OSCP Cheat Sheet 2026

The 30 highest-yield OSCP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What does the command 'updatedb' do in Kali Linux and why is it relevant to OSCP engagements? → Rebuilds the locate command's file index database
2. Which tool is commonly used during OSCP to enumerate web application directories using a wordlist? → Dirb
3. During an OSCP lab, you find port 111 open on a Linux target. What service is most likely running? → Portmapper/RPC
4. In a Local File Inclusion (LFI) vulnerability, which of the following payloads is used to traverse directories and read /etc/passwd? → ../../../etc/passwd
5. Which Kali Linux tool is used to create a persistent USB drive that saves changes across reboots? → dd with persistence partition
6. Which HTTP method is most commonly exploited to upload a malicious web shell to a vulnerable web server? → PUT
7. Which command in Kali Linux displays active network connections along with the process name and PID? → netstat -tulnp
8. What tool can dump Windows NTLM password hashes from the SAM database when running as SYSTEM? → Mimikatz
9. After successfully exploiting a buffer overflow to get a reverse shell, you find you have low-privileged access. What OSCP methodology comes next? → Perform local privilege escalation enumeration to elevate from the current user
10. Which Windows registry key stores hashed credentials for locally cached domain accounts? → HKLM\SECURITY\Cache
11. Which hashcat attack mode uses a wordlist to crack password hashes? → Mode 0 (Straight/Wordlist attack)
12. In Kali Linux, which command updates the package database AND upgrades all installed packages in a single step? → apt-get update && apt-get upgrade
13. Which Burp Suite feature allows an attacker to intercept and modify HTTP requests between a browser and a web server? → Proxy
14. What is DLL hijacking in the context of Windows privilege escalation? → Placing a malicious DLL in a directory searched before the legitimate DLL location
15. A _________ is a sequential section of memory that has been set aside for holding data, like a character string or an array of numbers. → buffer
16. Which command would an attacker use to enumerate writable directories in the PATH that could enable a path hijacking attack? → echo $PATH | tr ':' '\n' | xargs ls -ld
17. What Kali Linux tool would you use to perform ARP spoofing to intercept traffic between two hosts on a local network? → Both arpspoof and ettercap are correct
18. Which Nmap output format is most useful for importing results into other tools during OSCP? → -oX (XML)
19. Where system binaries (programs) are stored → /sbin
20. What Nmap script can identify anonymous FTP login on a target? → --script=ftp-anon
21. When exploiting a Remote File Inclusion (RFI) vulnerability, what does the attacker typically host on their server? → A malicious PHP web shell
22. What Windows privilege escalation technique abuses the SeImpersonatePrivilege token right? → Juicy Potato / PrintSpoofer token impersonation
23. Which Kali Linux tool is specifically designed for brute-forcing web application login forms over HTTP? → hydra with http-post-form module
24. An OSCP candidate finds a writable /etc/passwd file. Which entry would add a passwordless root-equivalent account? → hacker::0:0::/root:/bin/bash
25. In Kali Linux, which command would you use to forward local port 8080 to a remote host's port 80 via SSH tunneling? → ssh -L 8080:remotehost:80 user@sshserver
26. What procedure deletes a folder? → rmdir
27. When using msfvenom to generate shellcode for a Windows buffer overflow, which flag specifies characters to exclude from the payload? → -b
28. What does an attacker gain when they successfully exploit an XML External Entity (XXE) vulnerability? → Ability to read arbitrary local files or perform SSRF
29. What is the purpose of the 'rpcinfo -p ' command during enumeration? → Enumerate all RPC services and their port numbers on the target
30. Where .so (Library file, stands for "shared object") are stored (basically like Windows .dll files). → /lib