HackTheBox Certified Penetration Testing Specialist (CPTS) Review

What is CPTS?

The Certified Penetration Testing Specialist (CPTS) is a practical penetration testing certification provided by Hack The Box through Hack The Box Academy.

It is designed for intermediate penetration testers and is completely focused on hands-on skills in realistic environments. There is no theory-based testing, everything comes down to actually performing attacks and understanding how systems behave in practice.

To qualify for the exam, you must complete the Penetration Tester path, which consists of 28 modules. This is not just a formality - finishing this path is a challenge on its own and requires serious time and focus.

The content covers areas such as:

CPTS Exam Overview

The exam is a real-world simulation where you are placed inside a corporate environment and expected to fully compromise it and document your work professionally.

My Opinion on the Materials

I believe that when it comes to network penetration testing content on the internet, there are no better materials than this. However, that does not mean they are perfect.

The materials are high quality, but:

One thing I didn't like is how disconnected the learning process feels.

I think it would be much better if, after every few lessons, there were small lab environments similar to simplified Hack The Box machines, where multiple concepts are combined. Then, as you progress, new lessons could expand those same labs, making them more complex over time.

That way, you would continuously build on what you've already learned instead of having to connect everything yourself later. In my opinion, that would make understanding much easier and more practical.

Also, the Password Attacks module is something I personally didn't like. Running tools like hashcat and waiting 10+ minutes is not really skill, it's just time. It doesn't add much beyond basic tool usage.

Exam Experience

Honestly, this is the hardest certification I've ever done. It pushed me more than anything else so far, and there were multiple moments where I seriously considered quitting.

One thing that bothered me the most was the environment. I had a very unstable experience, and I want to be upfront that this may have been on my side rather than an issue with Hack The Box. I'm sharing it simply because it shaped a significant part of my exam.

I had to reset the environment around 6 to 8 times, and there were situations where I was doing everything correctly but not getting any results. After resetting, the same steps would suddenly start working. Because of that, I lost around 24 hours total just retrying things, resetting, and troubleshooting, while actually being on the right path the whole time.

I've seen people say they had a great experience with the environment and even praise it. Everyone's experience is different.

My progress looked like this:

I spent around 3 days writing the report, because I tend to write it in a way that even someone without prior experience can follow and fully replicate what I did. In the end, the report was around 120 pages.

After nine days and a few hours, with some time still left, I submitted my report.

Less than 24 hours later, I received the following email:

And just like that I passed.

Based on the feedback I received, the report quality was very high. It was described as well-structured, precise, clean, and professional.

I would share the exact feedback, but I'm not sure if that's allowed.

There was also some feedback I'm not sure I fully agree with. Implementing those suggestions would probably make the report significantly longer than 120 pages, and at that point there's a risk of turning it into something too large, which creates its own problems.

CPTS vs OSCP

This is the question I get asked most, so let me answer it honestly: I have not taken OSCP, so I cannot compare them from both sides. What I can pass on is the published format of each exam and what people who have done both consistently say.

The consensus I keep hearing is that CPTS is significantly harder, and that OSCP feels more CTF-like while CPTS feels closer to a real engagement. The structural difference behind that is the exam window: a single sitting against 10 days changes what is actually being tested. A 24-hour exam tests what you can do under acute pressure. Ten days tests methodology, note-taking and whether you can stay coherent after a day where you got nothing.

Final Thoughts

The exam is very difficult while you are doing it.

But once you get through it, your perspective changes. You realize it wasn't about some hidden trick or missing knowledge. It was about:

If you've done Hack The Box machines before, you probably know that feeling.

While you're stuck, it feels impossible. Once you solve it, everything suddenly makes sense.

Additional Learning Materials and Preparation Tips

I didn't use much extra material. Here's what actually helped:

What I'd Do Differently

If I had to do this again, here are a few things I would change: