The Hack The Box Certified Penetration Testing Specialist (HTB CPTS) is not a theory-heavy exam you can pass by reading summaries and memorizing terms. It tests whether you can work through a realistic penetration testing path, make decisions under pressure, document what matters, and keep moving when one method fails. This guide is for candidates who learn best with a practical plan. If you already use HTB Academy, labs, or home lab exercises and want a focused 30-day roadmap, this article will help you turn scattered practice into a structured routine.
Who should use this study guide
This guide is a good fit for three types of candidates:
-
HTB Academy learners who finished major CPTS-related modules but do not yet feel exam-ready.
-
Hands-on learners who are comfortable with Linux, networking, and basic exploitation, but need a clear review plan.
-
Certification candidates on a deadline who want a 30-day schedule instead of an open-ended study process.
It is less useful for complete beginners. The CPTS expects you to be able to enumerate, pivot, identify misconfigurations, and think like a real tester. If you are still learning what Nmap does or how web requests work, build those basics first. A rushed plan only works if the foundation already exists.
What the exam is really testing
The goal of the CPTS is not just “get flags” or “run tools.” The exam measures whether you can perform a practical penetration test workflow from start to finish. That includes:
-
Scoping your effort and staying organized
-
Enumerating thoroughly instead of guessing
-
Recognizing attack paths across Linux, Windows, Active Directory, web applications, and common services
-
Escalating privileges with method, not luck
-
Documenting evidence clearly enough that someone else could verify what you found
This matters because many candidates fail not from lack of knowledge, but from poor process. They jump into exploitation too early, miss simple findings during enumeration, or lose track of credentials, ports, users, and paths. The CPTS rewards disciplined testing.
Prerequisite knowledge and tools
Before starting a 30-day sprint, make sure you are comfortable with the core skills below. You do not need to be perfect. But you should be able to use each area without stopping every few minutes to relearn basics.
Technical knowledge to have before Day 1:
-
TCP/IP, DNS, HTTP/HTTPS, SMB, LDAP, Kerberos, WinRM, SSH, FTP, RDP
-
Linux command line navigation, file permissions, process review, scheduled tasks, basic Bash usage
-
Windows basics: users, groups, services, shares, registry, scheduled tasks, PowerShell basics
-
Nmap scanning and interpreting results
-
Web enumeration: directories, parameters, forms, cookies, sessions, common vulnerabilities
-
Privilege escalation fundamentals on Linux and Windows
-
Active Directory concepts such as domain users, groups, trusts, shares, SPNs, and common misconfigurations
-
Basic report writing and note-taking during labs
Tools you should already know how to use:
-
Nmap
-
Netcat
-
Curl and wget
-
Gobuster or Feroxbuster
-
Burp Suite
-
CrackMapExec or NetExec-style workflows
-
Evil-WinRM
-
BloodHound basics
-
LinPEAS and WinPEAS for validation, not as a replacement for manual review
-
SSH, SCP, SMB client tools, PowerShell
The reason tool familiarity matters is simple: in the exam, time goes into analysis and decision-making. It should not go into remembering a flag for a scanner you barely use.
HTB-style skills checklist before you begin
Use this checklist as a fast reality check. If many items feel weak, spend a few extra days on those gaps before following the full schedule.
-
Enumeration discipline: I can scan, validate, and prioritize attack surface without rushing.
-
Service analysis: I can identify what matters on web, SMB, LDAP, SSH, and WinRM services.
-
Credential handling: I can test discovered credentials safely across services and keep notes clean.
-
Web testing: I can inspect requests, test parameters, check auth logic, and enumerate content.
-
Linux privilege escalation: I know where to look for sudo rights, SUID files, capabilities, cron jobs, writable paths, and weak services.
-
Windows privilege escalation: I can review services, tasks, token rights, groups, registry issues, and misconfigurations.
-
Active Directory movement: I understand how shares, users, group membership, ACL issues, and Kerberos-related weaknesses can create attack paths.
-
Pivoting mindset: I can think beyond one host and ask what access enables next.
-
Documentation: I capture commands, outputs, credentials, and evidence as I go.
-
Recovery under pressure: When stuck, I return to enumeration instead of randomly trying exploits.
30-day HTB CPTS study plan
This plan assumes you can study about two to four focused hours per day on weekdays and more on weekends. If you have less time, keep the order but extend the schedule. The sequence matters because practical exams reward layered understanding. Strong fundamentals make domain review faster, and targeted review makes practice more useful.
