The Complete Roadmap: Kioptrix → VulnHub → Proving Grounds → HackTheBox – 7 Brutal Lessons from My First OSCP Failure Turned Win
So You Wanna Get the OSCP? Read This Before You Torch $1,749.
If you’ve been staring at that OSCP price tag like it’s a bad joke—wondering if this cert is going to level up your life or just vaporize your savings account—you’re not alone. As of 2025, the PEN-200 + OSCP bundle (with 90 days of lab time and one exam attempt) clocks in at a brutal $1,749. That’s before you factor in any retakes, Hack The Box, Proving Grounds, or the fact that you’ll be living off ramen and caffeine for the next few months.
(Source: 2025-10)
This guide isn’t another motivational fluff piece. It’s a practical, brutally honest roadmap built on my own failure and eventual pass. I bombed my first OSCP attempt. Hard. Not because I wasn’t smart, but because I didn’t have a strategy—I just YOLO’d into labs and got steamrolled. This is the guide I wish I had back then.
Here’s what you’re getting:
- A no-BS training path (Kioptrix → VulnHub → Proving Grounds → HTB),
- A 60-second OSCP cost calculator (save this for later),
- And three “Money Blocks” you can screenshot and re-use to budget your time, energy, and dollars like a pro.
Let’s be real for a second: you’re probably time-poor, half-burned out from work or school, and maybe feeling a little defeated. Good. That urgency? That frustration? That’s your launch fuel. Use it. Because the people who pass this cert aren’t always the smartest—they’re the ones who didn’t quit after their ego got wrecked by a 20-point buffer overflow.
In the next 15 minutes, you’ll learn how to build a controlled, repeatable study process that turns OSCP from a chaotic gamble into a winnable campaign. I’m not promising it’ll be easy. But I am promising it’ll be worth it.
So pause the Hack The Box tab, stop refreshing Reddit threads, and just read. One clear path. No fluff. Let’s go.
Table of Contents
Why the OSCP Roadmap Feels Impossible at First
My first OSCP attempt felt less like an exam and more like being locked overnight in a hostile data center with a ticking clock and no coffee. Officially, the exam gives you about 23 hours and 45 minutes of hands-on hacking plus 24 hours to submit your report, and you need 70 out of 100 points to pass (Source, 2025-10). Unofficially, it gives you a front-row seat to all the gaps in your training.
I walked in having “done labs” for months… but in reality I’d mostly yo-yo’d between random Hack The Box boxes and YouTube walkthroughs. No structure. No pacing. No sense of when to pivot. When the first exam machine didn’t pop to a low shell after my favorite three tricks, panic set in. The screen didn’t look different—but suddenly every command felt wrong.
Here’s the blunt truth: OSCP is not about memorizing exploits. It’s about stitching together enumeration, note-taking, time management, and emotional control under sleep deprivation. That’s why so many smart people fail on the first try, even after hundreds of “CTF” solves.
- You over-index on CTF tricks, under-index on boring enumeration.
- You know 15 privilege escalation paths but no consistent workflow.
- You’ve never actually hacked for 10+ hours straight and then written a report.
The roadmap we’re building here fixes exactly those problems: we’ll move from friendly, guided boxes to semi-realistic practice and finally to OSCP-style labs and HTB grind—in that order, not the other way around.
- Most people start in Hack The Box when they should start with Kioptrix/VulnHub.
- CTF-style wins don’t guarantee exam readiness.
- Time management and note-taking are as important as exploits.
Apply in 60 seconds: Write down your last 3 weeks of “study”—how much was structured vs random?
Kioptrix → VulnHub → Proving Grounds → HackTheBox: The 4-Stage OSCP Roadmap
Think of your OSCP journey as weight training. You don’t start by maxing out your deadlift; you start by learning how not to snap your back in half. Same with hacking: you don’t start with brutal Active Directory chains and weird kernel race conditions. You start with clean, well-documented vulnerable machines that reward correct process.
In this roadmap, each platform has a specific role:
- Kioptrix – Safe sandbox for basic tools and workflows.
