Show Notes
In this episode, Prabh sits down with Sérgio to break down a practical, no-fluff roadmap for preparing for the OSCP (Offensive Security Certified Professional) certification.This discussion is designed for anyone who feels overwhelmed by OSCP — and wants a structured approach that focuses on hands-on skills, repeatable methodology, and exam-ready habits.Sérgio’s Journey: From Hospitality to OSCPSérgio shares how he transitioned from being a restaurant shift supervisor into cybersecurity — and eventually earned the OSCP.Key takeaway: OSCP isn’t about being “naturally gifted.”It’s about practice, repetition, and building a personal methodology.What You Should Learn Before OSCPBefore buying OSCP material, Sérgio strongly recommends building fundamentals first:Linux fundamentals (file system, permissions, services, processes)Windows fundamentals (users, services, logs, privilege escalation basics)Basic networking & enumeration habitsComfort using terminals and troubleshootingHe suggests starting with platforms like Hack The Box or TryHackMe to build confidence before going into OSCP labs.Best Practice Platform for Exam ReadinessSérgio recommends training on Proving Grounds because it most closely matches OffSec-style machines and exam patterns.Why it matters:Practicing on OffSec-style labs builds the exact muscle memory needed for OSCP — especially under time pressure.The OSCP Notes System That Saves You in the ExamOne of the strongest lessons in this episode:Your notes and checklists are your real “weapon” in OSCP.Sérgio explains how he built an Excel-based tracking system to document:Machine difficulty rating (your own subjective scale)Steps takenKey learnings and takeawaysWhat worked / what failedRepeatable exploitation patternsThis helps you avoid repeating mistakes and creates a “playbook” you can use during the exam.OSCP Exam Methodology (How to Think Under Pressure)Sérgio stresses that OSCP success depends on a personal workflow:Start with full port scansRun targeted enumerationCheck common entry points (shares, web apps, creds, services)Always validate credentials across machinesBuild a repeatable process you can run like a scriptHe also highlights the value of becoming tool-flexible (not tool-dependent). Active Directory in OSCP (What to Focus On)The OSCP Active Directory portion is not about advanced enterprise AD topics.It’s about doing the fundamentals extremely well:Recon + enumerationCredential access and reuseLateral movement basicsTools like SecretsDump / Mimikatz (used correctly)Repeating the process across AD machines systematicallyTools, Tunneling & Not Overusing MetasploitSérgio shares realistic advice on tools OSCP candidates should understand:Privilege escalation basicsEnumeration scriptsPivoting/tunneling tools like Ligolo-NG and ChiselAvoid becoming dependent on MetasploitLearn to adapt when a tool failsOSCP Reporting: The Skill Most People IgnoreA big OSCP differentiator is report writing.Sérgio breaks down what matters in the exam report:Clean structureClear reproduction stepsScreenshots for proof (flags + key commands)A readable narrative (work backwards if needed)Make the examiner’s job easyHow to Know You’re Ready for OSCPSérgio suggests readiness looks like:You can solve boxes consistently in a limited timeframeYou’re comfortable with OffSec-style lab patternsYou have a repeatable checklist-driven methodologyYou can document everything clearly while hacking
More from Prabh Nair
Cybersecurity tools can identify vulnerabilities.But offensive-security professionals need to understand something deeper:How can multiple weaknesses be connected into one meaningful attack path?https://www.linkedin.com/in/saurabh-kumar-pandey-1303b4126/In this practical podcast, Prabh speaks with Saurabh Kumar Pandey, an offensive-security practitioner, about how penetration testers approach a target from initial reconnaissance through enumeration, validation, exploitation and privilege escalation.Using a controlled lab scenario, the discussion explores the thinking behind each stage of a penetration test, rather than simply running automated tools.Topics coveredOffensive-security methodologyReconnaissance and attack-surface discoveryUnderstanding Nmap scan resultsService and version identificationSMB and NetBIOS security assessmentIdentifying configuration weaknessesFalse positives vs validated findingsWhy manual validation still mattersHow attackers chain vulnerabilitiesInitial-access thinkingOne of the strongest lessons from the session:A vulnerability by itself may not represent the complete risk. The real risk often appears when several weaknesses are chained together.That is why penetration testing requires more than scanners and exploit tools.The tester must continually ask:What did I learn? What can I validate? What does this give me access to next?The discussion also provides an important defensive lesson.A collection of seemingly manageable issues—unnecessary services, configuration weaknesses, exposed credentials or weak access controls can collectively create a much larger attack path
Let's learn the thin line difference between masquerad vs eavesdropping Attack#cybersecurity #infosec #pentesting #comptia#isaca #cybersecurity #infosec #isc2 #ccsp #cism
Prepare for the Offsec OSAI+ certification with insights on interview strategies for 2026 cybersecurity roles.Ankit Bharathan joins Prabh Nair to discuss the path to mastering the Offsec OSAI+ (AI-300) certification. This conversation focuses on the practical skills required for professionals aiming to enter the specialized field of AI Security.Beyond the technical curriculum, we analyze effective interview strategies and the specific criteria used for candidate selection in 2026. Whether you are looking to pivot your career or sharpen your expertise, this session provides a roadmap to navigating the hiring landscape for off-sec positions.A practical learning path discussed in the episode:Web Security → AI Fundamentals → Build an LLM App → RAG → Embeddings → Agents → Threat Modeling → AI Security Labs → AI Red TeamingThis episode will be useful for:Pentesters • Red Teamers • AppSec Engineers • AI Security Professionals • OSCP holders • Security Researchers • AI Engineers • Cybersecurity StudentsSubscribe for weekly technology infrastructure breakdowns and comment below on what certification topics you want covered next.Prepare for the Offsec OSAI+ certification with insights on interview strategies for 2026 cybersecurity roles.Ankit Bharathan joins Prabh Nair to discuss the path to mastering the Offsec OSAI+ (AI-300) certification. This conversation focuses on the practical skills required for professionals aiming to enter the specialized field of AI Security.Linkedin Profilehttps://www.linkedin.com/in/ankitbharathan/https://github.com/microsoft/AI-Red-Teaming-Playground-Labshttps://owasp.org/projects/top-10-for-large-language-model-applicationshttps://atlas.mitre.org/AI red teaming is becoming a serious extension of offensive security.But preparing for AI security assessments requires more than learning prompt injection.You need to understand how modern AI applications are actually built — LLMs, RAG pipelines, vector databases, embeddings, agents, APIs, web applications and the traditional infrastructure underneath them. Beyond the technical curriculum, we analyze effective interview strategies and the specific criteria used for candidate selection in 2026. Whether you are looking to pivot your career or sharpen your expertise, this session provides a roadmap to navigating the hiring landscape for off-sec positions.Subscribe for weekly technology infrastructure breakdowns and comment below on what certification topics you want covered next.
