OSCP-Like Machines: TJ Null's List and How to Use It

The short answer

OSCP^®-like machines are practice boxes that play like the standalone machines on the OSCP exam: you enumerate, get a foothold, then escalate to root or SYSTEM, with little guesswork and no need for Metasploit. The best-known list of them is TJ Null's, a free Google Sheet of well over 100 Hack The Box, Proving Grounds and Vulnlab machines, last updated July 18, 2026.

Those boxes train the standalone part of the exam well. The OSCP+^™ (OSCP Plus) exam also has an Active Directory set of three linked machines, and most list entries are single machines, so add AD chains to your practice from the start. How you work each box counts for more than how many you finish: time-box it, keep the walkthrough closed, and take notes and screenshots as if you had to write the report.

We're Hacker Blueprint. Our instructor holds the OSCP, our academy has more than 600 students, and around 7,000 people have claimed our prep materials. Below: the lists, where to run the boxes, and a routine that turns each one into exam practice.

Watch OSCP-style labs worked from start to finish

Here's what working a full Active Directory set looks like. This walkthrough takes one of our paid Active Directory chains, Chain_07 (Crosslink), through enumeration, Windows privilege escalation, credential dumping and reuse, and a pivot through the network to domain admin. It runs 2 hours 33 minutes, so try the chain yourself first if you plan to buy it.

Our YouTube playlists cover the same skills in shorter videos:

• OSCP Practice Labs: our Active Directory chains worked part by part, plus the full walkthrough above.
• Hacking Active Directory: AD methodology from the basics to full guides, with BloodHound, AS-REP roasting, Kerberoasting, certificate attacks and lateral movement.
• Pivoting and Network Tunneling: Ligolo-ng and Chisel, including the pivots from our chain walkthroughs.
• Most Common OSCP Attacks: one technique per video, such as GPP credentials, PrintNightmare and SeBackupPrivilege.
• My Pentesting Methodology: how we approach initial access, Linux privilege escalation and Active Directory on any machine.
• OSCP Exam Prep Guide: our full OSCP course, roadmaps, note-taking and exam advice in one place.

What makes a machine OSCP-like

OffSec's exam guide describes a private VPN network with "a small number of vulnerable machines": three standalone machines worth 20 points each (10 for initial access, 10 for privilege escalation) and one Active Directory set of three machines. The guide bans automatic exploitation tools such as SQLmap, allows Metasploit against one target only, and says the exam's primary objective is "to evaluate your skills in identifying and exploiting vulnerabilities".

A good OSCP-like machine fits that shape:

• Enumeration leads the way. Ports, versions, files and web content point you to the way in. You shouldn't need a riddle, hidden data in an image or a lucky guess.
• Two stages. A foothold as a low-privileged user, then privilege escalation, the same split as the 10 and 10 points on each standalone.
• Public exploits you read and adjust. OffSec's AD preparation article tells you to "read exploits prior to using them" and to check multiple exploits for the same vulnerability. A box that only falls to a one-click Metasploit module teaches little you can use on exam day, where Metasploit is limited to one target.
• Linux and Windows. OffSec's PEN-200 page lists Windows and Linux privilege escalation among the course skills, so practice both.
• Domain machines that start from a login. The exam's AD set starts you with a username and password, "simulating a breach scenario". TJ Null's list tags some newer AD boxes "Assumed Breach".

The platform matters less than the way you play. A list box worked with the writeup open, or solved by a tool the exam bans, trains you for a different test.

TJ Null's OSCP list: what it is and where to find it

TJ Null's list, often searched as the "tjnull list", is a public Google Sheet called the NetSecFocus Trophy Room, curated by TJ Null. The OSCP tab is named "PWK V3 (PEN 200 Latest Version)", and other tabs cover OffSec's OSEP, OSWE and OSED exams. When we checked on November 3, 2026, the PEN-200 tab said "Latest Update: July 18th 2026".

The PEN-200 tab is split by platform, then by operating system:

The Post-OSCP sections are labelled "Challenging yourself", so keep them for after the main sections. The current tab has no TryHackMe or VulnHub section, although Proving Grounds Play hosts machines from the VulnHub community. Copies on other sites, such as PDFs, can be older than the sheet, so check the update date.

Its Hack The Box AD section includes boxes such as Active, Forest and Sauna, and the Proving Grounds Practice AD section includes Nagoya. For after you finish a box, the Hack The Box section links 0xdf's page, which tracks TJ Null's lists and links a 0xdf writeup for each box.

Read TJ Null's disclaimer before you start. The boxes are meant "as a way to get started, to build your practical skills, or brush up on any weak points". The list "is not a substitute to the actual lab environment" in PEN-200, and it "is not exhaustive, nor does it guarantee a passing grade for the OSCP Exam." The sheet also asks you not to request edit access, so use File, Make a copy, and track your progress in your own copy.

