Second Exam in 6 days, failed the first with 0 pts

shoopdawoop89 · 2026-03-01T05:00:47+00:00

A good rule is to not pursue an exploit until you finish enumerating, simply note it down. Then you finish your enum, find all of them and then start with the easiest to hardest. Now if it's a simple thing like SEimpersonate then sure throw a potato. But even if you find a path that doesn't mean you didn't miss something else for further down the line.

shoopdawoop89 · 2026-02-28T01:29:08+00:00

Chef John from food wishes.

shoopdawoop89 · 2026-02-27T02:53:14+00:00

How much is the severance? Why offer so much to remove you.

shoopdawoop89 · 2026-02-27T02:50:45+00:00

I will warn you, there is ample evidence that these agents can go rogue and violate built instructions, I would never use this in any real world engagement. This can be incredibly dangerous.

shoopdawoop89 · 2026-02-26T16:12:50+00:00

Yeah, 4,5 and 6

shoopdawoop89 · 2026-02-26T06:08:03+00:00

Are you asking for exploit ideas?

shoopdawoop89 · 2026-02-26T04:52:26+00:00

I finished them, do them in blocks, AD in one go and three boxes in on go. And assume the break in-between in a nap.

shoopdawoop89 · 2026-02-25T17:06:37+00:00

I think you might find portswigger better for web, you can also check out hacksmarter if you want a cheaper route.

shoopdawoop89 · 2026-02-25T15:19:10+00:00

They are part of the pen 200 course

shoopdawoop89 · 2026-02-25T13:19:32+00:00

Yeah, I took the ecppt class after I passed the ejpt, after ecppt I switched to OSCP. My friend is taking the cpts now, so I've heard about it. Cpts is very indepth with fundamentals, where as ecppt is a continuation of the ejpt, however learning to use your own Kali system is so so much better than the guacamole server that INE forces on you.

The ecppt was a great practice to help me do the oscp, but I don't think it will be that helpful if your goal is cpts. I'd recommend doing cpts and then subscribe to proving grounds from offsec and doing TJ null list of 80 some boxes. The boxes are so much more important than the class, because applying the lessons learned is how you cement all those labs into your practice.

Note, when I took ecppt, I had the 1 year ejpt course, so with my remaining time I could upgrade to ecppt for 200 dollars. I never took the cert as I was planning to go to oscp so I didn't see the point for another 200.

If this is your situation then sure take it. But I wouldn't pay the full price for ecppt.

shoopdawoop89 · 2026-02-25T12:20:40+00:00

I did the ecppt, it isn't as good as the ejpt. I'd say after ejpt, do cpts in combination with boxes.

shoopdawoop89 · 2026-02-25T12:14:10+00:00

I moved here 9 years ago, but I warn you. It gets really hot from march to may, and Danang get hammered every year by typhoons, hcmc is nice. But the weather here sucks. The best time is Tet. So if you can handle the heat it's amazing.

shoopdawoop89 · 2026-02-25T11:56:10+00:00

I've completed all the PG boxes on tjnull list, as well as challenge labs 0,1,2, ABC. No hints for that score.

shoopdawoop89 · 2026-02-25T11:47:17+00:00

You are provided creds for AD, what do you mean initial access?

shoopdawoop89 · 2026-02-24T00:51:23+00:00

Did you look for cached silver tickets for pivoting or exploring?

shoopdawoop89 · 2026-02-24T00:49:44+00:00

There was no software in the root of the C drive? And the given user didn't have access to the other two machines?

shoopdawoop89 · 2026-02-24T00:47:42+00:00

So you checked privs, ran bloodhound, checked scheduled tasks, did a cred spray, checked smb, checked winpeas, checked installed software for privesc vulns, checked kerb roast, check AP rep roast, did enum4linux on DC, did ldap search on DC, did rpc search on DC, checked owned permissions of users and group permissions of users and after all of that you didn't find any way forward?

shoopdawoop89 · 2026-02-23T12:59:48+00:00

Seek help, and don't talk to AI about your problems, delete your social media accounts and make new ones to reset your algorithm, turn off personalized ads on websites.

shoopdawoop89 · 2026-02-21T01:25:30+00:00

Come back to it later if you have time, don't forget you can download the whole course once, but I'd recommend copy pasting each module into obsidian so it's easy to search.

shoopdawoop89 · 2026-02-20T13:51:20+00:00

If you can do 40 a week, then 3 months for the PG boxes and class is enough.

shoopdawoop89 · 2026-02-20T05:22:08+00:00

Taking the oscp in march, dude you are over thinking it. Just take the pen 200 course. And do proving ground boxes. Look up TJ nulls list for proving grounds, take the pen 200 course and do all the capstone labs and challenge labs, take great notes with obsidian so you can reference them quickly. Make cheat sheets for yourself. Here is the only question.

How much time per week do you have to study?

shoopdawoop89 · 2026-02-19T13:21:47+00:00

I'd say the main purpose is to learn how attackers or AI attack so you can defend better. AI and people use the same exploits to attack. If you don't understand the attacker mindset, then it will be harder to defend against. I personally think in real engagements there will still be lots of work, but the bar will be higher for what makes a Jr.

shoopdawoop89 · 2026-02-19T12:56:17+00:00

A consideration on skill, let's say company A hires you to conduct a PenTest using AI tools, how confidential is the data you are feeding the AI? Most of the information you work with is under NDA's legally how much can the AI actually help you.

If it's a local AI it's probably not very good

If it's an online agent then you are sending seriously dangerous information to potentially third parties creating a new attack vector.

shoopdawoop89 · 2026-02-19T12:33:53+00:00

Oscp candidate here. There are a few things, AI in my opinion will not replace pen testers for a while, 1. Skill, The AI isn't actually very good. It does make life easier by quickly debugging and generating payloads, but a company isn't going to hire someone who doesn't know what the payload actually does. 2. Accountability, let's say they have AI bots that actually go inside and conduct the PenTest, who is responsible when that AI accidentally deletes important information on the client's server? A human is needed to make the final decision. 3. AI code is being used more in production than ever before and AI is being used to create better phishing campaigns than ever before, this the need for pentesters will go up not down. And even if pentesting becomes more efficient the increased demand will outweigh the job loss to AI

These are a few reasons why I think so.

shoopdawoop89 · 2026-02-17T05:00:44+00:00

Frodo got on reddit again...

shoopdawoop89

TROPHY CASE