Can the cheat sheet make me pass the OSCP by itself?

No — the OSCP is a 24-hour hands-on practical, not a recall test, so nothing replaces breaking into real machines in a lab. The sheet is a quick-reference layer: it keeps your syntax automatic so you spend exam hours solving the box instead of recalling a flag.

How current is the OSCP cheat sheet?

It reflects the post-November 1, 2024 OSCP+ format: 100 points, 70 to pass, three standalone machines plus a 40-point Active Directory set, and no bonus points. Always confirm the live exam rules on the OffSec exam guide before you book.

How do I get the OSCP cheat sheet?

Click the download button or the preview card at the top of this page to open the PDF instantly. Bookmark the page so you can pull it up again the night before your exam window.

Free OSCP Cheat Sheet 2026 — Downloadable PDF

Q: What's on the OSCP cheat sheet?

It condenses the commands and techniques the PEN-200 practical leans on most: Nmap enumeration flags, service-enumeration one-liners, reverse-shell and payload snippets, Linux and Windows privilege-escalation checks, and the Active Directory attack chain — grouped the way the exam allocates its 100 points.

This OSCP cheat sheet distills the OffSec PEN-200 (Penetration Testing with Kali Linux) practical into a quick reference for the commands and attack paths you reach for under a 24-hour clock. It's a premium cheat sheet built by Capital Prep — the one premium prep we trust — and it's yours free. Keep it beside your lab reps and reinforce it with the rest of the free OSCP toolkit: the practice questions, study guide, and flashcards.

OSCP exam at a glance

Format: 24-hour hands-on practical — compromise live machines, then submit a report (not multiple choice)
Points: 100 points: three standalone machines (20 each) + one Active Directory set (40)
Passing score: 70 of 100 points; no bonus points as of the Nov 1, 2024 OSCP+ update
Time: 23 hours 45 minutes to attack the lab, plus a further 24 hours to write the report
Cost: Sold in PEN-200 packages from ~$1,749 (bundle) or ~$1,699 (standalone exam) — verify at offsec.com
Administered by: OffSec (Offensive Security), via the PEN-200 course

What’s on the OSCP cheat sheet

Enumeration (foundation of every machine) — Nmap host discovery and -p- port scans, -sC -sV version detection, and deep SMB, web, and FTP service enumeration.
Exploitation & foothold — searchsploit and Exploit-DB, adapting public PoCs, reverse vs. bind shells, TTY upgrades, and msfvenom payloads.
Standalone machines (60 of 100 points) — three hosts worth 20 points each — 10 for initial access and 10 for privilege escalation.
Privilege escalation — Linux SUID, sudo -l, cron, and GTFOBins; Windows SeImpersonate, unquoted service paths, and DLL hijacking, surfaced with linPEAS/winPEAS.
Active Directory set (40 of 100 points) — Kerberoasting, AS-REP roasting, Pass-the-Hash, golden and silver tickets, DCSync, plus lateral movement and pivoting.

Highest-yield facts on the sheet

You need 70 of 100 points: owning the 40-point Active Directory set plus two standalone machines gets you to 80 — bank easy points, don't tunnel-vision one hard box.
When you're stuck, the OSCP answer is almost always more enumeration — run a full -p- scan and enumerate each service deeply before reaching for a new exploit.
Privilege escalation is the second 10 points on every machine: check SUID binaries, sudo -l, and cron on Linux; SeImpersonate, unquoted service paths, and services on Windows.
Metasploit's automated exploitation is limited to one machine of your choice, but msfvenom payload generation is allowed freely everywhere.
Passing now earns both credentials: OSCP (no expiry) and OSCP+ (valid three years, renewable); a compromise you don't document in the report scores nothing.

How to use it in your final week

Front-load the Active Directory chain — it's 40 of 100 points. Drill Kerberoasting, AS-REP roasting, Pass-the-Hash, and DCSync until the command order is automatic.
Rehearse your enumeration opener from memory: fast top-ports scan, then a full -p- sweep, then -sC -sV and targeted service enumeration (SMB, web, FTP).
Lock in the escalation checklists — Linux SUID/sudo -l/GTFOBins and Windows SeImpersonate/unquoted-service-path — so a foothold shell becomes root or SYSTEM without hunting.
Read the sheet once the morning of the exam, then keep it beside you as a syntax reference while you attack the lab — 70 points across three boxes and the AD set is the goal.

The cheat sheet is your review layer — your OSCP practice test drives the exam-readiness ring at the top of this page. Download it, review, then take a full practice exam (or drill with the study guide and flashcards) to see where you stand.

OSCP cheat sheet FAQ

Yes — the OSCP cheat sheet downloads as a PDF with no sign-up and no account. It sits alongside Career Employer's free OSCP toolkit: the practice questions, study guide, and flashcards you can pair with your hands-on lab reps.

References

1.OffSec. “PEN-200: Penetration Testing with Kali Linux (OSCP+).” offsec.com, 2026. ↑
2.OffSec. “OSCP+ Exam Guide — Essential Information.” OffSec Support Portal, 2026. ↑
3.OffSec. “Individual Pricing.” offsec.com, 2026. ↑
4.OffSec. “Changes to the OSCP.” OffSec Support Portal, 2026. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

All Posts

Career Employer’s Editorial Process

Here at Career Employer, we focus a lot on providing factually accurate information that is always up to date. We strive to provide correct information using strict editorial processes, article editing, and fact-checking for all of the information found on our website. We only utilize trustworthy and relevant resources. To find out more, make sure to read our full editorial process page here.

Your Free OSCP Cheat Sheet 2026 — Downloadable PDF