- VulnHub – Wider variety of real-ish setups; still offline, still forgiving.
- Proving Grounds – OffSec-designed targets that feel like mini-exam boxes.
- Hack The Box – “Gym” for your problem-solving stamina and weird edge cases.
Kioptrix and many early VulnHub boxes were literally designed so beginners could “acquire root access via any means possible” and learn core techniques in a gamified way (Source, 2014–2024). Proving Grounds was built by Offensive Security to bridge that world with their own exams, with PG Play giving free daily hours on community VulnHub-style machines and PG Practice adding unlimited access to OffSec-authored targets (Source, 2024-11). Hack The Box then stacks on top as an ever-expanding playground of modern attack paths (Source, 2024-11; 2025-11).
On my second attempt, the big shift wasn’t “learning more exploits.” It was treating these platforms as phases in one training pipeline instead of four different addictions. Once I did that, every session either built muscle memory, exam realism, or stamina—and my score finally reflected it.
“Random grinding feels productive but rarely moves the OSCP needle. Intentional sequencing does.”
Stage 1 – Kioptrix: Building Muscle Memory the Safe Way
Stage 1 is about not drowning. Kioptrix boxes are older, intentionally vulnerable VMs where the entire goal is to reach root while learning the basics of scanning, enumeration, and exploitation in a low-pressure environment (Source, 2014–2024).
On my first Kioptrix run, I remember spending 45 minutes just trying to figure out why my nmap scan saw nothing—turns out I’d misconfigured the host-only network in VirtualBox. Embarrassing? Yes. But that awkward evening saved me from debugging the same nonsense at 2 a.m. during the OSCP exam.
Your Kioptrix goals (per box):
- Practice clean recon:
netdiscover/nmap/ simple scripts, written into your notes. - Write a one-page summary per machine: target info, attack path, key commands.
- Commit to no copy-pasting full walkthroughs until you’re truly stuck.
Spend 2–3 weeks here if you’re new. Focus on consistency: 60–90 minutes most nights beats a single 10-hour binge. And yes, celebrate the small wins. Getting your first root shell—even on an ancient VM—is the moment your brain realizes, “Oh, I can actually do this.”
- Use it to debug your local lab setup once and for all.
- Practice turning recon into structured notes, not screenshots.
- Learn to recognize “patterned” misconfigurations quickly.
Apply in 60 seconds: Schedule one 60–90 minute Kioptrix session for tonight—put it in your calendar.
Stage 2 – VulnHub: From Checklist Hacking to Situational Awareness
Once Kioptrix feels “predictable,” you graduate to the slightly messier world of VulnHub. VulnHub hosts community-built VMs covering web apps, Linux, Windows, and misconfigurations that feel closer to real networks (Source, 2014–2024). Here you’ll meet weird services, forgotten CMS versions, and the joy of old PHP apps that probably should have been put down years ago.
My first VulnHub surprise was a box where my usual playbook—run nmap, dirb, basic SQLi—got me nowhere. I rage-quit, came back the next evening, and finally noticed a non-standard port running a dusty admin panel. That tiny mental pivot—“what am I not seeing?”—is exactly what the OSCP exam quietly demands.
In this stage, your focus shifts from “checklist” to “situational awareness”:
- Identify the story of the box: misconfigured backup? forgotten service? leftover dev portal?
- Experiment with manual enumeration:
curl,nc, custom scripts, not just automated tools. - Start practicing privilege escalation paths you’ll see again: sudo misconfig, SUID binaries, cron jobs.
If you’re outside North America—say Europe or Asia—VulnHub has a hidden bonus: you can run everything locally without worrying about latency or maintenance windows. That matters when your evenings are short and your internet sometimes isn’t perfect; you want your brain to struggle, not your connection.
“VulnHub is the awkward teenager phase—messy, frustrating, and absolutely essential for emotional resilience.”
Money Block – OSCP Costs and Time Budgets in 2025
Time to talk uncomfortable numbers. In 2025, most learners underestimate OSCP total cost by 30–50%. They remember the course price and forget retakes, lab extensions, and external platforms.
