HTB CPTS Certification (Exam Review)

As a Cyber Defender, I'm slowest to recognise the attacks I've never run myself. That's why I sat the CBBH back in 2024, now called the Certified Web Exploitation Specialist (CWES). The goal then was to find and close any fundamental gaps in my offensive web application skills. CPTS was the next step, expanding well beyond web vulnerabilities into Windows and Linux attacks, service exploitation, Active Directory, and pivoting through a network.

I'm not typically asked to run penetration tests, though I don't think I can be a good responder without understanding how the attacks actually work. Attack techniques mean something different once you've run them yourself. For example, if you see a Kerberoasting alert, you can be (almost) certain the attacker already holds valid domain credentials. You also know the ticket is likely going to be attempted to be cracked offline, so you have some idea of what may likely happen next.

What is CPTS?

The Certified Penetration Testing Specialist (CPTS) is HTB's mid tier penetration testing certification, and it's the logical step up from the CWES. Where CWES is scoped tightly to web application attacks, CPTS is a full penetration testing course covering everything from initial enumeration through to initial access, privilege escalation, pivoting, pilliaging, and Active Directory domain/trust compromises.

The Course

To be eligible to sit the CPTS exam, you must first complete the Penetration Tester pathway.

It's a medium difficulty course, with 28 modules, 321 interactive sections, and 23 assessments in the course alone. HTB estimates around 44 days of full time study, which is optimistic unless CPTS is the only thing in your life for a couple months. Realistically, if you're not already a pentester, want to absorb the depth of the content, build a solid methodology, and still have a job and a life in between, 6 months is a fairer expectation.

There is a lot of content, but that's exactly why I chose it. It's written extremely well, and there's almost always a VM to spin up so you can experiment with the technique you've just learnt. To sit the exam it's important that you understand the content, take notes for a methodology as you go, and resist the urge to rush it.

The course is fairly gentle to start with. Web attacks, common service exploitation and password attacks all build naturally on CWES. It steps up as you continue, especially once you reach Active Directory.

Tunnelling and pivoting is the other section that trips a lot of people up. Once you're comfortable single hopping through one compromised host it feels simple enough, but the course also expects you to chain multiple pivots together, tunnelling through a second (or third) compromised host to reach deeper network segments you otherwise have no route to. It sounds simple, but debugging a broken route three hops deep when you don't know whether the issue is your tunnel, a firewall, or the target service itself is a very different skill to just running a tool against a box when told to in the modules.

The Exam

After completing the Penetration Tester path you're able to start the CPTS exam. You're given a letter of engagement outlining the scope, rules of engagement, and objectives, then you have 10 days to complete it (including report writing time).

The exam simulates a full external to internal penetration test against a fictional company. You start unauthenticated from the internet with only a handful of network ranges provided, and no other information about host addresses, operating systems, or applications in scope. From there you're expected to enumerate, gain a foothold, escalate privileges, pivot into the internal networks, and keep compromising hosts until you've either exhausted the environment or hit the points threshold required to pass.

To pass you need to reach a minimum number of points by submitting flags found throughout the environment, and separately submit a commercial grade report covering every vulnerability identified, evidence of exploitation, and remediation advice. HTB is explicit that completing the technical work is not enough on its own, so technically, finding all the flags with a weak report can still fail you.

My Exam Experience

I started the exam on a Friday morning, with ~7 of the 10 days free to work on it. Most of those days were 15+ hours long, and I needed them to pass on my first attempt. Though if you understand the content properly, it's a fair exam. You'll need to enumerate a lot, but the methods you use are not complicated on their own.

The first day was almost entirely mapping the external attack surface. There was a lot exposed, so I felt like I was making progress, but I finished day one with zero flags. That's not a great feeling. Though by the second day I began picking up pace, especially once I'd broken into the internal network. Some flags took 20 minutes, others took over a day. The methods towards the flags themselves were rarely the hard part but rather the enumeration to find which method to use next.

