CPTS Preparation — HTB Pentest Specialist | FsKnockouT

The HTB Certified Penetration Testing Specialist (CPTS) is Hack The Box's practical pentest certification, often cited as one of the most technically rigorous entry-to-mid-level offensive-security certs in 2026. The CPTS exam is a 7-day assessment against a realistic internal network with multiple Active Directory environments, requiring you to deliver a complete pentest report at the end. This guide covers the exam format, the HTB Academy prep path, common failure points, a 12-week plan, and how FsKnockouT walkthroughs fit in.

What CPTS is

CPTS is a 7-day practical penetration-testing exam followed by a 2-day report-writing window (9 days total). You receive scope access to a multi-machine internal network with at least one Active Directory environment and your objective is to achieve the stated engagement goals — typically domain admin plus flag captures across the entire scope. The deliverable is a complete, professional pentest report.

The underlying training is the HTB Academy "Penetration Tester" job-role path — approximately 20 modules covering enumeration, web attacks, privilege escalation, Active Directory, Kerberos abuse, and pivoting. The path is estimated at 150+ hours of guided learning.

Who CPTS is for

  • Pentesters who want a recent (2022+) vendor-respected practical cert.
  • Candidates looking for OSCP alternative at a lower price point.
  • HTB platform users already deep in the academy ecosystem.
  • Red-team candidates wanting both offensive AD and modern web skills in one cert.
  • Hiring targets for consulting firms that recognise HTB as training authority.

Exam format and scoring

7 days exam, 2 days report. The environment contains:

  • Multiple target machines across one or more Active Directory environments.
  • Flags positioned to validate your progression through the kill chain.
  • Specific engagement goals (achieve domain admin, exfiltrate specific data, demonstrate specific compromise paths).

Grading is based on both flag collection AND the report. You cannot pass with flags alone — the report must demonstrate understanding, clear methodology, and professional-grade documentation of each finding.

Common failure points

  1. Treating it like OSCP. OSCP is a sprint; CPTS is a marathon over 7 days. Candidates who go all-in on day 1 burn out by day 3 and miss later machines.
  2. Skipping HTB Academy modules. The exam draws directly from the academy path. Candidates who tried to shortcut to the exam without full module completion routinely miss attack chains the modules explicitly teach.
  3. Weak report structure. Flag collection alone does not pass. Report must include executive summary, scope, methodology, findings with CVSS, screenshots, remediation. Spend day 8-9 writing, not day 8-9 looking for flags.
  4. AD gap. If you came from web-pentest background, the AD section will dominate your fail list. Spend extra prep time on AD specifically.
  5. Pivoting rust. Ligolo-ng, chisel, SOCKS proxies, and SSH tunnelling must be instinctive by exam day.

Study timeline (12 weeks)

  • Weeks 1-8: HTB Academy Penetration Tester path, all modules. Complete every lab.
  • Week 9: Dedicated AD module revision + Hack The Box boxes focused on Windows / AD.
  • Week 10: Pivoting and tunneling practice across multi-subnet environments.
  • Week 11: Report template development. Study HTB's example CPTS report provided in the academy.
  • Week 12: Mock exam against a selection of medium-to-hard HTB boxes, including report drafting for each.

Recommended practice

FsKnockouT maintains the CPTS Latest Exam Walkthrough covering current exam-pool patterns including the AD compromise chains that appear most often. Related HTB walkthroughs include CDSA (defensive counterpart), CWES (web), and CBBH (bug-bounty).

Frequently asked questions

How much does CPTS cost?

The exam is included with an annual HTB Academy Silver or Gold subscription (around $490-$1,290/year). Standalone exam vouchers exist but are rare — subscription is the usual path.

How many flags must I capture?

HTB does not publish an exact flag threshold. Passing requires substantial flag capture across the environment AND a strong report. Flag count alone does not guarantee pass.

Can I retake if I fail?

Yes. Retake cost and waiting period depend on your subscription tier.

How does CPTS compare to OSCP?

CPTS is longer (7 days vs 24 hours), deeper in web exploitation, requires more professional report quality, and in 2026 is considered by many to exceed OSCP in realism — but OSCP still has stronger hiring-manager recognition in many markets.

Can I use Metasploit?

Yes. Unlike OSCP, CPTS does not restrict Metasploit usage. You are expected to perform like a real pentester using whatever tools help.

What is the pass rate?

HTB does not publish a public pass rate. Anecdotal evidence suggests first-attempt rates around 50-60%, higher than OSCP's historical 35-45%.

Should I take CPTS before or after OSCP?

If budget allows, OSCP+ first for hiring-manager signal, then CPTS to demonstrate depth. If budget is tight, CPTS alone is increasingly accepted by modern employers.

Ready to prepare?

Pick up the CPTS walkthrough, book @FsKnockouT on Telegram for live exam support, and consider OSCP study guide 2026 or PNPT prep as parallel paths.