Days 1–7: Foundation reset
The first week is about tightening your workflow. Most candidates know the topics. Fewer can apply them cleanly under time pressure.
-
Day 1: Build your exam note template. Create sections for hosts, ports, credentials, web findings, shells, privesc notes, AD notes, and proof screenshots. This saves time later because the exam can get messy fast.
-
Day 2: Review Nmap strategy. Practice full TCP scans, service version checks, script use, and targeted follow-up scans. Learn when to slow down and validate unusual ports.
-
Day 3: Review Linux privilege escalation manually. Do not just run helper scripts. Practice checking sudo, SUID, writable files, cron jobs, capabilities, PATH abuse, and service configs.
-
Day 4: Review Windows privilege escalation. Focus on local groups, services, scheduled tasks, registry keys, file permissions, and PowerShell host review.
-
Day 5: Review web enumeration. Practice content discovery, parameter discovery, login testing, file upload review, source inspection, session handling, and request replay in Burp.
-
Day 6: Review credential attacks and password hygiene testing. Practice safe credential reuse checks across SSH, SMB, WinRM, web portals, and database interfaces when appropriate.
-
Day 7: Do one mixed lab or target from start to finish in a timed session. Focus on your process, not speed.
Days 8–15: Domain review by attack surface
This week is where you revisit the exam’s likely environments in a structured way.
-
Day 8: Linux-host enumeration and common footholds. Focus on web-to-shell, weak services, credentials in files, and SSH-based access paths.
-
Day 9: Windows-host enumeration and access. Practice SMB share review, WinRM access, local user/group review, and common misconfigurations.
-
Day 10: Active Directory basics under pressure. Enumerate domain users, groups, shares, and relationships. Practice identifying the next best move, not collecting every possible data point.
-
Day 11: Kerberos- and LDAP-related review. Focus on what these services reveal and how to turn information into practical movement or access.
-
Day 12: Web vulnerabilities review. Prioritize issues that commonly lead to footholds or secrets: auth flaws, file upload abuse, command injection, local file inclusion, SSRF-like logic, exposed config, and weak admin panels.
-
Day 13: File transfer, shells, and post-exploitation hygiene. Practice moving tools, upgrading shells, handling TTY issues, and preserving clean notes.
-
Day 14: Pivoting and lateral movement concepts. Even if the exam path is not heavily pivot-based, learning to think in stages helps prevent tunnel vision.
-
Day 15: Do a full practical review lab. Simulate exam behavior: enumerate, exploit, escalate, document.
Days 16–21: Practice questions and scenario drilling
This phase is not about memorizing answers. It is about exposing weak decision-making. You want short feedback loops.
-
Day 16: Work through scenario-based questions on enumeration and service analysis. After each one, explain out loud why the correct next step matters.
-
Day 17: Drill Linux privilege escalation scenarios. For each case, write the clue that should have triggered your next action.
-
Day 18: Drill Windows privilege escalation and credential use scenarios. Focus on pattern recognition without becoming lazy.
-
Day 19: Drill web attack path questions. Train yourself to move from symptom to root cause. Example: a file upload flaw is not “interesting” by itself; it matters because it may allow code execution or data access.
-
Day 20: Drill Active Directory scenarios. Practice deciding what to enumerate first and which credentials or rights are worth testing next.
-
Day 21: Timed mixed practice. Review your misses by category, not by score alone.
Practice with the relevant page only: HTB CPTS Practice Test
Days 22–26: Weak-area repair
This is the most important stage for many candidates. By now, your weak spots should be obvious. Do not keep studying what already feels comfortable.
-
Day 22: Pick your weakest technical area. Rebuild it from the ground up with one module, one lab, and one written summary in your own words.
-
Day 23: Pick your weakest workflow issue. Common examples are poor note-taking, skipped validation, bad time use, or incomplete enumeration.
-
Day 24: Repeat one failed or difficult lab without looking at old notes for the first hour. This tests whether your process really improved.
-
Day 25: Revisit the second-weakest area and create a one-page cheat sheet of cues, commands, and checks.
-
Day 26: Do a mini mock exam with strict timing. Force yourself to document as if someone else will read your report.
Days 27–30: Final revision
The final days are for confidence, structure, and calm execution. This is not the time to cram ten new topics.
-
Day 27: Review your personal notes only. Condense them further. Remove noise. Keep what helps action.
