How to leverage the PEN-200 simulated black-box penetration testing scenarios for maximal self-improvement and career success.

DISCLAIMER:

All opinions expressed in this article are solely my own. I have reviewed the content to ensure compliance with OffSec’s copyright policies and agreements. I have not been sponsored or incentivized in any way to recommend or oppose any resources mentioned in this article.

Introduction

In the last post of this series, I explored some hidden benefits and extra steps students should take when writing notes for the PEN-200: Penetration Testing with Kali Linux course. Before attempting the Offensive Security Certified Professional (OSCP) exam, it’s highly recommended to complete the practical lab networks. But first, read this article to learn how to maximize the lab experience.

PEN-200: Penetration Testing Certification with Kali Linux | OffSec

During the Labs…

“Success is no accident. It is hard work, perseverance, learning, studying, sacrifice, and most of all, love of what you are doing.” — Pelé

The PEN-200 course includes multiple virtual lab environments, each offering an opportunity to grow as an offensive security professional. The three key takeaways from this post are:

1. Learn how to write a high-quality penetration testing report and apply those skills to each lab network
2. Use the labs as a baseline to build your own testing environment where you can refine offensive techniques, understand how misconfigurations arise, and analyze network packets associated with different attacks
3. Develop a repeatable testing methodology, apply it to the labs, and continuously refine it through an iterative process

Write Reports for Each Lab

For all the effort OSCP candidates put into identifying and exploiting technical vulnerabilities, the irony of the course is that its arguably most valuable skill is also the least offensive: report writing. In the real world, the value of an offensive security engagement doesn’t come from hacking efforts alone—it mostly comes from a legible, actionable, and informative report. Given this, it’s somewhat disappointing that the OSCP exam report—a required component of the certification process—is graded more on accuracy than quality. According to the PEN-200 Reporting Requirements, “[students] must submit an exam penetration test report clearly demonstrating how [they] successfully achieved the certification exam objectives”. This policy ensures that passing students have demonstrated the minimum technical competency of an offensive security professional, but not necessarily the writing skills needed to excel in the field. If your goal is not just to pass the exam but to be a standout candidate in future consulting roles, you should learn how to write an exemplary penetration test report and use the PEN-200 labs as practice.

Report writing is often the least enjoyable part of a penetration test, but a poorly written report can have serious consequences. The most immediate impact may be frustration from supervisors or colleagues, but the affected audience is often much larger. If your firm has a quality assurance (QA) process, multiple rounds of revision can delay the report’s delivery, damaging the company’s reputation. Worse, if significant errors slip through and the client receives a flawed report—such as one containing incorrect, incomplete, or difficult-to-read sections—the aftermath can be disastrous. Miscommunication about findings can lead to delayed security improvements, inadequate risk mitigations, and ultimately an unresolved attack surface. The client may become furious over wasted time and resources, potentially demanding revisions, reattempts, or—worst-case scenario—a partial or full refund.

Given the stakes, it’s imperative to take reporting seriously—and this is where the PEN-200 labs come in. While their official purpose is to provide students a sandbox environment for practicing their newly learned offensive techniques, they also serve as an excellent training ground for report writing. The lab structures simulate a black-box penetration test scenario, lending authenticity and relevance to aspiring offensive security professionals. Furthermore, three lab networks are specifically designed to replicate the OSCP exam conditions, allowing students to simulate the exam environment under self-imposed time constraints.

NOTE:

Consider attempting two of these lab networks within a 48-hour window (24-hours each for testing and reporting) before your first exam attempt, reserving the third for after you’ve conducted your first attempt postmortem (more on that later in the series).

Before you begin report writing, it’s essential to understand their structure. While formats vary across firms, most reports include at least an Executive Summary, Assessment Results, Attack Path Narrative, and Appendix. A full breakdown of these sections is beyond the scope of this post, but for practical guidance, Brian King’s Hack for Show, Report for Dough (Wild West Hackin’ Fest 2018) is a phenomenal resource. It also covers several report writing best and worst practices, helping students refine their skills. Students can also reference OffSec’s official OSCP exam report templates as a primary source for understanding the certification provider’s expectations.

