I Survived the HTB CPTS Exam
I Passed the HTB CPTS Exam: Here's My Honest Story
I passed.
Three words I kept replaying in my head the moment the results came through. Not because I doubted my skills, but because the CPTS exam is the kind of experience that makes you question everything you thought you knew about yourself, not just penetration testing.
What Is the CPTS, Really?
The HTB Certified Penetration Testing Specialist (CPTS) is Hack The Box's professional-level certification. It's not a multiple-choice exam. It's not a lab where you exploit one machine and move on.
You get a full simulated enterprise environment with multiple machines, multiple domains, layered defenses and you have to act exactly like a real penetration tester would. Find vulnerabilities, exploit them, pivot through the network, escalate privileges, and then, and this is the part people often underestimate, write a full commercial-grade penetration test report documenting everything you did and everything you found.
Fourteen flags total. A professional report. A timer counting down the whole time.
Simple to describe. Absolutely brutal to live through.
How It Started: Confident, Then Humbled
I went in prepared. Months of studying the full HTB Academy CPTS path, writing detailed methodology notes, building tools, practicing attack chains until they became second nature. I had a system.
The first few flags went okay. Not easy, nothing on this exam is easy, but okay. I was moving, I was thinking, I was making progress. The environment was complex but navigable. I felt like the preparation was paying off.
And then the exam reminded me, in the most humbling way possible, that feeling prepared and being prepared for every scenario are two different things.
Flag 8: The One That Almost Broke Me
I'm not going to pretend I handled Flag 8 gracefully. It stopped me dead in my tracks.
I won't share specifics for obvious reasons, but I will tell you this: it was one of those situations where you know you're on the right path conceptually, and yet nothing is working the way it should. You try one angle, nothing. You try another approach and still nothing. You go back, re-enumerate from scratch, look for something you missed, still nothing.
Hours passed. I kept a notepad next to me with every theory I was testing. Some entries had three or four question marks next to them. A few had the word "WHY" written in capital letters, which tells you everything you need to know about my mental state at that point.
I slept on it. Came back with fresh eyes. Tried again. Made tiny incremental progress that then hit another wall. This cycle repeated itself more times than I'd like to admit.
In the end, Flag 8 remained uncaptured. I moved forward.
Knowing when to move on and not let one flag consume the entire exam was itself one of the hardest judgment calls I made.
The Endurance Factor
People talk about the CPTS as a technical challenge. And yes, it is. But nobody tells you how much of it is also a mental endurance challenge.
The exam runs for ten days. Ten days sounds like a lot, until you're actually in it. Because it's not ten relaxed days. It's ten days of constantly switching between active attack mode, documentation mode, and "I need to sleep but there's still this one thing I want to try" mode.
Around day five and six, I hit a wall that had nothing to do with the exam itself. I was tired. Not physically tired. The kind of tired where your brain starts producing lazy theories and circular thinking. You revisit the same paths. You start second-guessing enumeration you already did. You lose sharpness.
I had to force myself to step away from the screen. Not because I wanted to, it felt like wasted time, but because I recognized that tired decisions in a penetration test lead to missed findings and rabbit holes. Every single time I came back after a real break, after sleeping, eating properly, going for a short walk, I saw the environment more clearly than when I left it.
Patience isn't a soft skill in this exam. It's a technical requirement. The ability to stay calm when you're stuck, to resist the urge to brute-force your way through a problem, to trust that the answer exists and that a clearer head will find it. That's the actual skill being tested underneath all the tooling and technique.
The Tools That Got Me Through
I'm a Python person at heart, so my toolkit leaned into scripting and automation where it made sense, alongside the standard industry tools. Here's an honest picture of what I reached for most:
Enumeration & Recon
nmap: always the first thing, alwaysnetexec(formerly CrackMapExec): indispensable for Active Directory enumeration and lateral movement validationBloodHound+SharpHound: for mapping AD attack paths visually; this saved me hours of manual analysisffuf/feroxbuster: web directory and file brute-forcing
Exploitation & Post-Exploitation
impacket: a whole toolkit in itself;psexec.py,secretsdump.py,GetUserSPNs.pyand the rest of the familyevil-winrm: Windows remote management, clean and reliableligolo-ng: tunneling and pivoting through segmented networks; genuinely one of the best tools I touched during this examMetasploit: used selectively, where it made the most sense
Password Attacks
hashcat: offline cracking on the GPUjohn: for specific hash types and quick checks
Notes & Documentation
Obsidian: my notes lived here throughout the exam, organized by machine and attack chain, always one tab openflameshot: screenshot tool, fired constantly
The Report: 141 Pages of Proof
If there's one thing that surprises people when I describe the CPTS, it's the report requirement.
This is not a "write a paragraph per machine" kind of report. The CPTS expects a commercial-grade penetration test report, the kind you would actually hand to a paying client. Executive summary written for non-technical management. Detailed attack narrative. Every finding documented with severity ratings, full evidence, business impact analysis, and professional remediation recommendations that are actually actionable, not just "patch this" but how and why.
My report ended up at 141 pages.
Writing it wasn't just a documentation exercise. It was also a verification process. Forcing yourself to explain an attack chain in clear, professional language tells you very quickly whether you actually understand what happened or whether you were just following steps on autopilot. There were moments mid-report where I had to go back into the environment and re-test something, because I realized I couldn't fully explain why it worked the way it did.
That discomfort is the right feeling, by the way. That's how you know the report is making you better, not just keeping you busy.
Around three solid days of writing and editing, stacked on top of the active exploitation time. Every finding cross-referenced with screenshots. Every recommendation tied back to a real-world consequence. 141 pages of proof that I was actually there, actually did the work, and actually understood it.
The Final Score
13 out of 14 flags. 90 out of 100 points.
Honestly? I'm proud of that number. Not because it's perfect. It isn't, and Flag 8 sits there permanently as evidence of that, but because it reflects exactly who I am as a penetration tester right now. Technically capable, methodical, persistent, professional in my output. And still with room to grow.
Flag 8 will stay with me as a reminder that there's always another technique to learn, another layer to understand. I'll run into that specific scenario again somewhere out in the wild, understand it more deeply, and the next time it won't stop me.
That's not failure. That's the job.
Was It Worth It?
Absolutely. Without any hesitation.
The CPTS didn't just give me a certification. It gave me a real test of my actual capabilities under real pressure with no hints, no walkthroughs, and no safety net. It confirmed some things I hoped were true about myself and exposed a gap I now know exactly how to fill. That's what a good exam should do.
If you're thinking about taking it, here's what I'd tell you honestly:
- Study the full HTB Academy CPTS path seriously. Not skim it , study it. The exam is designed around that curriculum.
- Practice writing reports during your preparation, not just at the end. Your report writing speed and quality matter.
- Learn
ligolo-ngandBloodHounddeeply. These two tools came up more than almost anything else. - Get comfortable with Active Directory attack chains. That's where the real depth of this exam lives.
- Develop patience as deliberately as you develop technical skills. You will get stuck. The exam is designed to stick you.
And when you hit your own Flag 8 moment, and you will. Don't spiral. Step away. Eat something. Sleep. Come back with a cleaner head and different eyes.
The exam doesn't care how fast you are. It cares whether you can find the answer.
Comments (0)
No comments yet. Start the conversation.