Cost of OSCP first attempt with 90-day labs, realistic prep, 2025 (Global)
| Item (2025) | Typical Cost (USD) | Notes |
|---|---|---|
| PEN-200 + OSCP (90 days + 1 exam) | ≈ $1,749 | Official bundle, includes labs + 1 attempt. |
| Optional OSCP retake | ≈ $150–$250 | Depends on promo/plan; check current fee. |
| Proving Grounds Practice | ≈ $19+/month | OffSec practice labs for exam-style boxes. |
| Hack The Box VIP / VIP+ | ≈ $14–$25/month | Labs pricing updated from Oct 2025. |
| Books & references | $50–$150 | Privilege escalation, web hacking, notes. |
Official sources and recent analyses put the 90-day bundle at around $1,749, with additional retakes costing roughly $150–$250 and external labs (HTB, PG) adding $20–$50/month depending on plan (Source, 2024-10; 2025-10).
If you’re outside the US, converting these numbers into your local currency can be painful. A friend in Eastern Europe calculated that his all-in OSCP journey was roughly two months’ salary. That didn’t make the investment wrong—but it meant his margin for retakes was zero. He passed on his first attempt because he treated his time and money like a clinical budget, not vibes.
- Expect total costs to exceed the course price by 20–50%.
- Budget for at least 3–4 months of external labs.
- Decide today how many paid retakes you can actually afford.
Apply in 60 seconds: Write down your “maximum total OSCP budget” (including retakes and labs).
Save this table and confirm the current fee on the provider’s official page.
Stage 3 – Proving Grounds: Practice Like the Exam, With Training Wheels
Offensive Security’s Proving Grounds is where your training starts to rhyme with the actual exam. PG Play gives you a few hours of free daily access to community Linux machines, while PG Practice adds unlimited time on OffSec-authored Linux and Windows boxes specifically tuned for pen-testing skill development (Source, 2024-11).
The first time I sat down with a PG Practice “OSCP-like” machine, I made a rule: no walkthroughs until I’d sunk at least two focused hours. The machine didn’t fall quickly. My notes, however, started to look eerily like mini OSCP reports: recon → foothold → escalation → loot. That shift—writing like an examiner is watching—was the single biggest confidence boost before my second attempt.
How to use Proving Grounds effectively:
- Pick a difficulty band (easy/medium) and clear a small set instead of sampling everything.
- Impose time boxes: 2–3 hours per box, then a short retrospective.
- For every finished machine, write a 1–2 page narrative report in your OSCP template.
Be a little ruthless. If you’re just tabbing between Reddit and Discord, you’re not doing OSCP prep—you’re doing OSCP cosplay. A focused 2-hour PG session three nights a week beats a weekend of “kinda hacking” with Netflix in the background.
Show me the nerdy details
For Proving Grounds, run a consistent recon pipeline that you can almost automate: host discovery, full TCP scan, service-specific scripts, then web enumeration with tools like ffuf or feroxbuster. Keep your tooling similar to what you’ll use in the exam’s Kali image to avoid surprises. Track your average “time to low shell” and “time to root” for each machine; over 6–8 boxes, you’ll see whether you’re trending towards exam readiness or just getting lucky.
Stage 4 – HackTheBox: From CTF Mindset to Real Pentest Thinking
Hack The Box (HTB) is addictive in the best and worst ways. On one hand, it offers constantly updated, real-world flavored challenges, Pro Labs, and HTB Academy. On the other, it’s easy to spend six months chasing obscure CTF flags that never show up in OSCP-style environments (Source, 2024-11; 2025-11).
When I first joined HTB, I did exactly what everyone does: I sorted by “most owned” and spent hours farming dopamine on easier retired boxes. Fun? Yes. Efficient? Not really. I wasn’t building the long-form endurance OSCP demands.
To align HTB with your OSCP roadmap:
- Focus on OSCP-adjacent paths: medium Linux boxes, entry-level AD, realistic web apps.
- Mix in HTB Academy modules for things you routinely fail at (e.g., LDAP, AD enumeration).
- Use VIP/VIP+ strategically for retired boxes with write-ups, not just for leaderboard glory.
