HTB CPTS study plan
HTB CPTS · Give each week a clear focus.
8 weeks · About 6 hours per week
Penetration Testing Process and Methodologies & Reconnaissance, Enumeration, and OSINT
Draft a reusable engagement checklist that maps each phase of a penetration test (scoping, recon, enumeration, exploitation, post-exploitation, reporting) to the evidence you must capture at that phase.
Configure a lab with an attacking VM and at least two targets, then document the network topology and snapshot baseline in a runbook you will reuse all eight weeks.
Execute passive reconnaissance on a practice target using certificate transparency logs, DNS enumeration, and search-engine dorking, recording every finding with its source.
Build a findings register template (spreadsheet or markdown table) with columns for host, service, version, evidence path, severity, and remediation, and populate it from week-one recon.
Your checkpoint
A written methodology checklist plus a populated findings register covering one practice target's passive recon, stored in your notes repository.
Reconnaissance, Enumeration, and OSINT & Network and Service Exploitation (including Active Directory)
Perform active enumeration against at least three services (for example SMB, HTTP, and SSH) and record banner, version, and misconfiguration evidence for each.
Practice anonymous and guest access checks on SMB and FTP, documenting exactly which shares or directories were reachable without credentials.
Map an Active Directory lab by enumerating users, groups, trusts, and Kerberos-related settings with at least two different tooling approaches.
Write a short enumeration playbook that lists, per service, the first five commands you run and what output would make you escalate to exploitation.
Your checkpoint
A service enumeration playbook covering five services, each with commands, expected output, and a decision rule for moving to exploitation.
Network and Service Exploitation (including Active Directory)
Exploit at least three distinct network services in the lab and capture proof-of-concept evidence (screenshot, command output, timestamp) for each.
Chain one vulnerability from initial foothold to a second host or higher-privileged context inside the Active Directory lab.
Reproduce one Active Directory attack path end to end (for example credential-based lateral movement or an ACL abuse path) and diagram the path.
Document each exploit with root cause, preconditions, and a concrete remediation recommendation written for a non-technical stakeholder.
Your checkpoint
An exploit log of three network-service compromises plus one Active Directory attack path diagram with remediation notes.
Network and Service Exploitation (including Active Directory) & Web Application Enumeration and Exploitation
Enumerate and exploit at least four web application vulnerability classes in the lab (for example injection, access control flaws, file handling, and server-side request issues).
Build a repeatable web assessment workflow covering content discovery, parameter mapping, authentication testing, and session handling review.
Write proof-of-concept requests for each web finding that another tester could replay from scratch without your notes.
Rate every finding from weeks one to four using a consistent severity method and justify each rating in one sentence.
Your checkpoint
A web assessment report section with four or more findings, replayable proof-of-concept requests, and justified severity ratings.
Privilege Escalation (Linux and Windows)
Escalate privileges on at least two Linux targets and two Windows targets, recording the enumeration command that revealed each weakness.
Compare manual privilege escalation enumeration against automated scripts and note where automation produced false positives or missed context.
Document one privilege escalation path per operating system as a step-by-step reproduction guide.
Identify and record the persistence and cleanup considerations for each escalation you performed.
Your checkpoint
A privilege escalation field guide with four reproduced paths (two Linux, two Windows) including enumeration evidence and cleanup steps.
Lateral Movement and Pivoting & Password Attacks and Credential Access
Set up a pivot through a compromised host and reach a target that is not directly routable from your attacking machine.
Execute at least three credential attack techniques in the lab (for example password spraying, hash-based authentication, and offline cracking) and record detection artifacts for each.
Document the credential material you recovered, where it was stored, and how you protected it during the engagement.
Draw a network map showing every pivot point, tunnel, and reachable subnet discovered so far.
Your checkpoint
A pivoting and credential-access log with a network map, three techniques reproduced, and the detection artifact each technique would generate.
Reporting and Communication of Findings & Post-Exploitation and Data Exfiltration
Perform controlled data exfiltration from one lab host over an approved channel and document volume, method, and evidence handling.
Convert your findings register into a full report with an executive summary, technical findings, and prioritized remediation roadmap.
Write three findings at different severity levels and have them reviewed against a clarity checklist (impact stated in business terms, reproduction steps unambiguous).
Prepare a ten-minute verbal findings briefing and deliver it to a practice audience or record it.
Your checkpoint
A complete mock client report, including executive summary and remediation roadmap, plus a recorded ten-minute findings briefing.
Penetration Testing Process and Methodologies & Network and Service Exploitation (including Active Directory) & Web Application Enumeration and Exploitation & Privilege Escalation (Linux and Windows)
Complete one timed full-scope practice assessment from recon through reporting without consulting your playbooks mid-run.
Review every weak spot the timed run exposed and update the relevant playbook section with the fix.
Re-rate all findings from the eight weeks against a single severity standard and reconcile any inconsistencies.
Write a one-page self-assessment naming your three strongest and three weakest domains with evidence from your deliverables.
Your checkpoint
A timed end-to-end assessment report plus a one-page self-assessment identifying remaining gaps and a remediation plan for each.
Milestones
Week 2: You can enumerate five common services from memory and state, for each, the output that justifies moving to exploitation.
Week 4: You have at least seven documented findings across network, Active Directory, and web, each with replayable evidence and a justified severity rating.
Week 6: You have escalated privileges on two Linux and two Windows hosts and successfully pivoted to a host that was not initially reachable.
Week 8: You completed a timed full-scope assessment and produced a client-ready report with executive summary, technical findings, and prioritized remediation.