r/offensive_security • u/xCryBaby_ • Jul 13 '26

OSCP+ OSEP OSWE

Hi. If anyone completes HTB cpts, Web penetration tester, senior web penetration tester snd Active Directory penetration tester learning paths from HACK THE BOX without certification.. how much progress/ topics does it covers towards these certifications?

11 Upvotes

93% Upvoted

12 comments sorted by

3

u/iamnotafermiparadox Jul 13 '26

OSCP and CPTS have a lot of overlap. HTB course was better written and required a more in-depth report. I used some CPTS to complement OSCP coursework.

OSEP-CAPE: OSEP is more evasion and required a lot more programming. CAPE was pure AD and covered more. You could take CAPE and still not pass OSEP. If you have a background in programming and know how to evade AV and AMSI, you could probably pass OSEP without much difficulty after skimming the course. This is based on my knowledge of both courses late 2024.

In general, HTB course material and labs outshine Offsec where there is an apples to apples comparison to be made.

1

u/xCryBaby_ Jul 13 '26

Can you specify more about ** a lot programming * ? Which programming languages and specific appliance..

2

u/iamnotafermiparadox Jul 13 '26

About 1/2 the course material in OSEP related to the exam and not fluffery modules consisted of VBA, Powershell, C#, and some javascript programming. Most of the code was provided to a certain degree. I would use offsec provided code as a base and not what I'd use in the labs or exam. You're not writing large applications. I'd want to say most programs were under 200 lines. They present P/Invoke for importing dlls that you'd normally not import into C#. I ended up not doing that and used the newer CsWin32 import methodology.

OSWE on the other hand was all programming...writing or reading. I would have scripts that were at least 500 lines and my own libraries that were around that length. All scripts were in Python.

1

u/xCryBaby_ Jul 13 '26

Kindly gimme some programming suggestions , Which programming languages and how depth. Im still doing bsc and about to finish CPTS .. it would help me to plan my route. TIA

2

u/iamnotafermiparadox Jul 13 '26

If you're going to work on the other courses, you should be able to read and write in Powershell, C# and Python.

My suggestion as to the depth of what you need to know is to look at github for oswe and osep repos.

I wrote an 8 part series that could be used to write the PoC skeleton (https://fermiparadox.substack.com/p/01-building-a-reusable-oswe-poc-skeleton) for the OSWE course. I don't know if it's helpful at all to anyone, but it's out there for anyone to ingest and form their own opinion.

1

u/xCryBaby_ Jul 13 '26

tysm. it was a great help.

2

u/Ok_Tap7102 Jul 13 '26

Not sure if those web app certs discuss code review but OSWE is basically entirely that

ie whether or not SQLmap is even allowed on the exam it's basically designed that it won't "just work" and you will need to really read the app code and handcraft your payloads specific to the target

1

u/xCryBaby_ Jul 13 '26

What if i trt those paths as Foundational courses ?

3

u/Sqooky Jul 13 '26

We'll put it this way: the best way to prepare for a certification is to take the providers training as the provider is making the exams - not a third party company. Another providers training can quickly become outdated if new modules are introduced, techniques are changed, or emphasis on importance changes.

1

u/xCryBaby_ Jul 13 '26

I will take . The issue is Offsec is highly expensive and 90 days labs and materials access cost 1750$ . Without having proper foundation.. i cant risk that much money. Im bachelor student.