LainKusanagi's list and other OSCP-like machine lists

The newer list people compare with TJ Null's is LainKusanagi's OSCP Like sheet. The list "overlaps a lot" with TJ Null's, filters out boxes it considers too far outside PEN-200 and the exam (it names the Proving Grounds boxes Kyoto and Nara as ones meant mostly for OSEP and OSED), and adds boxes from Hack Smarter Labs and Virtual Hacking Labs. It keeps a few boxes it says are harder than the OSCP because they're worth doing.

A few of its notes help with any list:

• It advises against skipping Hack The Box entirely, because some boxes there cover topics "rare even in PG practice like SNMP and Keepass".
• Its TryHackMe section is marked as no longer updated.
• It offers its own OSCP-LK practice exams: sets of three standalone and three domain-joined machines you run locally, with writeups.
• Its update log shows changes in September and October 2026, so it's actively kept.

Since September 26, 2026, the list has also included a table of our assumed-breach Active Directory chains, under the heading "AD labs good for OSCP that you can run locally".

Community forks, linked from the sheet, add difficulty ratings and a tracker for both lists. Pick one list as your main track and stop shopping for boxes. The two overlap heavily, so finishing one covers much of the other.

Where to practice OSCP-like boxes: platforms and prices

Prices are as of November 3, 2026, from each platform's own site.

PEN-200 labs. OffSec's PEN-200 page lists 9 challenge labs and says three "are designed to closely replicate the OSCP+ exam environment". If you've bought the course, finish those before any community list. Our OSCP cost breakdown has the course prices.

Proving Grounds Practice. This is OffSec's own practice platform, and OffSec says "Retired OSCP+ exam labs are available" there. LainKusanagi's list presents its Proving Grounds Practice picks as the most authentic OSCP-like boxes it has. Practice is also included in OffSec's Annual Membership ($299 a year), which bundles OSCP+ maintenance.

Hacker Blueprint AD chains. These are ours: downloadable Active Directory chains that run offline on your own computer. Each one is three linked machines that you start from a domain username and password, the format most lists don't cover (more on that in the Active Directory section below). Chain_01 and Chain_03 are free, and the other eight are on our labs page.

Proving Grounds Play. Free VulnHub community machines with a 3-hour limit, good for Linux warm-ups.

Hack The Box. The free tier gives you 20 active machines. Many of the Hack The Box entries on both lists are retired, and retired machines need VIP+. Vulnlab, which has its own section on both lists, is moving into Hack The Box, which announced on April 2, 2025 that Vulnlab's machines and AD chains would join its platform.

VulnHub. Free VMs you import into VirtualBox or VMware and, as its FAQ recommends, run on an isolated network. The newest entry on its front page is from July 2022, so treat it as an archive. Our post on OSCP lab requirements covers the hardware for running VMs locally.

TryHackMe. Learning paths and rooms, some free.

Our OSCP roadmap shows where box practice fits in a full study plan.

How to work a practice machine like the exam

A box only trains exam skills if you play it under exam rules. OffSec's preparation article tells you to simulate the exam and practice report writing after you exploit machines. Here's a routine for every box on your list:

1. Go in cold. Skip the box's reviews, forum threads and writeup titles before you start. They often name the vulnerability.
2. Set a timer. Under the heading "Avoid rabbit holes", OffSec suggests 2 to 3 hours per standalone machine, another two hours for privilege escalation once you have a shell, and 4 hours for the AD set. "If time runs out, move on." On a practice box, that means a break or a hint (next section).
3. Enumerate before you exploit, and again after. OffSec calls enumeration "a cyclical approach": after gaining new access, enumerate again in the context of your new privileges. Keep a checklist and run all of it before you decide you're stuck.
4. Stay inside the exam rules. Leave out what the exam restricts (automatic exploitation tools such as SQLmap, commercial tools, AI chatbots), and use Metasploit on at most one machine in any practice set. Our post on OSCP allowed tools has the full list.
5. Document as you go. Save every command and its output, and take proof screenshots to exam standard: an interactive shell, the proof file shown with type or cat, and the target's IP address in the same screenshot. Our guide to OSCP note-taking covers how to structure the notes.
6. Write a short report for some boxes. Every third or fourth machine, write it up the way the exam wants: thorough enough that a "technically competent reader" could replicate your attack step by step. In the skill-domain table in OffSec's AD preparation article, documenting findings carries the largest weight, 33%. Our OSCP report template post shows the format.

Keep one log row per box: the date, time to foothold, time to root, hints used and the step you missed. That log is what you'll use later to judge readiness.

