HTB Certified Penetration Testing Specialist

Preparing the CPTS

A full penetration test on a simulated enterprise network, ending with a professional-grade pentest report.

Offensive · Enterprise pentestIntermediatePenetration Tester path

The exam at a glance

Duration10 daysThe countdown never stops
Prerequisite28 modulesPenetration Tester path completed at 100%
PassingPoints + reportPoints threshold and a professional report
ReportIn EnglishSubmitted once, cannot be changed
Good to knowThe environment simulates a complete enterprise network: web, services, internal segments and Active Directory. The report counts as much as the points.

Rules shared by every exam (attempts, deadlines, AI, Pwnbox): shared rules.

Page updated on 13 November 2026. Exam conditions change: check them on the HTB Help Center before booking.

Review

Study notes, flashcards and quizzes. Mastered cards and your best score are saved in this browser.

Module tracking

The 28 modules of the Penetration Tester path, grouped by theme. Tick them off as you go: progress is saved in this browser.

Foundations and process

  • Penetration Testing Process
  • Getting Started
  • Network Enumeration with Nmap
  • Footprinting
  • Information Gathering - Web Edition
  • Vulnerability Assessment
  • File Transfers
  • Shells & Payloads
  • Using the Metasploit Framework

Passwords, services and internal network

  • Password Attacks
  • Attacking Common Services
  • Pivoting, Tunneling, and Port Forwarding
  • Active Directory Enumeration & Attacks

Web applications

  • Using Web Proxies
  • Attacking Web Applications with Ffuf
  • Login Brute Forcing
  • SQL Injection Fundamentals
  • SQLMap Essentials
  • Cross-Site Scripting (XSS)
  • File Inclusion
  • File Upload Attacks
  • Command Injections
  • Web Attacks
  • Attacking Common Applications

Privilege escalation

  • Linux Privilege Escalation
  • Windows Privilege Escalation

Reporting and wrap-up

  • Documentation & Reporting
  • Attacking Enterprise Networks

What the exam assesses

  • Methodically enumerate an enterprise network: hosts, services, web applications.
  • Identify and exploit vulnerabilities in common services and applications.
  • Manage your access and file transfers in a constrained environment.
  • Reach internal network segments.
  • Compromise an Active Directory domain.
  • Escalate privileges on Linux and Windows.
  • Write a commercial-grade report.

Study plan

An example to adapt to your pace. Always alternate modules and practice.

  1. Wk 1–3Foundations: process, enumeration, footprinting, file transfers, shells.
  2. Wk 4–6Web: proxies, fuzzing, injections, file inclusion, uploads, common applications.
  3. Wk 7–9Internal: passwords, services, pivoting, Active Directory, privilege escalation.
  4. Wk 10–11Medium HTB machines focused on AD and multi-host chains, writing up each time.
  5. Wk 12Attacking Enterprise Networks under real conditions, report template ready.

Exam tips

Specific to the CPTS

  • Enumerate broadly before digging in: every host, every service, every vhost.
  • Keep a network map up to date: hosts, segments, access obtained.
  • After each new access, start enumerating again from that vantage point.
  • “Attacking Enterprise Networks” is the best dress rehearsal.

Valid for every HTB exam

  • Split the time: keep at least a third of it for the report.
  • A screenshot at every key step, timestamped notes.
  • Stuck for two hours? Note the lead and move on.
  • Use the official template or SysReptor's from your practice runs onwards.

Review on this site

Methodology

Writing the report

Open →
 Methodology

Reconnaissance and enumeration

Open →
 Methodology

Web exploitation

Open →
 Methodology

Privilege escalation

Open →
 Methodology

Active Directory attacks

Open →
 Methodology

Pivoting and tunnelling

Open →
 Cheat sheet

Ports and services

Open →
 Cheat sheet

Active Directory

Open →
 Cheat sheet

OWASP Top 10

Open →
 Cheat sheet

Linux essentials

Open →
 Cheat sheet

Reference frameworks

Open →
 Certification

CAPE

Open →
 Certification

CWES

Open →

Ready to book?

  • Penetration Tester path completed at 100%
  • Exam voucher available
  • Personal notes organised and easy to search
  • Report template ready, already used at least once
  • At least one full practice run under real conditions
  • 10 days blocked out in the calendar