HTB CPTS case studies
HTB CPTS · Put your knowledge to work in context.
The HTB Certified Penetration Testing Specialist (CPTS) is a hands-on practical certification offered by Hack The Box. Rather than testing recall through multiple-choice items, it asks you to compromise a live network of targets and then document what you did in a professional penetration testing report. The HTB CPTS case studies are 5 cases and about 2,894 words.
1Scope Boundary at the Second NIC
During a five-day internal penetration test for Northwind Logistics, the rules of engagement (RoE) authorize 10.10.10.0/24 only, 08:00–18:00 UTC, with an explicit no-pivoting clause: 'Do not access systems outside the listed ranges without prior written approval.' On day two you compromise WS-042 and find a second NIC with a route to 172.16.5.0/24. An ARP scan shows 40 live hosts, including PROD-SQL01 and a domain controller for a second forest.
571 words, about 3 min2Leaked Credentials and the Lockout Budget
Blackmere Health hires you for a two-week external assessment. The RoE permits passive OSINT and limited authentication testing against vpn.blackmere-health.com, with a lockout threshold of five failed attempts per 30 minutes per account, and explicitly forbids password spraying.
582 words, about 3 min3Kerberoasting Versus a Fragile Legacy Server
You have a foothold as low-privileged CORP .smith on a workstation in the CORP.LOCAL domain. BloodHound shows a path to Domain Admin through svc backup, a Kerberoastable account with SPN MSSQLSvc/sql01.corp.local.
585 words, about 3 min4Proving SQLi on a Shared Tenant Database
A public-facing ASP.NET storefront at shop.contoso.com sits behind Cloudflare and a WAF. You find a time-based blind SQL injection in the sort parameter of /api/products?sort=name.
579 words, about 3 min5Pivoting Through a Filtered DMZ Host
You have compromised WEB01 (10.10.10.50), a Linux DMZ web server, using a stolen SSH key for www-data; the account has /bin/bash. WEB01 has two NICs: 10.10.10.50/24 and 172.16.20.10/24.
577 words, about 3 min