4 posts tagged with "Certification"

As a Cyber Defender, I'm slowest to recognise the attacks I've never run myself. That's why I sat the CBBH back in 2024, now called the Certified Web Exploitation Specialist (CWES). The goal then was to find and close any fundamental gaps in my offensive web application skills. CPTS was the next step, expanding well beyond web vulnerabilities into Windows and Linux attacks, service exploitation, Active Directory, and pivoting through a network.

I'm not typically asked to run penetration tests, though I don't think I can be a good responder without understanding how the attacks actually work. Attack techniques mean something different once you've run them yourself. For example, if you see a Kerberoasting alert, you can be (almost) certain the attacker already holds valid domain credentials. You also know the ticket is likely going to be attempted to be cracked offline, so you have some idea of what may likely happen next.

What is CPTS?​

The Certified Penetration Testing Specialist (CPTS) is HTB's mid tier penetration testing certification, and it's the logical step up from the CWES. Where CWES is scoped tightly to web application attacks, CPTS is a full penetration testing course covering everything from initial enumeration through to initial access, privilege escalation, pivoting, pilliaging, and Active Directory domain/trust compromises.

The Course​

To be eligible to sit the CPTS exam, you must first complete the Penetration Tester pathway.

It's a medium difficulty course, with 28 modules, 321 interactive sections, and 23 assessments in the course alone. HTB estimates around 44 days of full time study, which is optimistic unless CPTS is the only thing in your life for a couple months. Realistically, if you're not already a pentester, want to absorb the depth of the content, build a solid methodology, and still have a job and a life in between, 6 months is a fairer expectation.

There is a lot of content, but that's exactly why I chose it. It's written extremely well, and there's almost always a VM to spin up so you can experiment with the technique you've just learnt. To sit the exam it's important that you understand the content, take notes for a methodology as you go, and resist the urge to rush it.

The course is fairly gentle to start with. Web attacks, common service exploitation and password attacks all build naturally on CWES. It steps up as you continue, especially once you reach Active Directory.

Tunnelling and pivoting is the other section that trips a lot of people up. Once you're comfortable single hopping through one compromised host it feels simple enough, but the course also expects you to chain multiple pivots together, tunnelling through a second (or third) compromised host to reach deeper network segments you otherwise have no route to. It sounds simple, but debugging a broken route three hops deep when you don't know whether the issue is your tunnel, a firewall, or the target service itself is a very different skill to just running a tool against a box when told to in the modules.

The Exam​

After completing the Penetration Tester path you're able to start the CPTS exam. You're given a letter of engagement outlining the scope, rules of engagement, and objectives, then you have 10 days to complete it (including report writing time).

The exam simulates a full external to internal penetration test against a fictional company. You start unauthenticated from the internet with only a handful of network ranges provided, and no other information about internal host addresses, operating systems, or applications in scope. From there you're expected to enumerate, gain a foothold, escalate privileges, pivot into the internal networks, and keep compromising hosts until you've either exhausted the environment or hit the points threshold required to pass.

To pass you need to reach a minimum number of points by submitting flags found throughout the environment, and separately submit a commercial grade report covering every vulnerability identified, evidence of exploitation, and remediation advice. HTB is explicit that completing the technical work is not enough on its own, so technically, finding all the flags with a weak report can still fail you.

My Exam Experience​

I started the exam on a Friday morning, with ~7 of the 10 days free to work on it. Most of those days were 15+ hours long, and I needed them to pass on my first attempt. Though if you understand the content properly, it's a fair exam. You'll need to enumerate a lot, but the methods you use are not complicated on their own.

The first day was almost entirely mapping the external attack surface. There was a lot exposed, so I felt like I was making progress, but I finished day one with zero flags. That's not a great feeling. Though by the second day I began picking up pace, especially once I'd broken into the internal network. Some flags took 20 minutes, others took over a day. The methods towards the flags themselves were rarely the hard part but rather the enumeration to find which method to use next.

My 10 Course & Exam Tips:​

If you're about to start the course or the exam, here's my top 10 tips:

