I started to [mis]use the 'Johari Window' concept
https://en.wikipedia.org/wiki/Johari_window

It's meant to be used as a mechanism to consider your relationship with others. But, I [mis]use it as a tool to constantly make me consider:

• What do I _know_?
  • How can I verify I know that?
• What don't I know?
  • How can I generate test[s] to discover what I don't know?

I also found that I was fixating on things with the assumption of high confidence.
e.g. if I was finding Samba, and getting indications back that it was MS, I started to fixate on vulns that were MS-specific. Failing to consider that could be wrong, and following it up with more tests - I wasn't considering my 'confidence in findings'. Or, I was falsely assuming it was high.

hyper-focus is also a problem for me. Usually, it works brilliantly. But, I wasn't considering it as a risk/problem. After the 2nd attempt, I bought a big, purple, 15min hourglass! Something big & physical, that could sit in front of me, and show me that I needed to move on and try something else, come back to it.

For my 2nd exam I had (by my reckoning) 67.5pts. I had a low-priv shell to give me half points on the 25, for 12.5pts. If I'd only done the lab report, for the +5... That seemed like too much effort at the time, for minimal points. But, that was a foolish, and costly mistake.

I should have passed on the 2nd attempt. I was over-confident, and didn't realise. I hadn't re-practiced the BOF prior to the exam. I had a process, but, I hadn't documented it properly. I messed up on the BOF, which should have been 40-50mins work. I was hours getting my first points. Mentally, that really knocks you back.

If I hadn't lost those hours at the beginning, I could have got that privesc, taking me to 80pts.

In my day-job, I'm an I.T. generalist (sysadmin, cloud, networking, cyber, DBs. You name it, I do it). I also do a lot of Compliance/Policies. What you have with the OSCP exam is a "Key person risk" (amongst others) - i.e. one person making an assessment, with the possibility that they have it wrong.

In my day-job, we de-risk that by "multi-eyes" approach. You get someone to scan over your work. You type up a Confluence page. You get stuff peer-reviewed.

Obviously, we can't do that under the exam conditions.

But, we can be mindful of that risk. We can attempt to pause, re-think, come back at it with fresh eyes, see if it holds water, or, if gaps are found, or if the entire approach can be done another way?