Most CPTS candidates who fail do not fail the hacking. They fail the report, or they run out of the ten-day window because they treated it like a twenty-four-hour exam and burned the first three days on a single external host.
The HTB Certified Penetration Testing Specialist exam is structured differently from OSCP, CRTO, or BSCP, and preparation that ignores that structure wastes the attempt. Here is what the exam actually asks for, why leaked material is close to worthless here, and a ten-day plan that maps to the report requirement.
The exam structure, precisely
- Eligibility: the Penetration Tester job-role path must be completed 100% before the voucher can be redeemed. That path is 28 modules, each with its own skills assessment.
- Lab access: ten days, on a dedicated instance you can reset at any time.
- Deliverable: flags submitted on the exam page, plus a commercial-grade report uploaded within ten days of starting.
- Inputs: a letter of engagement defining scope and objectives, and a report template.
- Attempts: two. Vouchers expire after one year; the retake must start within fourteen days of receiving feedback.
- Result: an instructor checks the points first, then evaluates the report. Feedback arrives within twenty business days, usually sooner.
- Validity: HTB Academy certifications do not expire.
The scope is a black-box engagement against a real-world Active Directory network: web, external, and internal. Pwnbox or your own VM over VPN, no tool installation required.
Why leaked material fails on this exam
Three reasons, and they apply to every hands-on certification that uses dedicated instances.
The instance is yours. Hostnames, credentials, and flags differ per candidate. A walkthrough of someone else’s lab shows a path through a network that does not exist in yours.
The report is graded by a human. This is the part candidates underestimate. Points alone do not pass the exam. If the report does not communicate risk at a commercial standard, the instructor can fail an attempt that gathered enough flags.
The engagement letter defines the work. Objectives in the letter are part of the exam. A technically impressive compromise outside scope earns nothing, and a report that ignores the stated objectives reads as if you did not read the brief.
Leaked content also tends to be older than the path it claims to cover. The Penetration Tester path is updated, and technique that worked on an older module assessment may be blocked or irrelevant in the current lab.
The ten-day plan
Treat the ten days as an engagement, not a CTF. Plan the report from day one, because the report deadline is the same as the lab deadline.
| Days | Phase | Output |
|---|---|---|
| 1 | Read the letter, map the external surface | Scope notes, host inventory |
| 2–3 | Web and external footholds | First credentials, first flags |
| 4–6 | Internal network and Active Directory | Lateral movement, privilege escalation |
| 7–8 | Remaining objectives, pivoting, cleanup | Flags complete, evidence collected |
| 9 | Report drafting | Full draft with findings and remediation |
| 10 | Review, evidence check, upload | Final PDF submitted |
Two rules keep this plan honest:
- Write the finding when you find it. A finding documented at the moment of discovery takes four minutes. Reconstructed on day nine, it takes forty and loses detail.
- Do not spend more than one day on a single host. The network is large. A dead end on day two costs objectives you will not have time to reach on day eight.
What the report has to contain
The template is provided, so the structure is not a guess. What varies is quality. A commercial-grade report typically needs:
- Executive summary — the risk story in plain language, understandable to a client who does not read shell output.
- Scope and engagement details — what the letter authorised, and what was tested.
- Methodology — how you approached web, external, and internal phases.
- Findings — one section per vulnerability, with evidence, affected hosts, impact, and remediation.
- Attack narrative — how individual findings chained into domain compromise. This is where most reports lose marks: findings listed separately without the path that connects them.
- Limitations — what you could not test and why.
Evidence standards matter. A screenshot of a flag proves access; a screenshot of a command with no output proves nothing. Every claim in the report should be reproducible from the evidence you include.
The mistakes that cost attempts
From candidate accounts and instructor feedback, the recurring failures are consistent:
- Treating the ten days as unlimited. The first three days set the pace. Lose them and the report becomes rushed.
- Ignoring the letter of engagement. Objectives are graded, and out-of-scope work is wasted work.
- Chasing every host. Breadth without depth produces flags but a thin narrative.
- Writing the report last. The report is half the certification. Draft it while the engagement is live.
- No remediation advice. A finding without a fix is an observation, not a professional deliverable.
Preparation that actually maps to the exam
The Penetration Tester path is the syllabus. Complete it properly rather than skimming to unlock the voucher — the skills assessments are the closest thing to exam conditions you get for free.
Beyond the path, three habits transfer directly:
- Practise writing findings, not just finding them. Take a retired box and write a one-page client finding: impact, evidence, remediation. Do this weekly.
- Rehearse AD chains end to end. Enumeration to domain admin in one continuous session, with notes taken as you go.
- Time-box hosts. Set a timer per target in practice, so the discipline exists before the clock is real.
If you are comparing CPTS with OSCP, the structure differs more than the difficulty: CPTS gives you ten days and grades a client report; OSCP gives you twenty-four hours and grades an exam report. The preparation converges on the same skill — reproducible documentation.
Where to go next
For the certification overview, pricing, and study material, see the CPTS certification hub. For report structure, the report template guide covers the sections that carry over to CPTS, and the AD enumeration workflow covers the phase that decides most CPTS attempts.
Certification names belong to Hack The Box. This is independent study material, not official course content.
Red team operator working across Active Directory and hybrid estates. OSCP, OSWE, CPTS and CRTO certified. Covers adversary simulation, evasion and report writing for red-team certifications.