When writing reports, I strongly advise sticking to Microsoft Word. While I personally find it somewhat infuriating and a victim of “featuritis”, it remains the dominant word processor application in the industry and offers useful features like change trackers (especially relevant for collaborative projects), cross-references, and a citation management system. For screenshots, I highly recommend Greenshot, Flameshot, Snagit, and ZoomIt from the Sysinternals suite. Including a network topology diagram in your lab reports can improve clarity—draw.io is a popular choice for this. Finally, ensure that your report writing toolset does not violate OffSec’s Academic Policy; for example, as stated in the OSCP Exam Guide, using large language models (LLMs) and artificial intelligence (AI) chatbots to generate or refine content constitutes sharing PEN-200 material with a third-party, which is a copyright violation.

Each firm has its own style guide for consultants, so it’s important to adopt a writing style that aligns with industry expectations when creating lab reports. While I couldn’t find a publicly available style guide specifically for penetration test reports, the Microsoft Writing Style Guide serves as a suitable alternative. Below are key writing principles to follow, with some modifications and additions to Microsoft’s guide:

• Use active voice over passive voice (e.g., “the student scanned the host…” vs. “the host was scanned by the student…”), unless the latter sounds objectively less “awkward”
• Maintain a consistent preterite verb tense and third-person narrative (e.g., “the student conducted a penetration test…”)
• Spell out acronyms on first use (e.g., “dynamic link library (DLL)”)
• Assign articles to acronyms based on pronunciation (e.g., “a DLL, an ISP”)
• Ensure text in screenshots is at least as large as figure subtitles or body text for readability
• Avoid opinionated language, colloquialisms, redundant phrases, and contractions to maintain a professional tone

Welcome - Microsoft Writing Style Guide

The main drawback of using the PEN-200 labs for report writing practice is that students cannot share their reports for peer-review due to copyright restrictions. According to Section 16 (IP Ownership) of OffSec Terms and Conditions, students are forbidden from sharing derivative PEN-200 content such as lab walk-throughs—which implicitly includes reports. Violating this agreement could result in punitive action from OffSec, such as having existing certifications revoked or being banned from future enrollment. To work within these constraints, students should conduct independent research on report writing and rigorously self-grade their reports while keeping them private. Those seeking peer feedback can instead write reports on alternative virtual lab environments with looser copyright restrictions, such as Hack the Box (HTB), and request evaluation from qualified career mentors.

It’s in your best interest to start developing your report writing skills early and the professionally managed PEN-200 lab networks provide an excellent environment to practice within. If you’re still struggling with report writing—or want to learn more about report review, delivery, and feedback procedures in general—consider enrolling in Luke Rogerson’s The Art of Report Writing, offered by Zero-Point Security. While I haven’t personally taken the course, it comes highly recommended by many in the consulting field and features an expansive syllabus. Investing in your report writing abilities—both during the PEN-200 labs and through external resources—will pay dividends in your future career.

Use the Labs as a Baseline for Your Personal Lab

The PEN-200 labs are excellent for simulating black-box penetration tests, but students shouldn’t rely solely on them for experimenting with offensive techniques. Your ultimate goal should be to either design a personal lab for yourself or use an existing template by the time you have completed the PEN-200 labs. If you choose to follow the former path, don’t be afraid to take inspiration from the labs when designing your own.

Developing your own cyber range offers several advantages over the PEN-200 labs. Most obviously, your lab access won’t expire when your OffSec subscription ends. Setting up a personal lab manually also deepens your understanding of how misconfigurations and vulnerable applications introduce security risks. You can also expand upon the PEN-200 syllabus by incorporating technologies not covered in the course, such as security incident and event management (SIEM) solutions, Kerberos delegation attack paths, and persistence techniques, to name a few. If you want to get even more granular, you can use a network protocol analyzer utility like Wireshark to manually inspect the network packets associated with your favorite tools or exploits. Finally, for students eager to stay current with cybersecurity trends, a personal lab provides a low-risk environment to deploy and test new exploits and tools.

Historically, deploying a personal cybersecurity lab was a costly endeavor. The resources required to simulate an entire Active Directory (AD) network required substantial investments in RAM, CPU cores, and HDD/SSD storage, often housed in bulky rack servers or large PC chassis. For those starting from scratch, costs can easily creep up to hundreds or even thousands of dollars. Luckily, mini PCs like the GMKtec NucBox offer a significantly more affordable and compact alternative to the comically large and expensive gaming rigs often associated with home labs. You can even purchase a barebones mini PC—no RAM, SSD, or OS pre-installed—and salvage memory and storage components from refurbished PCs. By integrating them into a custom-built setup and installing an open-source OS like Ubuntu, you can significantly cut costs while still aggregating the hardware required to create a fully functional lab environment.

