Nice-to-have Tools for OSCP Exam
Preparing for the OSCP is as much about efficiency and organization as it is about exploitation. While Kali comes pre-loaded with the "heavy hitters" like Nmap and Metasploit, several third-party scripts and utilities can significantly "quality-of-life" your 24-hour exam window.
Here are the most helpful "nice-to-have" additions for your OSCP toolkit:
1. Quality of Life & Shell Stability
Standard reverse shells are fragile (no arrow keys, no tab completion). These tools fix that.
rlwrap: Wrap your Netcat listeners (rlwrap nc -lvnp 4444) to get command history and arrow key support immediately.
Penelope: An advanced shell handler that automatically upgrades your reverse shell to a fully interactive TTY (handling stty rows/cols and terminal colors) the moment it connects.
Terminator: A terminal emulator that allows you to split your screen into multiple tiles (vertically and horizontally) and broadcast commands to multiple panes simultaneously.
2. Enumeration & Fuzzing (Speed Boosters)
The default dirb is slow. These alternatives are significantly faster and more flexible.
Feroxbuster: Written in Rust, it is extremely fast for recursive directory brute-forcing. It handles wildcards and filters better than most default tools.
ffuf (Fuzz Faster U Fool): The gold standard for web fuzzing. It is highly customizable for directory discovery, parameter fuzzing, and virtual host discovery.
AutoRecon: While many prefer manual enumeration, AutoRecon is a multi-threaded network reconnaissance tool that automatically kicks off port scans and subsequent service-specific enumeration (like enum4linux for SMB or gobuster for HTTP).
3. Privilege Escalation Scripts
You will likely need to run these on every target you compromise.
PEASS-ng (LinPEAS & WinPEAS): The most comprehensive privilege escalation scripts available. They highlight potential misconfigurations, sensitive files, and kernel exploits in color-coded output.
Linux Exploit Suggester (LES): Specifically looks at the kernel version and suggests potential exploits based on known CVEs.
PowerUp.ps1: A classic PowerShell script (part of PowerSploit) for finding Windows privilege escalation paths (service permissions, unquoted service paths, etc.).
4. Pivoting & Tunneling
The OSCP now features an Active Directory set that often requires pivoting.
Ligolo-ng: A high-performance tunneling tool that creates a virtual TUN interface on your Kali machine. It allows you to "route" your traffic into the target network as if you were physically there, making tools like Nmap work natively against internal IPs.
Chisel: A fast TCP/UDP tunnel over HTTP. It is excellent for bypassing firewalls and is often more stable than traditional SSH tunneling.
5. Note-Taking & Documentation
You must provide a professional report. Good notes during the exam save hours of stress later.
Obsidian or CherryTree: Local note-taking apps that allow you to organize machines by folders, link pages, and store screenshots easily.
Flameshot: A powerful screenshot tool that allows you to draw arrows, blur sensitive data, and add text directly to the image before saving it.
Pro-Tip: The /opt Directory
Create a dedicated folder (like /opt/tools) to keep these external scripts organized. Since you cannot use automated "one-click" exploitation tools (like SQLmap) on most machines during the exam, having these manual enumeration and post-exploitation scripts ready will be your biggest advantage.