When to take a hint, and how to learn from a writeup

OffSec's advice fits on one line: "Avoid relying on hints and walk-throughs." Everyone gets stuck sometimes, though, and a small nudge followed by a lesson beats an evening of staring. Use a fixed order:

1. Reach your time box first. Before any hint, rerun your checklist and write a stuck note: what you've found, what you've tried, and where you think the path goes.
2. Re-enumerate. The full port range, UDP, every web directory and parameter, files readable as your current user, and every credential you've found tried against every service. Many stalls end here.
3. Take the smallest hint you can. A one-line nudge from a study partner or a spoiler-tagged forum hint costs you less learning than a full writeup.
4. Open the writeup at your step, then close it. Read only up to the point where you stopped, then carry on alone.

The learning happens after the box:

• Name the miss. Write one line on why you missed the step: a service you didn't enumerate, a version you didn't look up, a password you didn't try elsewhere. Add a check to your checklist so it can't happen twice.
• Read a second solution, even for boxes you rooted. 0xdf's writeups and IppSec's videos often show another path, and OffSec suggests exploiting a machine "using multiple approaches and/or techniques".
• Redo hard boxes later. A week or two on, root the box again from scratch without your notes. OffSec tells you to "revisit challenges and topic labs that were challenging".

Keep your own writeups private unless the platform's rules allow publishing them.

What most lists miss: the Active Directory set

The exam's Active Directory set is three machines worth 10, 10 and 20 points, and you start with a username and password. OffSec's FAQ adds that "There may be pivoting required." Most list entries are single machines. Their AD boxes teach techniques well, and a few are assumed-breach boxes or multi-machine chains, but three linked machines from one domain login are rare on a standalone list.

OffSec's AD preparation article explains why that gap matters: "Unlike stand-alone machines, AD needs post-exploitation." It tells you to practice "by finding dependencies between AD challenge machines", and after you gain domain user access, to "enumerate the domain as that user", adding that "This concept is often overlooked."

The AD mistakes we see most often are pivoting, relaying and coercion, credentials stored in unusual places, not enumerating again after each new user, and overconfidence: assuming a topic won't come up.

To practice the set itself:

• PEN-200 challenge labs. If you have the course, challenge labs 4, 5 and 6 (OSCP A, B and C) each contain an AD set. OffSec suggests redoing them without looking at your notes.
• Our free AD chains. Each of our free AD chains is three virtual machines, two Windows clients and a domain controller, that run on your own computer. You start from a domain username and password, the same starting point as the exam. Our guide to free OSCP labs shows how to run them under exam conditions.
• Build your own domain. TJ Null's "Other Labs" section points to self-hosted options such as GOAD and Ludus.

Mix one AD chain into each week of box practice. For the method behind the set, read our OSCP Active Directory guide, and if you were hoping to skip AD, read whether you can pass the OSCP without Active Directory first.

How many OSCP-like machines you need before the exam

There's no official number. OffSec's exam FAQ suggests "at minimum completing the course labs and exploiting the challenge labs", which it says gives you "the bare skills needed to pass the exam". Its preparation article adds that the more challenge labs you complete, the more scenarios you'll have met. A count is a weak signal on its own, because a box done with the writeup open proves far less than one done cold.

Judge readiness from your log instead:

• You get a foothold on most unseen boxes inside OffSec's 2 to 3 hour window, without hints.
• Your privilege escalation runs from a checklist on both Linux and Windows, and the time it takes keeps falling.
• You've finished at least one three-machine AD chain from a single login, blind, inside 4 hours.
• Someone else could follow one of your practice reports step by step.
• The misses in your log are new ones, and the same missed step stops coming back.

When those look good, run a mock exam: three unseen standalone boxes plus one AD chain in a single 24-hour block, then write the report the next day. LainKusanagi's OSCP-LK practice exams come in the same shape. Our post on how hard the OSCP is has a fuller self-check, and our OSCP exam tips cover how to rehearse exam day before it counts.

To test your thinking under pressure, try our 13-question OSCP scenario quiz, then The Brutally Honest OSCP Quiz, which works through an Active Directory scenario.

FAQ

What is the TJ Null OSCP list?

It's a free Google Sheet of practice machines picked for OSCP prep, curated by TJ Null and called the NetSecFocus Trophy Room. Its PEN-200 tab groups well over 100 boxes by platform (Hack The Box, Proving Grounds Practice and Play, Vulnlab) and by Linux, Windows and Active Directory.

Is TJ Null's list still up to date?

Yes. When we checked on November 3, 2026, the PEN-200 tab showed a latest update of July 18, 2026, and it includes newer assumed-breach Active Directory boxes. TJ Null says it doesn't replace the PEN-200 labs or guarantee a pass.

What is the LainKusanagi OSCP list?

