I85PREP
⌘ K
HTB CPTS study materials
HTB CPTS study resources

HTB CPTS: Penetration Testing Process and Methodologies

HTB CPTS · Work through your exam, one topic at a time.

All guide sections

Penetration Testing Process and Methodologies

Penetration Testing Process and Methodologies

This domain tests whether you can run an engagement as a repeatable process rather than a pile of exploits. CPTS expects a clear lifecycle: pre-engagement and scoping, information gathering, vulnerability assessment, exploitation, post-exploitation, and reporting. Know where rules of engagement (RoE), scope, timeboxes, and communication fit.

Core rules

  • Convert scope into an explicit target list: IPs, CIDRs, domains, excluded hosts, allowed techniques, and testing windows. Re-check it before every active step.
  • Follow an attack-path mindset: validate access, map privileges, and chain findings. A low-impact misconfiguration that yields domain admin is worth more than a standalone critical CVSS score.
  • Keep an evidence log: timestamp, command, target, output, and interpretation. This becomes the report and protects you if a target behaves unexpectedly.
  • Prefer non-destructive validation. Prove impact with read-only commands or a controlled file, not by dumping or deleting production data.
  • Align terminology with frameworks such as MITRE ATT&CK for tactics and PTES for phases, but do not let a checklist replace target-specific reasoning.

Worked example

Scope is 10.10.10.0/24 with 10.10.10.5 excluded. Passive DNS and certificate transparency reveal app.corp.example. You resolve it to 10.10.10.5, so you stop and document the exclusion. You then scan only in-scope hosts, find 10.10.10.7 running SMB and HTTP, and discover a file-share credential. Before using it, you confirm the account is not a honeypot by checking login success and last-logon; then you enumerate from that host. The reasoning is scope first, evidence second, exploitation third.

Traps

Scanning an excluded host, using an exploit that crashes a service, failing to record the exact command that produced a shell, treating a vulnerability scanner's 'critical' as proven, and skipping cleanup or communication. Also common: no attack narrative, so the report reads as unrelated findings.