Practice Test GeeksOSCP - Offensive Security Certified Professional Practice Test

OSCP Study Guide 2026

Everything you need to pass the OSCP exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.

📋 OSCP Exam Format at a Glance

75
Questions
90 min
Time Limit
70.00%
Passing Score
Take a Full OSCP Exam Simulation →

📚 OSCP Topics to Study (27)

Buffer Overflow · 7 cardsKali Linux · 7 cardsLinux · 7 cardsBuffer Overflow · 7 cardsBuffer Overflow · 7 cardsBuffer Overflow · 7 cardsBuffer Overflow · 7 cardsKali Linux · 7 cardsKali Linux · 7 cardsKali Linux · 7 cardsKali Linux · 7 cardsLinux · 7 cardsLinux · 7 cardsLinux · 7 cardsLinux · 7 cardsWeb Application Attacks · 7 cardsWeb Application Attacks · 7 cardsWeb Application Attacks · 7 cardsNetwork Scanning and Enumeration · 6 cardsNetwork Scanning and Enumeration · 6 cardsNetwork Scanning and Enumeration · 6 cardsPassword Attacks and Cracking · 6 cardsPassword Attacks and Cracking · 6 cardsPassword Attacks and Cracking · 6 cardsWindows Privilege Escalation · 6 cardsWindows Privilege Escalation · 6 cardsWindows Privilege Escalation · 6 cards

✍️ Sample OSCP Questions & Answers

1. What is a common technique to bypass file upload filters that block PHP extensions?
✓ Use double extensions like shell.php.jpg

Using double extensions such as shell.php.jpg can bypass naive file extension checks if the server processes the PHP extension before the final jpg extension.

2. What technique allows an attacker to maintain a persistent rootkit-level backdoor without modifying disk-resident files on Linux?
✓ Loading a malicious kernel module (LKM rootkit)

Loadable kernel modules (LKMs) run in kernel space and can hide processes, files, and network connections; they can be loaded without leaving obvious file-system artifacts.

3. What type of attack involves tricking a victim into sending authenticated requests to a vulnerable web application without their knowledge?
✓ CSRF

Cross-Site Request Forgery (CSRF) forges authenticated requests from a victim's browser to perform unintended actions on a web application where they are logged in.

4. What are NTLMv2 challenge-response hashes and how are they typically cracked in OSCP?
✓ They are captured during authentication challenges (via Responder) and cracked offline with hashcat using module 5600

NTLMv2 hashes are challenge-response authentication tokens captured from network traffic or via tools like Responder, and are cracked offline using hashcat module 5600 (NetNTLMv2).

5. Which PowerShell command checks whether the current user can modify a specific service's binary?
✓ Get-Acl -Path 'C:\path\to\service.exe' | Format-List

Get-Acl retrieves the security descriptor (ACL) of a file, revealing which users have read, write, or modify permissions on the service binary.

6. What does the SLEEP() function in a SQL injection payload help an attacker determine?
✓ Whether the injection point exists via time delay

SLEEP() is used in time-based blind SQLi to confirm a vulnerable injection point by causing a measurable delay in the server's response.

🎯 Free OSCP Practice Tests

Buffer Overflow · 7 questionsBuffer Overflow · 7 questionsWeb Application Attacks · 7 questionsLinux · 7 questionsLinux · 7 questionsWeb Application Attacks · 7 questionsKali Linux · 7 questionsWeb Application Attacks · 7 questionsBuffer Overflow · 7 questionsBuffer Overflow · 7 questions

📖 OSCP Guides & Articles

Your OSCP Study Path
1. Learn with Flashcards → 2. Drill Practice Tests → 3. Take the Full Exam Simulation
🃏 OSCP Flashcards (180)🏆 OSCP Exam Simulation
Was this helpful?