Welcome to our deep dive into the world of ransomware. In this video, we'll unravel the intricacies of ransomware investigation , exploring their mechanisms, common vectors, and the tools used for analysis. From understanding the initial infection point to decrypting locked files, our comprehensive analysis will equip you with the knowledge to stay one step ahead of cyber threats.In this video, we'll be breaking down ransomware: what it is, how it works, and some tips on how to investigate ransomware . We'll also be discussing the different types of ransomware analysis, including static and dynamic analysis.If you're investigating ransomware symptoms or trying to determine if a system is infected, this is the video for you! We'll discuss the different types of ransomware, how to investigate them, and how to determine if a system is infected. After watching this video, you'll be able to break down ransomware and investigate it in a way that will help you protect your data!Ransomware Serieshttps://www.youtube.com/playlist?list=PL0hT6hgexlYy0PZMz9DejEZ2iDKBC-RTGSOC Interview Questionshttps://www.youtube.com/watch?v=UF_oLGoRL_c&list=PL0hT6hgexlYxd24Jb8OE7vZoas-iTcHAcPlaylist Network Securityhttps://www.youtube.com/playlist?list=PL0hT6hgexlYzX6AWwcyDbAZQUKYJL2MdtGRC Interview Questionshttps://youtu.be/4TyfNtFGAC4Internal Auditor Playlist https://www.youtube.com/playlist?list=PL0hT6hgexlYyNWBcGYfabwumCr0GKmLWvHow to make career progression post #isc2 and #isaca https://www.youtube.com/watch?v=PT0fnCWzAFA&pp=ygUJZ3JjIHByYWJoHow to make career in GRChttps://www.youtube.com/watch?v=_S4t9S5N4Ts&t=102s&pp=ygUJZ3JjIHByYWJoHow to Build PIMShttps://www.youtube.com/watch?v=IwAseU4ZmuQHow to Implement 27001 in an organization https://www.youtube.com/watch?v=sQqJH2naU6IHow to conduct PIAhttps://www.youtube.com/watch?v=z1BD7exH2Ow&t=774sHow to Make a career in GRChttps://www.youtube.com/watch?v=_S4t9S5N4Ts&t=7sTelegram Grouphttps://t.me/InfoseclearningStart your career in cybersecurity with free resources https://lnkd.in/g89gxkzc. Cybersecurity Career: How to Make a Career in Cybersecurity 2022 https://lnkd.in/gCGBnRM7Pentesting Career https://lnkd.in/gQYenKYdTelegram Group Linkhttps://t.me/InfoseclearningCybersecurity Guidehttps://www.youtube.com/playlist?list=PL0hT6hgexlYwdYBW6yqUQMuRqvABiQPXkFollow me on Instagramhttps://www.instagram.com/prabhnair/?...#soc #cybersecurity #infosec #ransomware , #Cybersecurity #malware Analysis, #RansomwareDecryption, Cyber Threats, #ransomwareattack #DigitalSecurity.
Welcome to our channel! In this video, we dive deep into realistic ITGC interview questions frequently asked in Big 4 firms. If you're preparing for an ITGC (IT General Controls) interview with top consulting firms like Deloitte, PwC, EY, and KPMG, this video is a must-watch!What You'll Learn:The most common ITGC interview questions asked by Big 4 firms.Insider tips on how to answer these questions effectively.Real experiences from candidates who have successfully navigated ITGC interviews.Essential knowledge for ITGC consulting and audit roles.Why Watch This Video?Securing a job in ITGC consulting or ITGC audit at a Big 4 firm can be challenging. This video equips you with the insights and confidence you need to ace your interview. Whether you're a fresh graduate or an experienced professional, understanding these interview questions is crucial for your success.What You'll Learn:The most common ITGC interview questions asked by Big 4 firms.Scenario-based questions to help you prepare for real-life interview situations.Insider tips on how to answer these questions effectively.Real experiences from candidates who have successfully navigated ITGC interviews.Techniques to handle questions with confidence and make a great impression.Essential knowledge for ITGC consulting and audit roles.Internal Audithttps://www.youtube.com/playlist?list=PL0hT6hgexlYyNWBcGYfabwumCr0GKmLWvGRChttps://www.youtube.com/playlist?list=PL0hT6hgexlYz1Usn1Nrnur6OzVoz59zylAudit Serieshttps://www.youtube.com/watch?v=an15rFruIvo&list=PL0hT6hgexlYzvKY3AcOX2M7bkLRFVpQv4&pp=gAQBiAQB#ITGCInterviewPreparation#itaudit #audition #audition #itsecurity #itgc #sox