CPTS Exam Prep & Study Resources

The CPTS (Certified Penetration Testing Specialist) exam by Hack The Box is widely considered comparable to or slightly harder than OSCP in terms of technical depth. The 10-day practical exam presents a complete enterprise-like network that must be fully assessed, covering Active Directory exploitation, web application attacks, internal pivoting, and privilege escalation. Unlike OSCP's 24-hour sprint, CPTS gives you 10 days to perform a thorough professional engagement, which rewards methodical candidates but also tests endurance and the quality of your penetration test report.

The CPTS exam gives candidates 10 days to compromise the target network and collect flags demonstrating successful exploitation of various systems. After the 10-day hacking window closes, candidates have an additional two days to write and submit a professional penetration test report. The report is graded for quality, completeness, and professionalism, it must meet a minimum quality threshold to pass. This extended timeline compared to OSCP reflects HTB's emphasis on professional report writing as a core competency alongside technical exploitation skills.

Both CPTS and OSCP are highly respected practical penetration testing certifications, and the better choice depends on your goals. OSCP is older and currently more widely recognized by employers in job postings and recruitment. CPTS is generally considered better value at a lower price point and provides a more structured learning path through HTB Academy. CPTS places heavier emphasis on professional report writing, which closely mirrors real engagement deliverables. Many professionals recommend earning both, using CPTS as preparation for OSCP, or pursuing CPTS as a strong standalone credential.

The CPTS exam is a 10-day practical assessment on an enterprise network. You must enumerate, exploit, and pivot through multiple systems, collecting flags placed throughout the environment that demonstrate successful compromise. After completing exploitation, you have two additional days to write a professional penetration test report that documents your methodology, findings, exploitation steps, and remediation recommendations. The report must meet HTB's professional quality standards, a technically successful compromise paired with a poorly written report is not sufficient to pass.

No formal prerequisites are enforced, but completion of the HTB Academy CPTS path (which consists of 28 structured modules) is strongly recommended by HTB and the community. The learning path covers everything needed for the exam, including reconnaissance techniques, web application attacks, Active Directory enumeration and exploitation, privilege escalation, pivoting, and professional report writing. Candidates with prior CTF experience, Hack The Box machine completions, or professional penetration testing experience will have an easier time, but the Academy path is the primary preparation resource.

Completing the HTB Academy CPTS path takes three to six months depending on your pace and prior experience. Students who are new to penetration testing should expect closer to six months, while those with prior CTF or Hack The Box experience may complete the path in two to three months. Working through additional HTB machines in the recommended difficulty range alongside the Academy modules significantly reinforces the skills needed for the exam. Rushing through the learning path without practicing in the lab environment is a common preparation mistake.

Yes. CPTS is one of the most comprehensive and cost-effective advanced penetration testing certifications currently available. The HTB Academy learning path provides an exceptionally well-structured curriculum, the 10-day exam closely mirrors real-world engagements, and the emphasis on professional report writing adds genuine career value. HTB's credibility in the offensive security community means that CPTS is increasingly recognized by employers. For professionals who want a rigorous practical certification with a lower cost than OSCP and a better-structured study path, CPTS is an excellent choice.

CPTS covers the full lifecycle of a professional penetration test. Topics include external and internal reconnaissance, web application attacks (SQL injection, XSS, file inclusion, authentication bypass), Active Directory enumeration and exploitation (Kerberoasting, AS-REP roasting, ACL abuse, BloodHound-based attack path discovery), Windows and Linux privilege escalation, lateral movement and pivoting through network segments, post-exploitation and persistence techniques, and professional penetration test report writing. The breadth of coverage makes CPTS one of the most comprehensive entry-to-advanced practical certifications available.

CPTS grading is based on two components: the flags collected during the 10-day exploitation window and the quality of the professional penetration test report submitted afterward. Technical flags demonstrate that you successfully compromised the required systems. The report is graded by HTB for completeness, professionalism, technical accuracy, and adherence to real-world penetration test reporting standards. Simply finding vulnerabilities is not enough, you must communicate your findings clearly and professionally. Candidates who submit technically correct exploits but fail to produce a quality report can still fail the exam.

Completing the HTB Academy CPTS path is not technically mandatory to sit the exam, but it is very strongly recommended by both HTB and the community. The 28-module path is specifically designed to cover all topics tested in the exam, and HTB provides the path as the primary, and intended, study resource. Candidates who attempt the exam without completing the path and without equivalent prior experience consistently report struggling. The path also includes access to the Academy labs, which provide hands-on practice directly aligned with exam scenarios.