If the new HTB Labs pricing feels steep after October 2025, treat HTB like a gym: don’t buy the top membership if you’re only going once a week. A month of VIP+ during an intense prep phase may be smarter than an entire year of casual dabbling.
- Prioritize OSCP-like boxes over exotic, gimmicky ones.
- Pair labs with Academy modules to fix specific weaknesses.
- Use write-ups as “post-game analysis,” not cheat codes.
Apply in 60 seconds: Un-favorite 3 HTB boxes that don’t map to OSCP skills; re-favorite 3 that do.
Building Your 90-Day OSCP Roadmap (First Attempt vs Retake)
Let’s stitch everything together. Assume you’ve bought a PEN-200 + OSCP bundle with 90 days of labs. That clock is non-negotiable. Here’s how I wish I’d structured my first attempt—and how I actually structured my second.
90-day OSCP roadmap for a first attempt, 2025 (Global)
- Days 1–21: Kioptrix + basic VulnHub (2–3 machines/week). Build workflows and notes.
- Days 22–45: VulnHub + PG Play. One PG-style box every few days; start reporting.
- Days 46–70: Proving Grounds Practice + HTB. Alternate PG box / HTB box per session.
- Days 71–80: Simulated exam weekends: 10–12 hour hack days + report writing.
- Days 81–90: Light review, sleep hygiene, 1–2 more PG/HTB boxes; schedule exam.
For a retake, compress the early stages. You already know how failure feels; you don’t need to relive it, you need to patch it. My retake plan was basically: halve the Kioptrix/VulnHub time, double down on PG Practice and OSCP-style reporting.
Here’s the funny part: when I finally passed, I hadn’t magically become smarter. I had simply built a rhythm. Tuesday/Thursday nights were PG. Saturdays were HTB + reporting drills. I treated OSCP like training for a half-marathon—unromantic, consistent, and occasionally boring.
- Anchor 2–3 fixed sessions per week, no matter what.
- Reserve at least 2 full “mock exam” days before test day.
- Adjust lab intensity, not schedule, when life gets busy.
Apply in 60 seconds: Open your calendar and block three 2-hour weekly OSCP sessions for the next month.
Money Block – OSCP Readiness Eligibility Checklist
Before you buy or renew anything, you need to answer a simple question: Are you actually eligible—skills-wise and life-wise—to get value from OSCP right now?
Eligibility checklist – Ready to invest in OSCP in the next 90 days? (2025, Global)
- Yes / No: I can dedicate at least 8–10 focused hours per week for 12 weeks.
- Yes / No: I’ve rooted at least 5–7 Kioptrix/VulnHub boxes without copy-paste walkthroughs.
- Yes / No: I have basic comfort with Linux, Python/Bash, and simple scripting.
- Yes / No: I can afford one paid retake if things go badly.
- Yes / No: My family/work expectations are aligned with me being “semi-absent” one night a week.
If you’re hitting “No” on more than two of those, pressing “buy” right now may not be wise. One of my friends bought OSCP during a stressful product launch at work, telling himself he’d “just grind weekends.” He burned money, sleep, and goodwill—and still pushed the exam twice.
Save this checklist and revisit it before each major payment.
- Undercommitting is safer than overcommitting and burning out.
- Solidify fundamentals before starting the 90-day clock.
- Align your OSCP push with a relatively calm life season.
Apply in 60 seconds: Mark each checklist item “Yes/No” honestly and write one action to turn a “No” into a “Yes.”
Short Story – How My First OSCP Exam Fell Apart
Short Story: The night of my first OSCP exam, I brewed coffee strong enough to strip paint and told myself, “You’ve got this.” By hour three, I had one low-priv shell and a headache. I kept hammering the same machine long after it stopped making sense, convinced I was “almost there.” Time, meanwhile, was quietly evaporating.
By hour ten, I’d pivoted to a second box out of pure panic. Notes? A mess of terminal history and half-written markdown. When I finally paused to breathe, I realized something horrifying: I had no clear attack tree for anything. Enumeration had been random, not systematic. Every nmap scan was slightly different; every privilege escalation attempt was blind guesswork. The exam hadn’t beaten my knowledge—it had beaten my process.