It's a newer community Google Sheet of OSCP-like machines that overlaps heavily with TJ Null's list, drops boxes it sees as outside PEN-200 scope, and adds Hack Smarter Labs and Virtual Hacking Labs. It was last updated in October 2026.

Are Proving Grounds machines like the OSCP?

Proving Grounds Practice is OffSec's own platform, and OffSec says it includes retired OSCP+ exam labs, so its machines are a close match in style. As of November 3, 2026, Practice costs $19 a month or $199 a year, and Proving Grounds Play is free with a 3-hour limit.

Do I need Hack The Box VIP+ for OSCP-like machines?

For many of the Hack The Box entries on the lists, yes. The free tier covers 20 active machines, and retired machines need VIP+, which costs $25 a month or $223 a year as of November 3, 2026.

How many OSCP-like machines should I do before the exam?

OffSec doesn't give a number. Judge readiness from your results instead: unseen boxes rooted on a timer without hints, a three-machine AD chain finished blind in 4 hours, and a practice report someone else could follow.

Is it okay to use writeups for OSCP practice machines?

Yes, once you've reached your time box and re-enumerated. Read only up to the step where you stopped, close it, write down why you missed that step, and redo the box later without help.

Start with three boxes and one AD chain

Make a copy of TJ Null's or LainKusanagi's sheet, pick three boxes you've never seen from the Linux and Windows sections, and add one of our free AD chains. Work each one on a timer with the writeup closed, log what you missed, and write one of them up as a short report. If you'd like a ready-made checklist to work each box from, our methodology notes for OSCP prep come in CherryTree and Obsidian formats.

One of our students, Darren, wrote: "The videos and cheatsheets helped me build a solid methodology and improve my troubleshooting skills when things didn't work as expected during the exam. Thanks to this course and the effort I put into practicing the material, I was able to pass the OSCP+ on my first attempt with 70 points." (More reviews)

Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

Questions about your practice plan? Ask in the Hacker Blueprint Discord.

Sources

• TJ Null: NetSecFocus Trophy Room (PEN-200 tab curated by TJ Null, latest update July 18, 2026, sections by platform, "Assumed Breach" tags, Other Labs, the disclaimer and the make-a-copy note; checked Nov 3, 2026)
• TJ Null: OSCP-Stuff on GitHub (home of VulnAD, listed in the sheet's Other Labs section)
• LainKusanagi: OSCP Like list (author's background, overlap with TJ Null's list, filtered scope, added platforms, Hack The Box and TryHackMe notes, OSCP-LK practice exams, update log including the Hacker Blueprint table added Sep 26, 2026; checked Nov 3, 2026)
• 0xdf: OffSec Exam HTB Lists (tracks TJ Null's lists and links a writeup for each Hack The Box box)
• OffSec: OSCP+ Exam Guide ("a small number of vulnerable machines", standalone and AD point split, restricted tools, Metasploit on one target, proof screenshot rules, report replicable by "a technically competent reader")
• OffSec: OSCP+ Exam FAQ (pivoting may be required, minimum preparation of course labs and challenge labs)
• OffSec: OSCP+ Exam with AD Preparation (timers per machine, avoiding hints and walkthroughs, multiple approaches, revisiting hard labs, cyclical enumeration, AD post-exploitation and dependencies, OSCP A, B and C, report practice, skill-domain weights)
• OffSec: PEN-200 (9 challenge labs, three built to closely replicate the exam, Windows and Linux privilege escalation)
• OffSec: Proving Grounds (Practice $19 a month or $199 a year, retired OSCP+ exam labs in Practice, Play free with a 3-hour limit and VulnHub community machines; checked Nov 3, 2026)
• OffSec: Annual Membership ($299 a year, includes Proving Grounds Practice; checked Nov 3, 2026)
• Hack The Box: HTB Labs subscriptions (free tier with 20 active machines, VIP+ $25 a month or $223 a year with all retired machines; checked Nov 3, 2026)
• Hack The Box: Vulnlab joins Hack The Box (Apr 2, 2025: Vulnlab content integrated into the platform)
• VulnHub: FAQ (downloadable VMs for VirtualBox or VMware, run on an isolated network) and VulnHub home page (newest entry July 2022)
• TryHackMe: Pricing (free plan with free rooms only, paid plans)
• Hacker Blueprint: OSCP Practice Lab: Active Directory Attack Path (FULL Walkthrough) (YouTube, Sep 28, 2026; Chain_07 walkthrough)
• Hacker Blueprint: Prove You're OSCP Ready (The Ultimate OSCP Scenario Quiz) (YouTube, Oct 27, 2026)
• Hacker Blueprint: The Brutally Honest OSCP Quiz (YouTube, Feb 24, 2026)