Deploying a cybersecurity lab has traditionally been seen as a technically demanding experience due to the sheer scope of involved technologies. Most PEN-200 students may already be familiar with virtualization platforms like VMware Fusion and Workstation or Oracle VirtualBox, but not necessarily infrastructure as code (IaC) tools like Vagrant, Terraform, Ansible, and Packer. Similarly, containerization platforms such as Docker, Podman, or Kubernetes (K8s) introduce additional complexity. Once the lab is deployed, students must also administer network segmentation, domain name system (DNS) records, snapshot management, and, in the case of free licensed Windows virtual machines (VMs), manually extend the 180-day trial period by rearming the instance. Thankfully, platforms like Ludus have emerged to simplify the cybersecurity lab deployment process, consolidating many of these technologies into a single, streamlined solution.

Ludus is a cyber range orchestration platform that Erik Hunstad, the founder of Bad Sector Labs and Chief Technology Officer of Sixgen, created. The platform is built on top of the Proxmox Virtual Environment (Proxmox VE) hypervisor—a powerful open-source solution for VM and container management—enabling the virtualization of entire simulated networks. Among its many features, Ludus supports user-defined networking and firewall rules, DNS record management, snapshot functionality, and automated configuration pulls from Ansible Galaxy’s collection library. It deploys VM templates that can either be sourced from Ludus’s builtin library or customized and imported. The end-user only needs to install Ludus on a dedicated host, create an environment configuration file, deploy the range, and apply host- or domain-specific changes—which can easily be automated. Ludus is an extremely powerful and customizable tool for students who want to focus on refining their penetration testing skills rather than spending excessive time troubleshooting setup issues.

Ludus | Ludus

Designing a cyber range from scratch can be intimidating, but fortunately, multiple preconfigured penetration testing labs are available for students to deploy. One of the most popular lab templates today is Game of Active Directory (GOAD) by M4yFly, offered by Orange Cyberdefense. GOAD supports multiple attack path scenarios, many of which are covered in the PEN-200 course, making it an ideal choice for a first personal cyber range. It is also compatible with Ludus, further simplifying deployment.

Game Of Active Directory v2

Regardless of whether you use GOAD, a custom-built network, or another public lab template, consider supplementing the range with Elastic Security, an SIEM platform from the Elastic Stack (ELK). Integrating Elastic Security—or another free SIEM solution—into your lab allows students to observe how offensive techniques are detected in real time, providing valuable insights into defensive strategies. Elastic Security is also Ludus-compatible and, to demonstrate how to integrate it with a personal cyber range, I recommend this walkthrough from I.T. Security Labs that shows how to deploy GOAD with Elastic Security through Ludus.

NOTE:

Other noteworthy lab templates include BadBlood, ADCS Lab, and SCCM Lab, the last two of which are compatible with Ludus. BadBlood (by Secframe) is a PowerShell scripting suite that generates polymorphic Microsoft AD cyber ranges, ensuring distinct challenges with each invocation. The ADCS and SCCM labs focus on Active Directory Certificate Services (AD CS) and Microsoft Configuration Manager (MCM/SCCM). While not covered in the PEN-200 syllabus, recent security research has demonstrated that they both represent a significantly large attack surface, and the aforementioned labs provide an opportunity to develop skills in testing and securing both technology stacks.

In conclusion, a personal cybersecurity range inspired by the PEN-200 lab networks provides several key advantages: freedom from OffSec subscription limits, exposure to multiple relevant technologies, a sandbox for testing new techniques and tools, and the ability to integrate operational security (OPSEC) solutions. If you successfully design a custom penetration testing lab from scratch (not derivative of PEN-200 content), you can share your deployment template publicly—a valuable addition to your portfolio that can strengthen future job applications.

Develop a Testing Methodology

Once you begin the PEN-200 labs, it’s crucial to develop a repeatable and self-improving testing methodology early to avoid falling into a “spray and pray” mentality. A structured approach not only helps you uncover hidden vulnerabilities more efficiently, but also minimizes the risk of needing lab extensions or incurring multiple exam retake fees—maximizing the value of your PEN-200 experience.

