Penetration testing methodology references
Most exam failures on the practical side are missed enumeration, not missed exploits. These are working references for the methods every offensive-security exam assumes you already have — enumeration order, privilege escalation, web application testing and Active Directory attack paths.
The Active Directory attack chain used across OSCP, OSEP, CPTS, CRTP and PNPT — enumeration, credential access, lateral movement and escalation.
Linux and Windows privilege escalation for OSCP, CPTS, PNPT and OSEP — what to enumerate first, the escalation paths, and why the kernel exploit is last.
A port-by-port enumeration reference for offensive-security exams — what to check on each service, in what order, and when to stop and move on.
Web application security testing for BSCP, OSWE, CWEE and CBBH — how to map an app, the vulnerability classes to test every input against, and when to stop.