1. Slow down during the course. Don't just run the command in the exercise and move to the next module. Take the time to understand why the attack works and what conditions need to be true for it to work at all. That understanding is what pushes you through the exam. Yes, it will make the course take longer. It's worth it.
2. Build a methodology as you go and actually use it. The exam draws directly on what's taught in the course, so when you land on a Windows box you should already have a checklist of what to try next. Same for Linux, AD, etc. Don't get to the exam and start running random tools.
3. Don't expect the first flag right away I didn't get mine on day one, and if the same happens to you, don't panic. I still passed on my first attempt. Once you have a foothold, several of the later flags come easier than the first one did. There's a lot to enumerate before you get to flag one!
4. Go wide before you go deep. More than once I burned hours trying to force one exploit to work, only to realise there was an entire host or service I hadn't discovered yet offering a far simpler path forward. Enumerate broadly before committing to a rabbit hole.
5. Take breaks, even when stopping feels unproductive. I said the same thing in my CBBH review and it's just as true here. There were multiple points where I'd been stuck for hours, walked away for five minutes to clear my head, and solved it within five minutes of sitting back down. It's advice I wish I'd followed more often during this exam.
6. Learn Ligolo. This was advice I was given before starting the exam and it made pivoting enormously easier. Pivoting comes up constantly once you're in the internal network, and fumbling with tunnel setup mid exam costs you time. Get comfortable with single hop tunnels first, then practise chaining a second hop through an already compromised host, so that when the exam calls for it you're troubleshooting the target rather than the tool.
7. Use HTB Academy's search feature. If you land on a service, a privileged group, or an AD feature you don't fully remember, search for it directly rather than trying to recall which module covered it. It'll pull you straight to the relevant section.
8. Think simple. This does not mean the exam is easy. Every time you land a flag, stop and ask what you actually just unlocked, whether that's a new account, a new host, or access to a service you couldn't reach before. The exam is mostly linear, and more often than not the thing you just gained is exactly what gets you to the next flag. Go back to your methodology and the relevant modules rather than assuming the path forward has to be complicated. Once I knew what to look for, most paths felt obvious in hindsight.
9. Use SysReptor. Rather than fighting with a Word document to produce your final report, check out SysReptor. It gives you a pre built, HTB aligned report template that you fill in as findings, complete with severity scoring, a proper findings structure, and consistent formatting, then renders straight to a PDF that is ready to submit. You can either self host SysReptor or use their free cloud version, and either way it saves a good amount of time compared to manually formatting headings, tables, and a table of contents by hand while you're already exhausted from the exam itself. My report came out at over 100 pages, so I'm glad I didn't have to fight MS word through it.
10. Write the finding the moment you get the flag. By the end of the exam there was no chance I could have thought back and written those findings to the quality I managed in the moment. Report writing can be painful, though doing it immediately after a flag makes it feel more like a celebration than a chore, especially while you're still riding the high of getting it.

Would I recommend it?​

The Course - Absolutely! For the price there's very little to compare with the quality and depth of the content, and almost every technique is paired with a VM you can spin up to experiment with what you've just learnt. It's long, but it isn't padded. There's just a lot of great content in it.

The Exam - Absolutely, if you're doing it for the right reason. The course teaches you the techniques, the exam then lets you chain it all together and test your methodology. (The AEN module does bring it together as well, but not as far as the exam).

CPTS still trails OSCP on name recognition, thought it's getting there. In the meantime, plenty of practitioners know exactly what CPTS is and what passing it involves, and for those people it holds real weight even when the HR filter has never heard of it.

It's a strong buy if you're a defender who wants real attacker knowledge rather than just a badge after completing a theory exam. It may not be the right buy if you need a certification HR will recognise on a CV screen and you care less about the skills underneath it. Be honest with yourself about which of those you're actually after.

Closing Thoughts​

As a Cyber Defeneer I'm not usually asked to perform a penetration test. But I don't think I can be a good responder without understanding how the attack actually works, and the course and exam bridged gaps for me. Attacks mean something different once you've run the attack yourself.

Originally I planned to do OSCP, but CPTS was cheaper, I'd heard the content was better written, and since I wasn't applying for offensive roles it felt better suited. OSCP is still on my list. For now I'm glad I chose CPTS, glad it's done, though already looking forward to the next one.

In March 2026, I completed the in-person 6-day SANS SEC504 (Hacker Tools, Techniques, and Incident Handling) training course. After almost 2 months of study I then passed the GIAC Certified Incident Handler (GCIH) exam with a score of 98%. This article serves as a review of my experience (and tips during) the SEC504 training course / GIAC GCIH Certification.

The Course - SEC504:​

SEC504 is SANS' self-described "flagship incident handling course", designed to provide the essential skills required to detect, respond to, and neutralise threats across Windows, Linux, and Cloud platforms (Source: SANS). What sets it apart from a purely defensive course is its two-sided approach. Rather than studying offensive techniques and defensive response in isolation with two different courses, each concept is taught together. The course teaches how to execute a technique as an attacker, and then immediately how to detect, respond and prevent it. This builds a much deeper understanding than either perspective could offer alone.

The course runs over 6 days, with each day dedicated to a new section and its accompanying course book. Day 1 sets the foundation everything else builds on, covering the incident response process and methodology, as well as live, network and malware analysis (Source: SANS, SEC504 Syllabus). Days 2-5 then went through attacks from an offensive perspective, paired with the defensive counterparts a responder needs to know. Day 6 is a Capture the Flag exercise that brings everything together, giving you the chance to apply the weeks techniques in a simulated environment. It's a satisfying way to close out the week and a good check on how well the content has actually landed.