In the context of PEN-200 and offensive security, a testing methodology is a systematic process encompassing enumeration, documentation, tool selection, exploit testing, privilege escalation, and post-exploitation routines. Ideally, your methodology should evolve as you progress through the labs—allowing you to address knowledge gaps, adopt time-saving techniques, and incorporate novel attack strategies. Students who follow a codified and mature testing methodology are less likely to waste time redoing scans, chase dead ends, overlook low-hanging fruit, become prone to burnout and frustration, or rely on luck or accidental success to achieve the testing objective.

In the first post of this series, I introduced the concept of command reference guides (AKA “cheat sheets”), which serve as a repository for your preferred offensive tooling usage. Beyond providing easy copy-and-paste shortcuts for commands, your reference guide can be structured to align with your testing methodology. In our previous example, I demonstrated how you could leverage Obsidian to document the usage of impacket-GetUserSPNs for conducting a Kerberoasting attack. Let’s expand on this example by organizing the navigation pane of the guide into distinct phases of a simple penetration testing methodology.

Our reference guide now consists of seven root directories, each representing a major phase of a typical penetration test (e.g., Reconnaissance, Initial Access, Privilege Escalation, etc.). Notice how each of the three tools we’ve added so far (i.e., impacket-GetUserSPNs, BloodHound, and Hashcat) is intuitively placed within the appropriate parent directory, and further compartmentalized into subdirectories based on the specific technique utilized during that phase (e.g., Identifying Kerberoastable Accounts, Kerberoasting, Hash Cracking, etc.). In the Internal Enumeration and Privilege Escalation phases, we’ve gone a step further by dividing techniques by the environment we’re working in—in this case, Active Directory, Linux, and Windows. Since Kerberoasting is specific to AD environments, we placed our entry for BloodHound and impacket-GetUserSPNs in the Active Directory subdirectory of Internal Enumeration and Privilege Escalation, respectively.

I want to emphasize the importance of iterative learning when developing your testing methodology. It’s unrealistic to expect that your initial attempt at following a testing methodology will be optimal, so it’s critical to refine your process after each lab or exercise—especially during the early, high-growth stage of your OSCP journey. Consider keeping a brief log for each machine or network within your reference guide, summarizing the attack path, the tools and techniques you utilized, and the areas where you struggled most. Use the last section in particular to feed both successes and setbacks into your methodology refinement. This continuous improvement process will steadily strengthen your assessment methodology, significantly boosting your confidence and skills ahead of the OSCP exam.

In conclusion, I strongly encourage students to treat the labs not just as an opportunity to improve their ability to identify and exploit vulnerabilities, but also as a chance to build an iterative, professional methodology for offensive security engagements—and to commit to regularly polishing it as they progress. Doing so will not only prepare you for the OSCP exam, but will also translate directly to future responsibilities in a consulting role, strengthen your technical interview performance, and ultimately support your growth as a security professional.

Conclusion

If you have questions, feedback, or suggestions you feel should have been included in this post, please feel free to leave a comment. In the next installment of this series, I’ll dive into the OSCP exam itself.

Getting the Most Value Out of the OSCP: The PEN-200 Labs was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

In this second post of a five-part series, I provide advice on how to best utilize the PEN-200 course material for a successful career in ethical hacking.

Disclaimer:

All opinions expressed in this article are solely my own. I have reviewed the content to ensure compliance with OffSec’s copyright policies and agreements. I have not been sponsored or incentivized in any way to recommend or oppose any resources mentioned in this article.

Introduction

In my previous post in this series, I discussed practical steps students could take before enrolling in the PEN-200 to get the most value out of the pursuit for the Offensive Security Certified Professional (OSCP) certification. The next step is to discuss what to do while reading the official course material.

PEN-200: Penetration Testing Certification with Kali Linux | OffSec

During the Course

“One hour per day of study in your chosen field is all it takes. One hour per day of study will put you at the top of your field within three years. Within five years, you’ll be a national authority. In seven years, you can be one of the best people in the world at what you do.” — Earl Nightingale

The PEN-200 course is composed of 28 distinct modules covering fundamental penetration testing concepts. In this post, I discuss my advice for students starting the course. My three main arguments are:

1. Use the note-taking process and exercises in PEN-200 as a chance to build confidence with tools and platforms relevant to offensive security roles
2. Not all PEN-200 techniques are practical for real-world assessments — some require adaptation to evade defenses while others risk service disruption, credential exposure, and more; understanding these nuances will make you a more effective and responsible professional
3. PEN-200’s curated references to blogs, proof of concepts (PoCs), and whitepapers provide not only valuable learning but also insight into key industry contributors, which can give you an edge in job hunting and networking

Use Job-Relevant Tools and Platforms to Write Your Notes

The OSCP certification is primarily geared towards beginner-level security professionals, so it’s fair to assume that most students have limited experience with the tools that offensive security consultants commonly use. The PEN-200 course provides a valuable opportunity for OSCP candidates to gain exposure to these tools and build their proficiency before entering the field.

