HTB CPTS study guide
HTB CPTS · Work through your exam, one topic at a time.
The HTB Certified Penetration Testing Specialist (CPTS) is a hands-on practical certification offered by Hack The Box. Rather than testing recall through multiple-choice items, it asks you to compromise a live network of targets and then document what you did in a professional penetration testing report. The HTB CPTS study guide has 9 sections and about 2,939 words.
01Penetration Testing Process and Methodologies
This domain tests whether you can run an engagement as a repeatable process rather than a pile of exploits. CPTS expects a clear lifecycle: pre-engagement and scoping, information gathering, vulnerability assessment, exploitation, post-exploitation, and reporting.
341 words, about 2 min02Reconnaissance, Enumeration, and OSINT
This domain tests passive and active information gathering and the discipline to turn raw data into targets. CPTS expects you to use OSINT for domains, people, infrastructure, and leaked secrets, then enumerate services without blind brute force.
332 words, about 2 min03Network and Service Exploitation (including Active Directory)
This domain tests exploitation of exposed network services and Active Directory attack paths. CPTS emphasizes service enumeration, credential reuse, and AD misconfigurations rather than single-shot CVEs.
350 words, about 2 min04Web Application Enumeration and Exploitation
This domain tests web recon, authentication logic, and common injection and file flaws. CPTS expects you to map an application before attacking it and to prove exploitability with minimal damage.
329 words, about 2 min05Privilege Escalation (Linux and Windows)
This domain tests local enumeration and reliable escalation on both platforms. CPTS values manual checks and a clear chain from low-privileged shell to administrative control.
331 words, about 2 min06Lateral Movement and Pivoting
This domain tests moving from a foothold into other network segments without losing access or corrupting evidence. CPTS expects clean tunnels, correct routing, and protocol-aware movement.
322 words, about 2 min07Password Attacks and Credential Access
This domain tests credential discovery, capture, and cracking while respecting lockout and noise constraints. CPTS expects you to distinguish online guessing from offline cracking and to choose the right hash mode.
319 words, about 2 min08Reporting and Communication of Findings
This domain tests whether you can turn technical work into a decision-ready report. CPTS expects a reproducible narrative, risk-ranked findings, and evidence that another tester could follow.
304 words, about 2 min09Post-Exploitation and Data Exfiltration
This domain tests what you do after initial access: consolidate control, collect evidence, and move data without breaking scope or availability. CPTS expects controlled, documented actions.
311 words, about 2 min