When the email came the next week, politely confirming what I already knew, I sat in silence for a long time. Then I opened my calendar and carved out three recurring blocks: lab time, report practice, and review. No big speech, no heroic playlist—just boring rectangles of time. That quiet decision, more than any new exploit, is what made the “win” version of this story possible.
Money Block – 60-Second OSCP Cost Estimator
Let’s turn those abstract numbers into your numbers. This mini calculator gives a rough total for your OSCP journey based on how many retakes and lab months you expect to need. It won’t be perfect, but it will be honest.
OSCP Cost Estimator (rough, 2025)
This rough estimate ignores discounts, taxes, travel, and opportunity cost. Always verify current prices on provider sites before purchasing.
Save this calculator by bookmarking the page and confirm all prices on the provider’s official fee schedule before you pay.
- Bundle + retakes + labs is the real price—not just the course fee.
- Adjust retakes or lab months until the total feels sustainable.
- Revisit this number before booking your exam date.
Apply in 60 seconds: Run the calculator once and write down your “no more than this” ceiling.
Nerdy Details – Environments, Tools, and Note-Taking That Actually Scale
At some point, the excitement of “new boxes” gives way to the quiet suffering of configuration management. The more time you spend wrestling with your lab environment, the less energy you have left for actual hacking. Treat your toolchain like production infrastructure.
On my retake journey, I rebuilt my setup around three simple principles: repeatability, portability, and legibility. One Kali VM for everything. One consistent directory tree for labs. One note-taking system (Markdown + screenshots, synced to a private repo). Boring? Yes. A lifesaver when I was 18 hours into the exam and too tired to think? Also yes.
- Standardize folder names:
01-recon,02-exploit,03-post, etc. - Use templates for OSCP-style reports and per-box notes.
- Automate your “daily reset” (snapshot restore, log cleanup, VPN checks).
For tools, resist the urge to install every shiny new thing. OSCP is passed every year with a fairly modest core stack—nmap, Burp, ffuf, linpeas/winpeas, bloodhound (for AD), and some home-grown helper scripts. Mastering those beats half-knowing 50 tools.
- Standardize your directory and naming conventions.
- Keep a lean core toolkit that mirrors the exam image.
- Invest in note templates before you invest in new exploits.
Apply in 60 seconds: Create a “_template” folder for new boxes and copy it before every session.
Infographic – Complete OSCP Roadmap at a Glance
🏆 The Complete OSCP Success Roadmap: 4 Stages
Kioptrix → VulnHub → Proving Grounds → HackTheBox
1 Stage 1: Kioptrix (Fundamentals)
Goal: Build muscle memory for tools and workflow.
- ✅ Target 5-7 boxes.
- ⏰ Expected 1–3 weeks.
- 💡 Focus: Debug your local VM setup, practice clean Nmap/Enum.
2 Stage 2: VulnHub (Variety)
Goal: Develop situational awareness in varied, semi-realistic environments.
- ✅ Target 8-12 boxes.
- ⏰ Expected 3–4 weeks.
- 💡 Focus: Moving past checklists, manual enumeration, and varied PrivEsc paths.
3 Stage 3: Proving Grounds (Exam Realism)
Goal: Practice OffSec-style targets and structured report writing.
- ✅ Target 8-10 PG Practice boxes.
- ⏰ Expected 4–6 weeks.
- 💡 Focus: Time-boxing (2-3 hrs/box), writing reports in the OSCP format for every solve.
4 Stage 4: Hack The Box (Stamina)
Goal: Problem-solving stamina and exposure to tricky edge cases.
- ✅ Target 10-15 boxes (Medium difficulty, OSCP-like).
- ⏰ Ongoing until exam.
- 💡 Focus: Targeted practice, avoiding exotic CTF boxes, running mock exams (10-12 hours).
🔥 Brutal Lessons (7 Key Takeaways)
- Random grinding is fake progress. Follow the Kioptrix → HTB sequence.