To clarify, this section is not about the “hacking tools” you will inevitably use to identify and exploit vulnerabilities — PEN-200 provides ample guidance on those. My advice focuses on tools that are tangential to offensive tasks but still widely used in cybersecurity roles.

The PEN-200 course is designed to be completed using Kali Linux, a Debian-based distribution pre-installed with many of the most popular tools for offensive security testing. While Kali is convenient for quickly deploying a Linux virtual machine (VM) with a broad toolkit, you shouldn’t feel restricted to using it for professional development. Experiment with other Linux distributions (e.g., Parrot OS, BackBox Linux, BlackArch) and even Windows-based distributions (e.g., CommandoVM, FLARE-VM) while improving your proficiency with virtualization software like VMWare or VirtualBox.

Kali Linux | Penetration Testing and Ethical Hacking Linux Distribution

Although it is more commonly associated with software development, git — the popular version control system — is a valuable asset to offensive security consultants. Deploying your PEN-200 notes to a git repository offers a great opportunity to improve your fluency with fundamental operations like commit, pull, push, merge, and more. The biggest hurdle to mastering git is often the concept of “branching”: the process of diverging from the master branch (often called master or main , depending on your platform), making independent changes, then later merging those changes back into the main branch. Fortunately, there are many excellent online tutorials to help with this.

Learn Git Branching

If you choose to use git for your notes, consider hosting them in a private repository on GitHub or GitLab. Both platforms are based on git but offer additional features such as access control, repository templates, Markdown support, and more. Personally, I prefer GitLab for storing my notes due to its granular visibility controls, but GitHub is undeniably the most popular option and the one you’re most likely to encounter in a cybersecurity role. Whichever platform you choose, make absolutely sure it’s locked down and only you can access it. Copyright infringements of OffSec’s proprietary course materials — even accidental ones — can result in punitive responses from OffSec.

Now that you’ve chosen where to host your notes, it’s time to start writing them! The three most popular command-line text editors are Vim, Emacs, and nano. Of these, nano is the most beginner-friendly and an excellent starting point. Both Vim and Emacs are feature-rich and highly customizable, but have a high learning curve. If productivity and modularity are values you prioritize, it pays to start learning one (or both) early. The debate over which is superior is so enduring that it even has its own Wikipedia article.

Of the two, I only have experience with Vim, so it’s the only one I can recommend. Its commands can be confusing at times, but it’s a huge productivity booster in the long-run. If you decide to go down the Vim rabbit hole, I recommend starting with Vi, Vim’s precursor. Vi supports fewer commands, but is more likely to be encountered on older Linux distributions, so you won’t be caught off guard when your favorite Vim commands aren’t working. Once you’ve got the hang of Vi and are ready to graduate to Vim mastery, consider using the online tutorial/game VIM Adventures to hone your skills.

Learn VIM while playing a game - VIM Adventures

Command-line text editors can be fun, but they’re not for everyone. If that’s you, I highly recommend Obsidian as your note-taking application. As I discussed in my last blog post, Obsidian is an extremely popular graphical text editor packed with useful features. In 2021, an employee of the cybersecurity consulting firm TrustedSec published a blog post detailing how they incorporated Obsidian into their internal tradecraft documentation. While this setup isn’t a one-to-one equivalent of an online course, the features showcased in the article — especially the usage of the Obsidian-Git community plugin — are particularly relevant for PEN-200 students.

Obsidian, Taming a Collective Consciousness

tmux is an open-source terminal multiplexer which allows users to manage multiple terminal instances from a single screen. This might not seem groundbreaking if you work from a multi-monitor desktop; however, tmux is a game-changer when you’re managing multiple jobs on a remote Linux system with only shell access. You can split your terminal into multiple panes, reattach to sessions in case a connection drops, or run concurrent background jobs and reconnect to them as needed. Needless to say, it’s an incredibly powerful utility that’s often overlooked. Most PEN-200 students know IppSec from his Hack the Box (HTB) walkthroughs, but his tmux tutorial is just as valuable to OSCP-hopefuls.

