After passing OSCP last year, people kept asking me what certification I was going after next. The answer was always the same in my mind: HTB CPTS. Half the reason I passed OSCP in the first place was HTB Academy and its courseware.
Why CPTS After OSCP#
Around 2023, HTB Academy was still in its early days. I stumbled upon it and started going through the content, eventually dropping TryHackMe altogether. Compared to TryHackMe, HTB Academy had a clear structure. Topics built on each other instead of feeling scattered, and every module explained the underlying principles, not just the commands. I started with the free modules and worked my way up from there.
Later, when I began preparing for OSCP, I studied only the OffSec PEN-200 material. Having just transitioned into a penetration testing role, I didn’t really grasp the key concepts in the courseware. I failed OSCP twice. My manager then suggested I try HTB Academy’s Penetration Tester Path. About halfway through it, I took OSCP a third time and passed.
A Working Mom Can Pass OSCP+ Too｜Walking a Tightrope Between Kids, Work, and a Hard Exam
HTB Academy helped me a great deal, from building a solid foundation that enabled my career switch to finally passing the OSCP exam. On Reddit and various forums, many people have compared OSCP and CPTS, and the consensus is overwhelmingly positive about HTB CPTS content quality. To show my support, and because the material genuinely deserves it, I decided to go back and earn HTB’s own certification as well.
The Road to CPTS Started During OSCP Prep#
My CPTS preparation overlapped heavily with my OSCP studies, so I can’t really say exactly how long I spent on it. By the time I passed OSCP, I had already completed about half of the Penetration Tester Path. After passing CISSP in September 2025, I slowly worked through the remaining modules and finished everything by January 2026. The Penetration Tester Path covers 28 modules in total, from Nmap enumeration, web attacks, and AD attacks to privilege escalation and report writing. It’s a complete penetration testing learning path.
Beyond the courseware itself, I also completed 7 of the HTB CPTS Preparation LAB machines. I strongly recommend doing these, because I encountered similar techniques during the actual exam.
For the report, I used SysReptor (self-hosted via Docker), the same setup I used for my OSCP exam.
Failing Isn’t the End, It’s Fuel for the Next Attempt#
First, some context on the CPTS exam format: the environment contains 14 flags, and you need at least 12 (plus a passing report) to earn the certification. You have 10 days from exam start to submit your report, so it feels like running an actual pentest engagement. Each registration includes two exam attempts; if you don’t pass on the first try, you get a second chance.
I registered for the first time in February this year. I used up both attempts and only captured 5 flags. The biggest issue was Flag 1, where I spent way too long going down the wrong path. On top of that, my Silver membership exam voucher was about to expire, work was busy, and I had a young child to take care of. I simply couldn’t commit fully.
The lesson was crystal clear: CPTS demands your full attention. Trying to juggle it alongside work is extremely difficult. The exam isn’t about any single technique. It’s about whether you can keep enumerating, keep reviewing the pieces you’ve already collected, and put the scattered information together. When you’re stuck, it’s usually because you haven’t seen the full picture yet, or you haven’t assembled the pieces you already have.
In September this year, I registered again. This time I had a gap between projects, giving me more time to focus on the exam. I still had a child to take care of, but at least I wasn’t juggling a high-pressure project at the same time. Since I had already completed Flags 1 through 5 during my first attempt, I got through them much faster this time around. The real time sinks were Flag 8 and Flag 10. Both heavily tested your enumeration skills and couldn’t be solved by following a single attack path. If you keep hammering at one approach, you’ll just hit a wall. The right move is to step back, lay out all the information you’ve gathered, and look for combinations you haven’t tried yet. In the end, I got 12/14, just enough to pass.
Exam Takeaways#
The CPTS exam focuses heavily on both web and AD. Each carries significant weight, while Linux plays only a minor role. Compared to OSCP, the AD content in CPTS goes much deeper, with longer chains, more diverse techniques, and a strong emphasis on privilege management. OSCP’s AD section feels like an introduction; CPTS is where you truly learn AD penetration testing.
During the exam, I followed the same approach as my OSCP attempt: every time I captured a flag, I immediately documented the attack path and took screenshots to avoid missing key evidence when writing the report later. Beyond the walkthrough itself, I also kept a running log of all enumerated information: credentials and hashes I found along the way, plus an active log tracking which attack paths worked, which didn’t, and what I hadn’t tried yet. This log was incredibly helpful for organizing my thoughts during the exam.
When I got stuck, the most effective thing to do was step away from the screen, take a break or get some sleep, and come back to re-enumerate with a clear head. Staring at the same thing and forcing it never works. Personally, I found that sleeping on it was surprisingly effective.
The report is another exam in itself. HTB’s report requirements are harder than OffSec’s, at least in my experience. For OSCP, the report is essentially a walkthrough. Document how you got in and you’re done. For CPTS, on top of the attack narrative, you also need to write each discovered vulnerability as a standalone finding with severity rating, description, impact assessment, and remediation recommendations. You’re essentially writing a walkthrough and a professional pentest report at the same time.
The report took a very long time to write. Getting it rejected would be devastating, so my advice is to invest the time and write it properly according to the official requirements on your first submission. Don’t just rush it out and hope for the best, unless you’re running out of time and need to rely on the second submission opportunity.
Final Thoughts#
Honestly, HTB certifications aren’t well-known in Taiwan yet. When people hear “HackTheBox,” they mostly think of the CTF-style lab machines, not the Academy or its certification program.
But from my own experience, HTB Academy is the most structured cybersecurity training platform I’ve come across. It covers both red team and blue team content. It won’t leave beginners with basic IT knowledge feeling lost, and it doesn’t stop at just telling you which commands to run. It explains the reasoning behind every technique. When you finish a module, you actually understand why things work the way they do, not just how to copy and paste.
If you’re preparing for OSCP but find the OffSec material hard to follow, I’d suggest starting with HTB Academy’s Penetration Tester Path. Those 28 modules are worth going through regardless of whether you end up taking the CPTS exam.