The final day CTF competition involved splitting into teams, and thanks to working alongside some incredibly talented people, our team took out first place with each of us earning the SEC504 SANS Offensive Operations Challenge Coin!

I found the course to be more updated than I had expected walking into it, covering concepts such as bypassing M365 authentication defenses, bypassing AI guardrails and integrating attacks with AI using Model Context Protocol (MCP) (Source: SANS, SEC504 Syllabus).

The Exam - GIAC GCIH:​

The GIAC GCIH exam is a proctored 4 hour exam consisting of 106 questions (Source: GIAC). An undisclosed number of questions in the exam are referred to as "CyberLive" questions in which a virtual machine is spun up for performance (practical) based challenges (Source: GIAC). In my experience, the CyberLive VMs where ready to go in seconds and with almost no input delay, which was a relief as I wasn't wasting exam time waiting for machines and their services to boot up.

It's also important to note that GIAC exams are open book. All printed books, notes, and study guides are allowed (no digital items) (Source: GIAC).

I passed on my first attempt with a score of 98% - which also got me an invite to the GIAC Advisory Board, and my honest take is that the exam is very manageable if you've put the work in. Below are my tips:

1. During the 6-day course, try to suck in as much information as possible. If you've fallen behind on a practical lab and the class is moving on, leave it. You can complete the labs later. Listen to the content.
2. After the course, take about a week break to refresh your mind.
3. Re-read the course books and re-complete the labs (I spent about 1 day a week on average per book). As you're going through the content, write your index and command notes (see below).
4. Do a practice test (under exam conditions)! On my practice test I scored 99%, only a 1% difference to what I got on my real exam.
5. Depending on your score you'll now either know if you're ready, or if not, which areas to focus on.
6. I gifted away my second practice exam voucher, but doing the second practice would be a great chance to reassess yourself if there were areas that needed more focus.
7. Sit the real exam! (You've made your index, notes, and done 2 practice exams. There shouldn't be any big surprises!)

An important part of the studying process is creating your index. An index is a guide that allows you to match key terms or concepts to the page(s) that those are referred to in the books. I've heard that some people like to alphabetically sort all the terms, however I preferred to keep them all in the order they were presented through the material. My index format looked something like below:

I also created a reference guide of tools/commands. The format of these notes looked something like the below:

Overall​

SEC504 and the GCIH certification are (in my opinion) genuinely excellent. The course is well-structured, consistently updated, and the dual offensive/defensive teaching approach makes it one of the most effective ways to build real incident handling skills quickly. The CTF on day 6 is a great way to close out the week, and the exam (if you've put the work in) is very achievable.

That said, I'd be doing you a disservice if I didn't mention the cost. SANS courses are expensive, and SEC504 is no exception. If your employer is sponsoring you, it's a no-brainer (and can have a strong ROI for a large business). If you're a self-funding student though, it's worth being honest with yourself. There are cheaper paths. Platforms like HTB cover a lot of ground (not all), though you'll likely get there a lot slower, with a lot more headaches, and a lot less guidance but you will get there. The benefit of SANS then, is the structure and speed in which you can develop your skills, which is on another level. Their promise of "Everyone who completes SANS training can apply the skills and knowledge they’ve learned the day they return to work." (Source: SANS) holds true in my experience and I'm looking forward to being able to complete another SANS course in the future to further develop my skills.

In August 2025, Hack The Box (HTB) announced that their Bug Bounty Hunter certification would be overhauled and rebranded as the Certified Web Exploitation Specialist (HTB CWES). While the core curriculum does not appear to have significant changes (beyond 4 modules being added/updated), the rebrand aims to better reflect real-world job roles and the broader scope of modern web application security testing.

Summary CBBH Review:​

In my CBBH review from last year, I stated that I would absolutely recommend the course material to anyone wanting to learn web penetration testing. The labs were realistic, platform polished and the coverage of vulnerabilities was both broad and practical. However, I struggled to recommend purchasing the exam and obtaining the full certification. This was due to 2 main concerns:

1. Recognition - The certification wasn't as widely recognised as other web application penetration testing certifications.
2. Branding - The name “Bug Bounty” felt limiting, especially for candidates aiming for traditional pentesting or AppSec roles. Despite these concerns I still recommended sitting the exam if you wanted to test your skills in a practical, hands-on assessment.

Has HTB Fixed This?​

HTB mentions that the change is to better align the certification with modern jobs roles, and I believe they did this well. It’s too early to tell how widely HTB CWES will appear on job postings, but the name itself is far more professional and transferable than the previous. I expect this change to have a more positive impact on employers views.

Has My Recommendation Changed?​

The certification has been renamed, but the core content remains largely the same with the addition of four new modules and several incremental updates and refinements. Because of this, my recommendation has not drastically changed but it has slightly improved.