Lastly, take advantage of every opportunity to sharpen your scripting skills in languages like Python, Bash, PowerShell, and more. Some great use cases would be scheduling tasks on Kali via cron jobs, or automating the process of reconnaissance, post-exploitation enumeration, and credential extraction. As you study, you’ll come across many PoC exploits — some written in languages you don’t know, others that could be improved upon. Instead of settling, why not rewrite the PoC yourself in your preferred language? Not only does this give you a working exploit, but it also becomes a strong addition to your job application portfolio. For inspiration, check out this blog post by a colleague of mine, who developed a working exploit for CVE-2022–35914 after finding the official solution for an OffSec Proving Grounds machine unsatisfactory. When developing scripts or PoCs, consider using a code editor like Visual Studio Code, a popular Microsoft option packed with features and supported languages.

Charting a path to RCE thru PHP callbacks

In short, be proactive when writing your notes. While you may never need to learn an entirely new scripting language, coding platform, or operating system on the fly during a billable engagement, it helps to have a solid grasp of the most useful technologies before landing your first consulting job.

Understand the Real-World Impact of Each Technique

The PEN-200 course provides a thorough and comprehensive foundation in penetration testing. However, applying its techniques in real-world engagements exactly as taught — without considering their potential impact — can lead to unintended consequences. Understanding not just how a technique works but also when, where, and whether to use it, distinguishes a skilled penetration tester from “script kiddies”. This section explores the risks of blindly following course material and how students can develop the judgment necessary to apply techniques responsibly in real-world engagements.

NOTE:

Developing a mature understanding of our tradecraft also helps mitigate the risk of introducing a backdoor through our toolkit. This is demonstrated in a recent CloudSEK report, which revealed that a trojanized version of a remote access Trojan (RAT) malware builder infected 18,459 devices, mostly belonging to cybersecurity students and hobbyists.

OSCP-certified professionals generally agree that PEN-200 does not emphasize stealth. While the syllabus includes an antivirus (AV) evasion module, the course primarily teaches identifying and exploiting vulnerabilities rather than evading detection — likely to prevent overwhelming new students. However, many of these techniques would immediately trigger alerts in security-mature environments. For example, Mimikatz, a popular tool for extracting plaintext credentials and password hashes from Windows Local Security Authority Subsystem Service (LSASS) memory, would almost certainly trigger endpoint detection and response (EDR) alerts if triggered in its original binary form. Many penetration testing techniques face similar scrutiny, and students should understand their OPSEC implications before applying them in real-world assessments.

When people think of service disruption in cybersecurity, their minds often jump to denial of service (DoS) attacks. However, even legitimate penetration testing techniques , if used carelessly, can cause outages and service unavailability. This risk is a major deterrent for businesses considering cybersecurity consulting services, as potential disruptions — such as bandwidth spikes, application latency, or unscheduled downtime — can lead to performance degradation and reputational damage. Common offenders include port scanners like Nmap, vulnerability scanners like Nessus, and brute-force password tools like Kerbrute, which can trigger account lockouts due to repeated failed login attempts. In real-world scenarios, penetration testers must pace network scans carefully, communicate clearly with the client about targeted systems and services, and adhere to account lockout policies to minimize disruptions.

Some tools and techniques can inadvertently expose plaintext credentials or hashed passwords, introducing serious security risks. In a simulated exercise, for example, we might use Mimikatz to dump NT LAN Manager (NTLM) hashes from memory or input a username and password into the Get-Credential PowerShell cmdlet before passing them to a PowerView function. While this may seem harmless in a controlled lab environment, the real-world consequences are far graver. If a Windows host logs command line output or an EDR solution records process activity, these credentials could be stored in logs accessible to administrators, regular users, or even threat actors — potentially leading to credential theft and further malicious actions long after the engagement is complete. Using third-party cloud-hosted tools to process artifacts containing client secrets — such as CrackStation for password hashes or DynamiteLab for packet captures — could also result in credential exposure, as neither the consultants nor the client have control over where that sensitive data is stored.

