🎯 HTB Certified Penetration Testing Specialist (CPTS) Exam Checklist
Exam-specific tips, common scenarios, and time management strategies.
Last Updated: 2026-03-27
Exam Overview
- Format: Practical, hands-on penetration test of a simulated corporate network
- Duration: 10 days for testing + 10 days for report writing (verify current format)
- Objectives: Compromise machines, collect flags, write a professional report
- Key Areas: External/internal enumeration, web attacks, AD attack paths, privilege escalation, pivoting, lateral movement, reporting
Time Management Strategy
| Day |
Focus |
| 1 |
Full enumeration of all accessible hosts. Map the network. Identify all services. |
| 2-3 |
Web application attacks, initial foothold |
| 4-5 |
Post-exploitation, privilege escalation, credential harvesting |
| 6-7 |
Active Directory attacks, lateral movement |
| 8-9 |
Pivoting to internal networks, repeat methodology on new subnets |
| 10 |
Flag collection verification, cleanup, start report notes |
| 11-20 |
Report writing |
⚠️ CPTS Exam Tip: Don’t rush exploitation. Spend the first day ONLY on enumeration. The better your enumeration, the faster your exploitation.
Common Exam Scenarios & What to Look For
External Perimeter
Initial Foothold to Domain User
Domain Escalation
Lateral Movement
Privilege Escalation
Things Commonly Missed
⚠️ CPTS Exam Tip: These are frequently overlooked and can cost you flags:
- UDP ports — Always run a UDP scan. SNMP, TFTP, and DNS over UDP are common finds.
- SMB shares as guest/anonymous — Try null sessions on EVERY host.
- Password in description fields — Always check AD user descriptions.
- Username as password — Test
username:username for all discovered users.
- Multiple web apps on different ports — Don’t stop at 80/443. Scan 8080, 8443, 8000, 8888, etc.
- Revisiting hosts after new credentials — Every new credential = full re-enumeration.
- Internal web applications — After pivoting, scan for web services on internal subnets.
- PDF files on web servers — May contain metadata with usernames.
- Git repositories — Check
/.git/ on every web server.
- Config files —
.bak, .old, .conf, .config, .ini, .env
- DNS zone transfers —
dig axfr domain.com @<DNS_IP>
- Second network interfaces — Check
ip a / ipconfig /all on every compromised host.
Key Commands Quick Reference
```bash
Quick full-scope enumeration
nmap -p- -v –min-rate 4000 -sV
nmap -sUV --reason -F --version-intensity 0 --min-rate 5000
SMB null session check
nxc smb -u "" -p "" --shares
nxc smb -u "guest" -p "" --shares
Username = password check
nxc smb -u users.txt -p users.txt --no-bruteforce
ASREPRoast without creds
impacket-GetNPUsers domain.com/ -usersfile users.txt -dc-ip -request
Kerberoast with creds
nxc ldap -u 'user' -p 'pass' --kerberoast spns.txt
Quick web enum
feroxbuster -u http:// -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt,bak -t 100
BloodHound collection
SharpHound.exe -c All –zipfilename bh.zip
Report Writing Tips
Exam Day Reminders