-
Day 28: Run one clean host compromise from scratch with full documentation.
-
Day 29: Review privilege escalation and credential flow. Ask yourself: once I get one shell, what are my next five checks?
-
Day 30: Light review only. Sleep well. Set up your environment, tools, templates, and backup notes.
How to review explanations without memorizing answers
This is a common problem with practice material. Candidates read an answer, feel they understand it, and then fail on a slightly different scenario. The fix is to review for reasoning, not recall.
Use this method:
-
Ask what clue mattered most. Example: if the right move was checking SMB shares, what evidence pointed there? Open ports? Domain context? Error messages?
-
Write the decision rule. Example: “If WinRM is open and I have valid credentials, test remote access early because it gives faster host validation than guessing local exploits.”
-
Create one variation. Change one condition and ask if the same answer still works. This prevents memorization.
-
Map the answer to workflow stage. Was it reconnaissance, validation, exploitation, privilege escalation, or lateral movement? Good testers know where they are in the chain.
-
Record misses by pattern. For example: “I keep overlooking simple file disclosure issues in web apps” or “I rush local privesc before checking user groups and sudo.” Patterns are more useful than isolated mistakes.
The reason this works is that the CPTS is built around realistic decisions. You are rarely rewarded for recognizing a textbook phrase alone. You are rewarded for choosing the next useful action from imperfect information.
Final-week readiness routine
In the week before your exam attempt, shift from learning mode to execution mode.
-
Standardize your notes. Every host should have the same layout. This reduces mental load.
-
Trim your toolset. Keep reliable tools you know well. Too many options slow you down.
-
Rehearse your first 30 minutes. Scan, identify key services, validate access paths, start documenting immediately.
-
Practice one “stuck” routine. When progress stalls, return to service review, credentials, local files, shares, user context, and missed ports. A preplanned recovery loop prevents panic.
-
Review reporting habits. Save proof, note timestamps if needed, and write short findings as you go. Waiting until the end is risky.
-
Protect your energy. Long practical exams punish poor pacing. Plan food, breaks, and sleep as seriously as technical prep.
Exam-day checklist
-
Stable system and internet connection
-
Working VPN and tested lab environment
-
Prepared note template
-
Command snippets for common enumeration steps
-
Credential tracking sheet
-
Screenshot or proof workflow ready
-
Backup local copies of your notes
-
Clear time blocks for enumeration, exploitation, escalation, and reporting
FAQ
How many hours should I study each day for 30 days?
For most candidates, two to four focused hours on weekdays and longer sessions on weekends is enough to improve sharply, as long as the study is hands-on. Eight distracted hours are less useful than three structured ones. The key is repetition of workflow, not just exposure to content.
Can I pass the CPTS by using only practice questions?
No. Practice questions help with recognition and decision-making, but the exam is practical. You must be able to enumerate, exploit, escalate, and document in live environments. Use questions to sharpen judgment, then prove that judgment in labs.
What if I keep forgetting commands?
Build a small personal cheat sheet during the 30 days. Keep it organized by task: scanning, web enumeration, SMB review, WinRM access, Linux privesc, Windows privesc, file transfer. This works because it reduces recall pressure and lets you focus on analysis.
How do I know if I am ready?
You are getting close when you can compromise mixed targets with a clean process, explain why each step came next, recover when stuck, and produce usable notes without redoing your work. Readiness is about consistency, not one perfect lab.
Should I review wrong answers more than right ones?
Yes, but review them correctly. Do not just read the explanation and move on. Identify the missed clue, the faulty assumption, and the better decision rule. That is where your score and practical performance improve.
What about retakes?
Retake policies can change, so always confirm the current official terms before planning. From a study perspective, treat a retake as a diagnostic opportunity. Do not simply repeat the same routine. Rebuild your prep around the exact process failures that cost you time or access.
What is the best practice strategy in the final week?
Use shorter, cleaner sessions. One or two realistic timed drills are enough. Spend the rest of the week refining notes, repeating core enumeration, and reviewing your weak spots. Cramming unfamiliar topics at the end often hurts more than it helps.
Final thoughts
The best CPTS preparation is not flashy. It is organized, repetitive, and honest. You review the basics until they become automatic. You practice realistic attack paths. You study your mistakes without ego. And you build a process you can trust when the exam gets messy. If you follow this 30-day plan with steady hands-on work, you will not just feel more prepared. You will be more prepared in the way the CPTS actually measures.