If you’re looking to learn web exploitation through practice, HTB CWES is an excellent option. The rebrand fixes one of my biggest concerns with the original CBBH, and the added content makes the certification feel more complete.

I would confidently recommend:

• The course content to anyone pursuing web pentesting or AppSec.
• The exam and certification to those who value testing their skills practically (and don't mind the cost + lower recognition compared to other certs).

While it may not yet rival the most established web certifications in terms of recognition, HTB CWES is now much better positioned to grow into those roles.

For my full review of CBBH from last year, check out: HTB CBBH Certification (Exam Review).

In early 2022 Hack The Box (HTB) released their first certification - the Certified Bug Bounty Hunter. They claim that "certification holders will possess technical competency in the bug bounty hunting and web application penetration testing domains at an intermediate level".

No - you don't need a certification to be bug bounty hunter, so the certification is essentially for junior web application penetration testers or web developers who want to understand the web penetration testing domains up to an intermediate level.

Since I was already familiar with HTB, I decided to give it a shot and started the pathway a few months ago. At this time, there was little information about the certification online, although it appears to be picking up in popularity recently - so I decided to share my experience with the exam with the hopes that it could answer a question someone may have about the process.

The Course Content:​

HTB estimates that completing the course contents will take around 144 hours. If you're very committed to it, you could complete the content within a month but this will only hurt you when you take the exam if you're rushing through it. I would recommend 2-3 months if you're able to dedicate time to the content, or a little longer if you're planning to just pick away at it or are completely new to web apps.

The course covers the following content:

The course material is completely text based, combined with many practical tasks. I'm a big fan of how they presented the material, but I know text-based content isn't for everyone - so keep that in mind.

The Exam:​

Once you complete the course content and obtain all the flags in the exercise machines, you'll be able to activate an exam voucher.

Once you activate your voucher, a letter of engagement will be provided which will outline the requirements to pass. You will have 7 days to complete the exam.

To pass the exam you must:

1. Obtain enough points (by submitting found flags on the exam lab’s page - the number of points required to pass will be shared only upon starting the exam).
2. Submit a commercial-grade report which includes the identified vulnerabilities and remediation advice (a template is provided once the exam is started). This is evaluated against quality requirements.

You should receive the results within 20 business days. If you fail, that's fine, because the exam voucher includes a free retake.

5 Exam Tips:​

1. The exam is different to the course labs. The exam simulates multiple real-world applications and to obtain a flag, you'll need to think outside the box and chain multiple vulnerabilities together. Going into the exam - I did not expect to be chaining vulnerabilities together, so I had to quickly adapt my mindset and think outside the box in order to obtain them. Once I understood this, I started to obtain them. The exam is therefore not easy, but it is fair.
2. Have an in-depth understanding on how the covered vulnerabilities work, as well as how to manually exploit them. Pointing a readily available tool at the web app and expecting RCE in return likely won't work. You'll need to manually poke the application and understand it's responses in order to discover vulnerabilities. And again, may need to chain multiple vulnerabilities together.
3. Everything you need to pass is covered in the provided material. However, don't expect to just run an exploit tool or copy and paste a payload. Again, you'll need to think outside the box and chain multiple techniques together in order to pass.
4. Enumerate, enumerate, enumerate. And when you gain a foot hold, enumerate even more!
5. Approach the exam methodically (ensure you make a methodology while studying the content!) and take your time. You have 7 days after all (14 if you include the free retake). If you feel stuck, take a break to clear your head and give it another go. It was more then once that I got stuck on a section for hours, only to take a break and solve it within a few minutes of sitting back down.

Would I Recommend it?​

The course - 100%! And especially if you're a student. The $8 USD/month price is incredible value for such a high quality course. If you're not a student, the pricing gets a bit more complicated as they use "cubes" to unlock modules. The entire course costs 1410 cubes. Which can be purchased for about $110 USD (as you gain some cubes along the way while obtaining the flags). There are also monthly/yearly subscriptions available which may benefit you more. Either way, I'd still highly recommend the course for those that want to understand web-app penetration testing. Also keep in mind that by completing the CBBH course, you'll already be almost 1/3 through the HTB CPTS course!

The exam - well, it depends. The certification isn't as recognised as other web-app penetration testing certifications so this makes it more difficult to recommend. The decision of calling it "Bug Bounty" and not "Junior Web-App Penetration Tester" also raises the question of "why have a bug bounty certification?". At the price of $210 USD (about $375 AUD with taxes), I find it hard to recommend for everyone at this stage. But if you're like me and wanted to get it to practice a little, to test your skill level before moving onto other, more advanced certifications - then go for it! I did greatly enjoy the exam after all and am looking forward to trying other HTB certs in the future :)