Summary#

The CPTS (Certified Penetration Testing Specialist) by Hack The Box left me with a very clear feeling: it’s not a certification designed to reward improvisation. It’s an exam that forces you to work with method, discipline and technical judgment for many hours.

For me, that’s precisely its greatest value. I really felt they weren’t only evaluating whether I could exploit something, but whether I could work like a pentester in an orderly way, connecting findings, prioritizing well and documenting everything thoughtfully.

What is the CPTS?#

The CPTS is an offensive certification focused on realistic pentesting, with a lot of weight on enumeration, exploitation, pivoting, Active Directory and the ability to relate different pieces within a single intrusion.

I don’t see it as an exam for someone who just wants to launch scripts, try tools at random and hope for results. Here it matters much more to understand context, grasp vulnerabilities well, spot relationships between services and not waste time in rabbit holes.

What I liked most#

• The exam forces you to think like a pentester, not just like a CTF player.
• The methodology you bring makes a real difference from the start.
• Active Directory is fun, but also tedious, and precisely because of that the experience feels much more complete and close to real scenarios.
• The certification rewards consistency, perseverance, good enumeration and the ability to connect findings.

What it demands most#

Where I felt the CPTS demand the most was in the need to stay organized throughout the whole process. It’s not enough to find a vulnerability and exploit it fast; several times you have to understand the full flow, the step by step, and why a path works before getting results.

I also found it a very mentally demanding certification. When you’ve already spent a lot of time inside the exam, any organizational mistake multiplies: you repeat tests, forget to validate something basic, or go back to a rabbit hole you should have discarded already.

Preparation and approach#

If someone wants to arrive well prepared to the CPTS, my opinion is that they shouldn’t focus only on memorizing techniques. What matters is building a solid work routine:

• Enumerate consistently.
• Take clean notes as you go.
• Separate useful evidence from noise.
• Review privileges, trust relationships, shares, credentials and internal vectors patiently.

In an exam like this, good preparation isn’t the one that fills you with commands, but the one that gives you a clear mental structure so you don’t get lost when the environment starts to grow. I’d also recommend arriving with your own cheatsheets for the most repeated vulnerabilities and steps, because that helps a lot to keep pace without falling into disorder.

Real difficulty#

My overall sense was this:

• Technical difficulty: Intermediate - Advanced
• Overall exam difficulty: High
• Time management: High

I didn’t find it an impossible certification, but I did find it one that heavily punishes any weakness in methodology. If you fail at enumeration, document poorly or struggle to prioritize, the exam becomes harder than it should be.

My overall experience#

What I value most about the CPTS is that it forced me to be more disciplined and calmer with every step I took. The exam took me a total of 5 days, and in that time I managed to get 12/14 flags.

During the first day I couldn’t get a single flag and I felt completely devastated. I started to question whether everything I had studied was really solid and I even doubted my own knowledge. Only at the start of the second day did I get the first flag, and from there the rest started to fall until number 7 between the second and third day. Now you’ll ask: “why do you say up to 7?” Because, at least for me, from the eighth flag onward the game really begins.

I should stress that, at several points between flag 1 and 7, I had to go step by step reviewing everything I did. As I mentioned earlier, it’s not all about throwing commands wildly: you have to know what you’re running, how you’re doing it and what real information it’s returning, because that itself is what can later help you move forward.

When I reached the afternoon of the third day, I was already ready to attempt flag 8. I knew a lot of people consider it one of the hardest and most tedious of the exam, and honestly I don’t deny it. It took me practically a whole day to get it. I had to try several attack methods, redo scans, repeat enumeration and go over methodologies I’d learned over time. But now, once the exam is complete, my final opinion is that rather than being “hard”, it’s a very tedious flag.

(Me when I got flag 8)

From flag 9 to 11 I had no major problems and, for me, that part was much smoother. But in the end I reached flag number 12, and even though many say it’s one of the easiest to get, for me it was a real pain XD. Personally, it seemed like one of the most trolly flags of the whole exam. If I had to give one piece of advice for this certification, it would be this: “think like a fool”, but obviously without switching your brain off completely.

On the fifth day I managed to get 12/14 flags, thus reaching the minimum points to pass. Honestly, I was more than satisfied. Then I prioritized finishing my report as well as possible, which ended up being a total of 252 pages XD, and then I tried to get the last two flags. But my body was already completely devastated and I couldn’t get them. I only managed to identify the exploits I could use, though I couldn’t quite get them to work.

Finally, I submitted my report when there were still two days left before the exam ended, and the next day they replied that I had successfully certified. That’s how I closed a totally challenging and exhausting exam, but above all one in which I put into practice everything I had learned over a long time.

The best of the CPTS#

• It feels like a serious certification, well oriented toward real offensive work.
• It forces you to develop judgment, not just mechanical execution.
• It has great value for anyone wanting to grow in internal pentesting and Active Directory.

The worst of the CPTS#

• It’s not a friendly exam for someone who doesn’t yet have a mature methodology.
• It can become very draining if you don’t arrive with good organization of notes and evidence.
• If you get mentally stuck on one part, the time cost can be high.

Who would I recommend it to?#

I’d recommend it to:

• People who already have a good pentesting base and want to test themselves in a more serious environment.
• People who have solved good-level HTB machines without depending entirely on a writeup.
• Folks interested in Active Directory, lateral movement and offensive methodology.
• Those looking for a certification that forces you to think and not just run scripts.

I wouldn’t recommend it to:

• People who are just starting out.
• Those who still rely too much on automated tools.
• Folks who aren’t yet fluent at documenting and prioritizing in an orderly way.

Final verdict#

Honestly, the CPTS is a certification that left a before and after for me. I remember when I was still starting in the offensive cybersecurity world around December 2024, watching lots of videos, reviews and above all how to specialize within this field, and the CPTS was never left behind and always gives people something to talk about even now.

For me, the CPTS is one of the most solid certifications if you really want to improve as a pentester from a practical approach. I don’t see it as a simple exam to add a credential, but as an experience that forces you to level up in methodology, discipline and analysis.

If you already have a previous base and are willing to prepare seriously, I think it’s a certification worth it. It demands a lot, but precisely because of that it also gives a lot. In my case, it left me with the feeling of having gone through an exam that really pushes you to work better, think better and operate with more judgment.

(Ariana Caceres looked like this when she read all that)