HTB CPTS
HTB Certified Penetration Testing Specialist (HTB CPTS)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The HTB Certified Penetration Testing Specialist (CPTS) is a hands-on practical certification offered by Hack The Box. Rather than testing recall through multiple-choice items, it asks you to compromise a live network of targets and then document what you did in a professional penetration testing report. It suits junior-to-mid-level penetration testers, red teamers, and security engineers who want evidence that they can run an engagement end to end: scoping, reconnaissance, enumeration, exploitation, privilege escalation, lateral movement, and reporting. The exam spans the full attack lifecycle, with the heaviest emphasis on network and service exploitation including Active Directory, web application attacks, and privilege escalation on both Linux and Windows. Preparation is best done by working through Hack The Box Academy's penetration testing job-role path and, more importantly, by practising on retired machines and labs until enumeration and note-taking become habits. Build a repeatable methodology, keep a findings log as you go, and rehearse writing a clear report with reproduction steps, impact, and remediation. Because the assessment is practical and time-boxed, stamina and prioritisation matter as much as individual exploit knowledge. The official Hack The Box site publishes current details on exam format, duration, pricing, and scoring.
What you'll study
About HTB CPTS preparation
What is the exam format?
It is a practical, proctored lab exam. You receive access to a network containing several hosts and must gain the required level of access, then submit a penetration testing report. There are no multiple-choice questions. The official Hack The Box site publishes the current rules, target scope, and submission requirements.
How long is the exam and what does it cost?
Hack The Box sets and updates the exam duration, price, and any included lab time. These figures change, so check the official CPTS page on the Hack The Box website rather than relying on secondhand numbers. Plan your schedule around the currently published duration.
How difficult is it compared with OSCP-style exams?
It is generally considered demanding because the target network is broad and includes Active Directory, web exploitation, and pivoting. You need a working methodology, not just a few memorised exploits. Candidates who have completed many retired machines and the Academy path usually find the pace manageable.
What happens if I fail? Can I retake it?
Retake rules, waiting periods, and any discounted retake options are set by Hack The Box and can change. Check the official certification page or your account dashboard for the current policy before booking. Budget time to review your weak areas between attempts.
In what order should I study the domains?
Start with methodology, reconnaissance, and enumeration, since everything else depends on thorough discovery. Then move to web exploitation and network service attacks, followed by Linux and Windows privilege escalation. Add Active Directory and pivoting once you are comfortable on single hosts, and practise reporting throughout rather than at the end.
How much lab practice is enough?
There is no fixed number, but you should be able to root medium-difficulty machines without hints and explain every step. Practise chaining: initial foothold, credential discovery, privilege escalation, and pivoting to an internal host. Keep notes in a report-style template so documentation becomes automatic.
What are the most common failure modes?
Shallow enumeration, tunnel vision on one host, poor time management, and losing track of credentials and findings. Another frequent problem is a thin report: missing reproduction steps, unclear impact, or no remediation advice. Treat note-taking and report writing as part of the exam, not an afterthought.
Do I need to write a full report?
Yes. The report is a scored deliverable. Include an executive summary, scope and methodology, and per-finding details with evidence, affected hosts, impact, and remediation. Write it as you go; reconstructing a multi-day engagement from memory at the end is error-prone and costs points.
Is the certification affiliated with any other body?
No. CPTS is issued by Hack The Box. This page is independent study material and is not affiliated with, endorsed by, or sponsored by Hack The Box. Always confirm exam details on the official site.