Lastly, we must consider whether a method could violate personal ethical boundaries or contractual obligations. Cybersecurity consulting firms often establish internal guidelines prohibiting high-risk activities that could cause irreversible damage with little value in a report, such as intentional DoS attacks, disabling security services, unauthorized password changes, or exfiltrating sensitive data like the ntds.dit database or structures containing personally identifiable information (PII). Consultants are also contractually bound by the client-imposed rules of engagement (ROE), which may restrict certain tactics or system/user targets, requiring testers to adjust their tradecraft. For example, Responder, a tool used for capturing NTLM v2 hashes, could unintentionally collect credentials from out-of-scope users or systems, constituting an indirect ROE violation. Ultimately, both personal ethics and professional constraints can significantly impact how penetration testers apply offensive techniques in real-world engagements.

In this section, I’ve explored four critical questions students should ask themselves after becoming proficient with a new security tool or technique:

1. Does this tool/technique carry a high risk of triggering OPSEC solutions?
2. Could this tool/technique result in service disruptions?
3. Could this tool/technique expose plaintext credentials or weak password hashes?
4. How could this tool/technique violate ethical or contractual boundaries?

NOTE:

Other important questions to consider — but omitted for brevity — include: “Would bypassing a common OPSEC solution for this tool/technique require disabling security services?”, “Does this tool/technique leave behind system artifacts that require cleanup to maintain stealth or as part of post-engagement procedures?”, and “Which threat actors have used this tool/technique before?”.

While these questions are important, they should not interfere with your learning process while navigating the course for the first time. Instead, keep them in the back of your mind and revisit them once you have the confidence and time to explore them fully. Developing this awareness early will help ensure you approach offensive security with the professionalism and responsibility expected in real-world engagements.

Read the Footnotes and Follow the Authors

Earlier this year, while preparing for the Offensive Security Experienced Penetration Tester (OSEP) certification, I was working through the PEN-300 course material, a direct continuation of the techniques taught in PEN-200. As I reviewed the footnotes in one of the modules, a particular blog post caught my attention. The topic was interesting, but what really stood out was the author’s handle — it looked vaguely familiar. Curious, I clicked on their profile to dig deeper.

A few seconds later, it hit me. I had accidentally stumbled on my boss’s old blog channel!

This story underscores an important lesson: the footnotes in PEN-200 (and other OffSec courses) aren’t just extra reading material — they’re a window into the offensive security industry. The white papers, PoCs, and blog posts referenced in these courses were written by researchers and hackers who have shaped modern penetration testing techniques and, in some cases, you may even cross paths with them later in your career. Taking the time to explore these citations offers more than just educational enrichment. It provides insight into “who’s who” in the industry, giving you an edge when networking or job hunting. While the extra reading may seem tedious, its benefits are an underappreciated strength of the course.

Understanding who the key players are in offensive security isn’t just an academic exercise; it’s a form of situational awareness that can benefit your career. The individuals whose blog posts and exploit code appear throughout the PEN-200 course are often the same ones presenting at security conferences, contributing to your favorite security tools, or even leading your next interview. The offensive security industry is surprisingly small, so by familiarizing yourself with just a handful of regular contributors, you gain a solid understanding of current industry trends, the companies driving innovation in different areas of cybersecurity, and even what technical skills hiring managers are prioritizing. This awareness can help you make more informed decisions, from identifying career mentors to choosing which companies to apply to.

Once you’ve read the footnote and understood its material, make an effort to follow the author on any platform where they have a public profile. Many security researchers publish their articles on Medium, but it’s also common to find their work cross-posted on personal websites. If the author works at a cybersecurity consulting firm, check their company’s blog — firms like TrustedSec, Mandiant, PortSwigger, and SpecterOps regularly publish security research. If the footnote references a coding project, explore the author’s GitHub profile to see their other work or contributions to open-source projects. Following them on X (formerly Twitter), BlueSky, or LinkedIn ensures you’ll receive timely updates on future publications. Lastly, try searching for the author on YouTube by their full name or handle, as they may have presented at major cybersecurity conferences like DEF CON, Black Hat, or RSA Conference.

Taking the time to read the footnotes and dive into the work of influential security researchers not only enhances the educational value you gain from the PEN-200 course, but also sharpens your situational awareness of the offensive security industry. This knowledge can serve as a powerful networking tool, help you discover new areas of professional interest, and guide your career path. So, next time you come across a footnote, don’t just skim it — take the extra step and use it as a launchpad for further exploration. You might just end up connecting with your next manager…

Conclusion

As always, feel free to comment if you enjoyed the article, have questions/criticisms, or would have liked to see other arguments included. In the next post, I will discuss my advice for the PEN-200 labs.

Getting the Most Value Out of the OSCP: The PEN-200 Course was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.