CPTS: Not Just a Certification

If you’re reading this, you’re probably either about to start the HTB Certified Penetration Testing Specialist exam, currently stuck somewhere inside it, or just finished and still processing what happened. Either way, welcome. Pull up a chair.

This is not gonna be an article that tells you “just follow the modules and you’ll be fine.” That’s technically true, but practically useless. What I want to share is the article I wish I had read before I started; not a tips list, but an honest and personal account of what this cert actually tests, and why it ended up teaching me more than I expected.

A Bit About Me

I’m an information security undergrad with an eJPT and CEH under my belt when I went into this. Not a complete beginner, but not someone with years of pentesting experience either. I took CPTS because I wanted something that actually tested methodology and skill, not just memorization. Glad to say I got what I wanted. :D

Struggling in Prep Phase

Before taking the exam, I had little to no confidence. My prep was minimal by most standards. After completing the Pentester path, I redid the skill assessments across the path to make sure the fundamentals were solid, and attempted to work through the Attacking Enterprise Networks (AEN) module blind, as a dry run for what the exam environment might look like.

The problem? I struggled with AEN. A lot. For 70% of the lab, I fell back to looking at the AEN module notes to guide myself through the exploit chain.

AEN is the closest thing HTB gives you to a preview of the exam, and when you’re stuck on it more than you expected, it’s hard not to read that as a sign. I didn’t do any Pro Labs or additional practice boxes. I just pushed through, refined my methodology, and went in anyway.

Looking back, struggling with AEN was probably the best prep I could have had. It forced me to actually develop and follow a methodology rather than try various attacks or tools that pop up in my head. If you breezed through it, that’s great. If you didn’t, that’s not necessarily a bad sign either.

All in all, be open to learning as you go.

It’s About Knowing How to Find Out.

Not going to lie, the CPTS path is very thorough. HTB covers a massive amount of ground: Active Directory, web exploitation, lateral movement, privilege escalation, pivoting, the works. And yes, like everyone says, everything you need to pass the exam is covered somewhere in the material. If you’ve done the path seriously, you have the foundation.

But here’s the thing nobody says clearly: covered doesn’t mean handed to you.

There are techniques in this exam that the modules introduce but don’t dwell on. They’re mentioned in passing, demonstrated in one lab, and then the module moves on. During the exam, you’ll hit a wall, recognize that the wall looks familiar, and realize you actually need to understand it. Not just recognize it.

One example: the [Unexpire-Password](https://learn.microsoft.com/en-us/windows/win32/adschema/r-unexpire-password) extended right.

Unlike GenericAll or ForceChangePassword, it doesn't show up as a direct attack edge in BloodHound, and either requires manual enumeration(PowerView comes to mind here) or very specific cypher queries in BloodHound, which isn’t extensively taught in the CPTS path either. Even if you thoroughly went through the AD Enumeration and Attacks module, you might still find yourself staring at PowerViewoutput that contains exactly what you need and not recognizing it.

me when bloodhound doesn’t show any outbound edges from the nodes i own

The technique isn’t buried or obscure, the research is one Google search away. Its just that you gotta stop and ask the question.

Stuff I Genuinely Wish Someone Had Told Me

Before taking my exam, I had done my fair share of reading other CPTS articles and scrolling through Reddit, and here’s a summary of the most common tips shared by fellow CPTS enjoyers:

• Learn and useLigolo for pivoting
• Attempt AEN blind
• Use HTB Pro Labs for practice
• Document and screenshot diligently
• Prioritize enumeration and avoid going down rabbit holes by attempting complex exploits

These are all very helpful advice, and honestly these pointers greatly helped me during my exam attempt. However, there are a few personal pain points of mine that I would like to share, that I haven’t seen around much:

Update your tools before you start. Seriously.

I personally encountered an issue with one of my tools where it actually needed to be updated before my attack worked. An outdated version of a tool was the last thing on my mind that i had expected to troubleshoot during the exam.