My 10 Course & Exam Tips:

If you're about to start the course or the exam, here's my top 10 tips:

1. Slow down during the course. Don't just run the command in the exercise and move to the next module. Take the time to understand why the attack works and what conditions need to be true for it to work at all. That understanding is what pushes you through the exam. Yes, it will make the course take longer. It's worth it.
2. Build a methodology as you go and actually use it. The exam draws directly on what's taught in the course, so when you land on a Windows box you should already have a checklist of what to try next. Same for Linux, AD, etc. Don't get to exam day and start running random tools.
3. Don't expect the first flag right away I didn't get mine on day one, and if the same happens to you, don't panic. I still passed on my first attempt. Once you have a foothold, several of the later flags come easier than the first one did. There's a lot to enumerate before you get to flag one!
4. Go wide before you go deep. More than once I burned hours trying to force one exploit to work, only to realise there was an entire host or service I hadn't discovered yet offering a far simpler path forward. Enumerate broadly before committing to a rabbit hole.
5. Take breaks, even when stopping feels unproductive. I said the same thing in my CBBH review and it's just as true here. There were multiple points where I'd been stuck for hours, walked away for five minutes to clear my head, and solved it within five minutes of sitting back down. It's advice I wish I'd followed more often during this exam.
6. Learn Ligolo. This was advice I was given before starting the exam and it made pivoting enormously easier. Pivoting comes up constantly once you're in the internal network, and fumbling with tunnel setup mid exam costs you time. Get comfortable with single hop tunnels first, then practise chaining a second hop through an already compromised host, so that when the exam calls for it you're troubleshooting the target rather than the tool.
7. Use HTB Academy's search feature. If you land on a service, a privileged group, or an AD feature you don't fully remember, search for it directly rather than trying to recall which module covered it. It'll pull you straight to the relevant section.
8. Think simple. This does not mean the exam is easy. Every time you land a flag, stop and ask what you actually just unlocked, whether that's a new account, a new host, or access to a service you couldn't reach before. The exam is mostly linear, and more often than not the thing you just gained is exactly what gets you to the next flag. Go back to your methodology and the relevant modules rather than assuming the path forward has to be complicated. Once I knew what to look for, most paths felt obvious in hindsight.
9. Use SysReptor. Rather than fighting with a Word document to produce your final report, check out SysReptor. It gives you a pre built, HTB aligned report template that you fill in as findings, complete with severity scoring, a proper findings structure, and consistent formatting, then renders straight to a PDF that is ready to submit. You can either self host SysReptor or use their free cloud version, and either way it saves a good amount of time compared to manually formatting headings, tables, and a table of contents by hand while you're already exhausted from the exam itself. My report came out at over 100 pages, so I'm glad I didn't have to fight MS word through it.
10. Write the finding the moment you get the flag. By the end of the exam there was no chance I could have thought back and written those findings to the quality I managed in the moment. Report writing can be painful, though doing it immediately after a flag makes it feel more like a celebration than a chore, especially while you're still riding the high of getting it.

Would I recommend it?

The Course - Absolutely! For the price there's very little to compare with the quality and depth of the content, and almost every technique is paired with a VM you can spin up to experiment with what you've just learnt. It's long, but it isn't padded. There's just a lot of great content in it.

The Exam - Absolutely, if you're doing it for the right reason. The course teaches you the techniques, the exam then lets you chain it all together and test your methodology. (The AEN module does bring it together as well, but not as far as the exam).

CPTS still trails OSCP on name recognition, thought it's getting there. In the meantime, plenty of practitioners know exactly what CPTS is and what passing it involves, and for those people it holds real weight even when the HR filter has never heard of it.

It's a strong buy if you're a defender who wants real attacker knowledge rather than just a badge after completing a theory exam. It may not be the right buy if you need a certification HR will recognise on a CV screen and you care less about the skills underneath it. Be honest with yourself about which of those you're actually after.

Closing Thoughts

As a Cyber Defeneer I'm not usually asked to perform a penetration test. But I don't think I can be a good responder without understanding how the attack actually works, and the course and exam bridged gaps for me. Attacks mean something different once you've run the attack yourself.

Originally I planned to do OSCP, but CPTS was cheaper, I'd heard the content was better written, and since I wasn't applying for offensive roles it felt better suited. OSCP is still on my list. For now I'm glad I chose CPTS, glad it's done, though already looking forward to the next one.