Skip to content
CertGPS

Certified Penetration Testing Specialist

Proves you can attack web, external and internal Active Directory targets over ten days, then write a commercial-grade report

AdvancedHack The Box

The exam

Exam cost
$210
Study time
4-8 months
Passing score
Unpublished points threshold plus a commercial-grade report
Valid for
No expiration

Before you book

  • Required: 100% completion of the HTB Academy Penetration Tester job-role path (28 modules)
  • Required: an exam voucher ($210, or included with the Silver Annual plan)
  • Recommended: web application, operating system and networking basics

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

Study guide

Last updated

HTB CPTS Study Guide: The 28-Module Path, the 10-Day Exam and the Report

The HTB Certified Penetration Testing Specialist (CPTS) shows that you can test a web application, an external perimeter and an internal Active Directory network, then hand over a report a paying client would accept. Hack The Box won't let you redeem an exam voucher until you've completed all 28 modules of its Penetration Tester job-role path. Price the path first and the $210 voucher second.

Who CPTS suits, and who should look elsewhere

HTB writes the exam for junior penetration testers, vulnerability analysts, security analysts and incident handlers, and it describes holders as working at an intermediate level. The path itself starts from close to zero, so it suits a system administrator or SOC analyst one or two years into the field who wants to move into consulting-style testing and can give the modules several months of steady evenings.

If a contract or job posting names OSCP, CPTS won't stand in for it, and OSCP is the one to take. If you're drawn to the defensive side, CDSA uses the same path-then-practical model for SOC work. If you already test for a living and want command-and-control tradecraft, CRTO is the better spend.

The exam at a glance

HTB CPTS
FormatPractical black-box web, external and internal testing of an Active Directory network, with flags to submit and a written report
Time10 days of lab access; the report is due within the same 10 days
Passing standardA minimum points total (HTB doesn't publish the figure) and a report an instructor judges commercial-grade
Price$210 voucher (€180, £150) with two attempts, valid one year from purchase; Silver Annual ($550 for new subscriptions from October 12, 2026) includes a CJCA voucher and one specialist voucher
DeliveryOnline over VPN, from Pwnbox or your own virtual machine, in a dedicated lab you can reset
Prerequisite100% completion of the 28-module Penetration Tester job-role path
ResultsWithin 20 business days
ValidityNo expiration date and no renewal

What the path and the exam cover

HTB publishes no domain weights. It lists eleven knowledge areas instead, from methodology and reconnaissance through Windows and Linux attacks, Active Directory, web applications, pivoting and lateral movement, privilege escalation and risk reporting. The 28 modules are the real syllabus.

Web testing takes the largest share of the path, with twelve modules: web reconnaissance, proxies, ffuf, login brute forcing, SQL injection, SQLMap, cross-site scripting, file inclusion, file uploads, command injection, a general web attacks module and attacking common applications. Active Directory gets one long module (Active Directory Enumeration & Attacks), backed by Pivoting, Tunneling, and Port Forwarding and the two privilege escalation modules. The path ends with Documentation & Reporting and then Attacking Enterprise Networks, a full simulated engagement.

The exam rewards chaining. HTB says candidates must find issues "not immediately apparent from searching for CVEs" and combine several weaknesses to reach the objectives. A letter of engagement sets the scope, so the exam also checks that you read and respect it. An instructor first checks your points against the threshold and then marks the report, which can fail you even if you captured every flag.

How to prepare

Work the path in HTB's order and treat each module's skills assessment as a small exam, because HTB doesn't publish the answers. HTB estimates the path at 45 days. Use your pace on the first five assessments to set a realistic date before you buy the voucher, since the voucher's one-year clock starts at purchase, not when you finish the path.

Write findings from the start. For every skills assessment, record the vulnerability, the evidence, the risk and the fix in the format you'll use in the exam. HTB publishes official report templates built in SysReptor, which you can use for free in the cloud or self-hosted, and the exam provides its own template on day one. By the time you reach Documentation & Reporting you should have a few dozen practice findings.

A workable split for someone part-time: about 60% of your hours on the path itself, 25% on repeating Attacking Enterprise Networks and on retired HTB machines with Active Directory, and 15% on report practice. Do Attacking Enterprise Networks twice, the second time without notes, and write a full report for it.

For the exam itself, plan the ten days as one engagement with a hard stop. The lab and the report share the same deadline, so stop testing with enough time left to write, and draft the report as you go, which HTB itself recommends. If you don't upload a report in time, your voucher expires and you lose the free retake.

After you pass, or if you don't

CPTS has no expiry, no continuing education requirement and no maintenance fee. Your digital certificate comes from the exam history tab, a Credly badge follows by email, and employers can check a certificate ID at hackthebox.com/certificates.

If the first attempt fails, an instructor sends written feedback. You then have 14 days to start the free retake, which runs for another ten days. HTB's business help centre adds a 14-day cool-off after a failed second attempt before you can try again on a new voucher.

Next steps that build on CPTS:

  • OSCP, if postings in your market ask for it by name. OffSec gives 24 hours to submit the report after the exam, and OSCP+ must be renewed every three years.
  • CRTO, for Cobalt Strike, operational security and red team work.
  • OSEP, OffSec's course on evading defences and breaching hardened targets.

Our view

CPTS gets respect for realism. You get ten days in a network that behaves like a client's, a scope letter, and a report someone actually grades, which is closer to the job than most exams with a clock running. At $210 for two attempts it costs a fraction of OffSec's $1,699 OSCP exam, even after you add the path. The mandatory path is the main complaint: experienced testers pay for and grind through 28 modules to prove things they already do at work. Recognition is the other risk, because an HR screen built around OSCP may not know the name. We'd recommend CPTS to anyone learning penetration testing from scratch, and OSCP to anyone who needs to clear a résumé filter this year.

Sources