HTB updated the exam environment in 2025. The machines are newer, the OS versions are newer, and if your Kali is running tools that are twelve months behind, you might spend an hour doubting your own enumeration before realizing your tool version is the problem.

Make sure nxc, impacket, and all relevant tools are current. It takes an hour and it will save you from a specific kind of madness.

BloodHound is a starting point, not an answer.

This one stung me. I came in fairly comfortable with AD attacks and BloodHound felt like a superpower during the modules, as well as AEN. Run SharpHound, ingest the data, look for paths. Clean and satisfying.

The exam humbled me on this fast.

BloodHound shows you what it can enumerate. It doesn’t show you what it missed. AD pentesting is not linear. The same command that gives you clean output on one machine might return nothing on another because of a policy difference, a service that isn’t running, or a permission you don’t have yet.

short snippet of my PowerView cheatsheet

To complement your AD automated enumeration, learn PowerView properly. Not just the three commands that show up in every blog post, but the full enumeration suite: Get-DomainUser, Get-DomainGroupMember, Get-ObjectAcl, Find-InterestingDomainAcl. When BloodHound gives you nothing useful, you need to enumerate manually and trust what you're seeing. But of course, ACLs are just one of many possible ways to laterally move in a network, so try not to be tunnel-visioned.

Use AI, but use it right.

The vulnerability finding and the thinking? That part has to be yours.

Nobody else seems to say this clearly, so: AI is useful during this exam, but only for specific things.

I had my Claude connected to my Obsidian, with an MCP set up such that Claude could read my entire vault containing past machine write-ups, my CPTS notes, my methodologies, and cheatsheets. With all this set up and proper prompt engineering, I thought that Claude had it in the bag.

However, it still led me down rabbit holes.

Not useful: Dumping huge chunks of script and tool outputs. If there’s no clear exploitation path, you’ll just get generic advice, hallucinated misconfigurations, and attack paths that don’t exist in your environment. You’ll waste time chasing them.

Useful: fixing a broken exploit script. Surfacing the correct syntax for a command you half-remember. Understanding an error message you’ve never seen. These tasks don’t require the AI to understand your environment, just to know the tool. That’s where it’s fast and accurate. The thinking has to be yours. The exam is specifically designed to test that.

Flags 1 and 8: The Feared Roadblocks

If you’ve done any research on this exam, you’ve seen these mentioned, either on forums, Reddit, etc. I always wondered, “nah how hard can it be?”, until I went through it myself. I can safely say, they have a reputation, and it’s earned.

What makes them difficult isn’t that the underlying misconfiguration/exploit that is complex. Most of what I needed was not beyond the CPTS path. The difficulty is that the path to them involves multiple steps that requires various enumeration methods and tools that were not covered in great detail in the CPTS learning path. As a result, when you do find the vector, you might not recognize it for what it is.

The trap looks something like this:

You enumerate, find something that looks like it might be worth pursuing, but fail to recognize it immediately and dismiss it. You assume you’re wrong and that you haven’t fully enumerated the system(s), and run the same tools again hoping for a different result.

Don’t do that.

When your enumeration surfaces something unusual, don’t dismiss it just because you can’t immediately name the attack. Stop and research it. Figure out what it is, whether it’s a known misconfiguration, and whether it’s worth spending time on. Trust your tools. Trust your output.

What This Cert Actually Is

CPTS didn’t feel like a test of how well you memorized the modules. I would say that it’s a test of whether you’ve absorbed the mindset: how a penetration tester approaches an environment they’ve never seen before.

That means being comfortable with uncertainty, researching during the exam, knowing when to push on a vector and when to step back and re-enumerate, and having enough manual skill that you’re not dependent on any single tool or excessive automated enumeration (i can’t lie, i’m guilty of this when i first started).

I finished this cert feeling like a better tester than when I started. Not because I learned new techniques during the exam, but because it forced me to actually think. It was frustrating in the specific way that useful things are frustrating.

Prepare your environment, take the modules seriously, and don’t treat this like something you can cram for. Treat it like a real engagement where you happen to be learning at the same time.

That’s what it is. And it is definitely worth it :)