- Enumerate meticulously. Every missed detail is a potential point loss.
- Reports are part of the exam. Write mini-reports for every serious box.
- Stamina is crucial. Practice 8–10 hour hack days before the exam.
- Environment stability is key. Use a clean VM and a repeatable workflow.
💰 Estimated Cost (2025 Minimum)
PEN-200 + 90-day Labs + 1 Exam: ≈ $1,749 USD
External Labs (HTB/PG) 4 Months: ≈ $140 USD+
Total Minimum Estimated Cost: $1,889 USD+ (Excluding retake fees)
🔑 Action Now: Block three consistent weekly lab sessions on your calendar!
OSCP Roadmap: From First Lab to Passing Score
Stage 1 – Kioptrix
Goal: tools + workflow muscle memory.
- 5–7 boxes
- 1–3 weeks
- Local VM only
Stage 2 – VulnHub
Goal: situational awareness & variety.
- 8–12 boxes
- 3–4 weeks
- Mixed stacks
Stage 3 – Proving Grounds
Goal: exam-style realism & reporting.
- 8–10 PG boxes
- 4–6 weeks
- OSCP report format
Stage 4 – Hack The Box
Goal: stamina & weird edge cases.
- 10–15 boxes
- Ongoing
- Targeted, not random
Use this infographic as a checklist: only move forward when each stage feels “predictably solvable,” not just “occasionally lucky.”
FAQ
Here are some of the most common OSCP roadmap questions I hear from students and colleagues, from absolute beginners to working professionals trying to upskill.
1. Do I really need Kioptrix and VulnHub before Proving Grounds and Hack The Box?
Strictly speaking, no one will check your “Kioptrix scorecard” before you log into Proving Grounds. But practically, starting with simpler, offline VMs gives you a cheap way to debug your setup, get used to scanning and enumeration, and make your early mistakes far away from the 90-day OSCP lab clock. If you already have solid Linux and networking experience, you can compress this phase. 60-second action: If you’ve never rooted a local VM, download one Kioptrix box and schedule a 2-hour session this week.
2. How many Proving Grounds and Hack The Box boxes should I do before booking the exam?
Quantity matters less than consistency and quality. For most people, 8–10 PG Practice boxes and 10–15 carefully chosen HTB boxes (medium difficulty, OSCP-like) are enough to expose the main patterns. What matters is that you can repeatedly gain low shell, escalate, and write a coherent report without panic. 60-second action: List your last 5 practice boxes and note how many you fully rooted and documented—if it’s less than 3, focus on depth, not more boxes.
3. What if my budget only allows one OSCP attempt with no paid retakes?
That’s a tough position, but not hopeless. It simply means your margin for random grinding is very small. In that case, prioritize free and cheap resources early (Kioptrix, VulnHub, PG Play, targeted HTB months) and only start your 90-day PEN-200 clock when you’ve already built strong fundamentals. When exam day comes, your goal is less “hope I pass” and more “execute the plan I’ve rehearsed.” 60-second action: Use the cost estimator above with “0” retakes and see whether your current prep matches that constraint.
4. How far in advance should I schedule my OSCP exam date?
Many learners do best when they schedule 4–6 weeks after starting their 90-day labs, then adjust if needed. It gives you a concrete target without boxing you into a corner too early. Factor in your busiest work periods, holidays, and family obligations; you want a reasonably calm 2–3 days around the exam, especially if you’re in a timezone where exam slots fall overnight. 60-second action: Open your calendar, find a calm 2–3 day window in the next 3–4 months, and pencil in a tentative exam date.
5. What should I do differently if my first OSCP attempt already failed?
First, read your own failure honestly: did you lose on enumeration, privilege escalation, time management, or report quality? Then rebuild your roadmap around your weakest pillar. For many retakers, doubling down on Proving Grounds and report writing—while trimming random HTB grinding—makes the biggest difference. Emotionally, your job is not to “redeem” yourself; it’s to run a cleaner experiment with better inputs. 60-second action: Write one sentence: “I failed OSCP mainly because of X,” then design your next 30 days to attack that one variable.