# Pwnote Offsec Pen200

> Use whenever the user is working on Offsec's PEN-200 course/OSCP — PWK lab notes, exam report drafting, screenshot/evidence discipline, or exam flag handling. Trigger on "OSCP", "PEN-200", "PWK", "OSCP exam report", or "proof.txt", even without the word "skill".

- **Type:** Skill
- **Install:** `agentstack add skill-pwnote-skills-pwnote-offsec-pen200`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Pwnote](https://agentstack.voostack.com/s/pwnote)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Pwnote](https://github.com/Pwnote)
- **Source:** https://github.com/Pwnote/skills/tree/main/skills/pwnote-offsec-pen200

## Install

```sh
agentstack add skill-pwnote-skills-pwnote-offsec-pen200
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Offsec PEN-200 / OSCP Workflow

Reference for structuring PWK lab notes and producing an exam report that meets Offsec's grading requirements. Offsec grades on documentation completeness as much as exploitation success — sloppy evidence fails an otherwise-successful exam.

## Security

- Never output flag values (`local.txt`, `proof.txt`) anywhere — use `` as placeholder text
- Screenshots with flags are taken by the user, not generated by the agent
- Report templates include flag placeholders; the user fills in actual values from their own terminal output

## 1. Exam Report Structure

Offsec's required sections, in order:

```
1. Executive Summary
2. High-Level Summary of Vulnerabilities (table: host, vuln, severity)
3. Recommendations
4. Methodologies (information gathering, service enumeration, etc.)
5. Attack Narrative — one section per target host
   5.x [Hostname/IP]
     - Information Gathering
     - Service Enumeration
     - Exploitation
     - Privilege Escalation
     - Proof (local.txt AND proof.txt contents + screenshot)
6. Appendix (additional evidence, full tool output if needed)
```

Each target host section must independently stand alone — a grader should be able to reproduce that one host's compromise from that section alone, without referring back to another host's notes.

## 2. Screenshot / Evidence Discipline

Offsec's most common reason for exam point deductions is incomplete evidence, not incomplete exploitation. For every step that matters to the narrative:

- [ ] Screenshot shows the **command typed**, the **output**, and (where applicable) the **flag/hash contents** in the same frame
- [ ] Terminal prompt visible showing hostname/IP or user context, so it's clear *which* box/user the screenshot is from
- [ ] For privesc: screenshot the `whoami`/`id` before AND after, not just after
- [ ] For flag capture: screenshot `cat proof.txt` / `type proof.txt` output directly

Take screenshots as you go, not retroactively — retroactive reconstruction is where evidence gaps happen.

## 3. Lab Note Structure (separate from exam notes)

Keyed by lab network segment, since PWK labs are organized that way:

```
00_Lab_Overview
Segment_A/
  Host_[IP]_[hostname]
Segment_B/
  ...
```

Lab notes can be more exploratory/messy than exam notes — the point is coverage and technique practice, not a polished narrative. Convert to exam-report format only for the final submission.

## 4. Proof File Conventions

- `local.txt` — user-level flag, captured after initial foothold
- `proof.txt` — root/SYSTEM-level flag, captured after privilege escalation
- The report must include a flag section for each host; the user pastes the actual hash from their own screenshot
- Never modify, delete, or attempt to read these files' contents through any means other than their intended access — tampering is a code-of-conduct violation

## 5. Common Point-Loss Patterns to Avoid

- Skipping the "Information Gathering" subsection because it feels redundant with "Service Enumeration" — Offsec grades them as distinct
- Not explaining *why* a vulnerability exists, only that it was exploited
- Missing the offline/standalone target requirement in the report (some point categories are host-independent)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Pwnote](https://github.com/Pwnote)
- **Source:** [Pwnote/skills](https://github.com/Pwnote/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-pwnote-skills-pwnote-offsec-pen200
- Seller: https://agentstack.voostack.com/s/pwnote
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.