal notes. A command being useful in a home lab does not make every tool feature permissible in an assessment. The OSCP+ guide restricts automatic exploitation, mass vulnerability scanners, commercial tools and direct AI chatbot assistance. It applies separate restrictions to Metasploit modules and Meterpreter. Check those exact rules instead of treating this page as an allowlist.
Record the local tool version and read its help before adapting a stored command. Older practice images may not include modern utilities, and a missing utility does not mean the underlying information is unavailable. For example, a legacy guest may provide ifconfig where a modern Linux system provides ip addr.
Twenty Command Patterns to Practise
These are short reference prompts. Read the output, explain why you chose the command and record its limits. A successful invocation is not proof of a vulnerability.
| Pattern | Question to answer | Check before relying on it |
|---|---|---|
nmap -sn TARGET | Does this authorized address respond to discovery? | A negative discovery result does not prove the host is down. |
nmap -Pn TARGET | What changes when discovery is skipped? | This treats the specified target as online; it does not prove availability. |
nmap -sT -p 22,80,443 TARGET | What is the state of these TCP ports? | Choose ports from the authorized exercise scope. |
nmap -sT -p- TARGET | What does a complete TCP-port check add? | Consider runtime and target load; this is not a UDP scan. |
nmap -sV -p 80,443 TARGET | What service identification is suggested? | Identification can be incomplete or wrong; validate important details. |
nmap -sT -p 80 -oA notes/web TARGET | Can the scan results be located later? | Create the notes directory first and use a unique output prefix. |
ip addr | Which addresses belong to this Linux system? | Check whether the shell is on Kali or the target. |
ip route | Which route would this Linux system use? | A route entry alone does not prove successful connectivity. |
ifconfig | What interface information does a legacy guest expose? | Availability depends on its installed packages. |
ipconfig | Which addresses belong to the Windows target? | Use the target shell for target identity evidence. |
hostname | What hostname does this session report? | A hostname is useful context, not proof of privilege. |
id | Which Unix user and groups apply to this process? | Read the effective identity rather than trusting the prompt. |
whoami | Which account name does the session report? | An account name does not by itself establish an elevated token. |
pwd | Which directory is the shell using? | Keep target and local working directories separate. |
ls -la | What files and permissions are shown here? | Interpret ownership and permission information in context. |
cat /root/proof.txt | Can the required Linux proof be displayed? | Use only an existing supplied proof at its original path. |
type proof.txt | Can the required Windows proof be displayed? | Run from its actual supplied location in the target shell. |
curl -I http://TARGET/ | What does a HEAD request return? | HEAD can behave differently from GET. |
grep -n 'pattern' notes.txt | Where is a recorded observation? | Check the pattern and the correct notes file. |
sha256sum artifact | Has a local practice artifact changed? | A local integrity hash does not replace the upload verification specified by OffSec. |
Use a Question, Result and Next-Step Workflow
Before a network command, state the target and the question. After it completes, save the relevant output and note whether the result supports the hypothesis. If the answer is uncertain, distinguish a service result from a route, authentication or name-resolution problem before adding more tools.
Use a small log with fields for timestamp, target, command, observation and next step. A scan saved to disk is useful only if you can identify which target and settings produced it. Avoid overwriting an earlier result with a later run whose conditions differ.
For a short practice session, choose one service and a few relevant patterns. Finish by writing a paragraph another learner can reproduce in the same permitted lab. Increase complexity when the explanation is sound. There is no validated number of repetitions or hands-on percentage that guarantees readiness.
Collect Proof in the Target Session
Keep the target IP and supplied flag content together in the same screenshot. Display the proof from its original location through an interactive target shell and submit the required control-panel value before the assessment ends. A local tmux pane, copied note or attacker’s VPN address is not target proof.
Kioptrix practice images may not provide OffSec-style flags. Document target identity and effective privilege for the exercise instead of inventing a replacement exam flag. Your lab report can explain the observations and limitations without claiming examination credit.
Keep the separate report deadline on your checklist. Document the path and output while access is available, then verify the final report and upload against the current instructions. This command list does not replace reporting requirements.
Common Questions
Must I memorize all twenty patterns?
No. Practise choosing and explaining commands relevant to a task. Memorizing this editorial list does not establish exam readiness.
Does inclusion mean a tool is allowed in OSCP+?
No. The current provider guide and exact feature restrictions govern the examination. Recheck them before an appointment.
Were these commands executed during this review?
No. This is a documentation and rules review. Tool versions, target configuration and runtime behavior must be checked in your own authorized practice environment.
Continue with the proof screenshot guide and the exam-day checklist when building your personal reference.