> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/blogs/how-i-passed-the-htb-cpts-exam.md).
# How I Passed the HTB-CPTS Exam
Captured all the 14 Flags.........!!!!!
If you're staring down the HTB Certified Penetration Testing Specialist (CPTS) exam wondering whether you're actually ready, here's my story. Spoiler: it took a full year, one flag nearly broke me, and I still passed on my **first attempt**. Hopefully this gives you a realistic picture of what the journey and the exam actually look like.
## The Prep: One Year, No Shortcuts
I spent about a year preparing before I sat the exam. Here's what that looked like:
* **Completed all 28 modules** in the HTB Academy CPTS learning path
* **Followed IppSec's CPTS track** on YouTube to reinforce concepts with real walkthroughs.
* **Went through the official HTB CPTS track** end to end.
* **Had prior foundations in place**: CompTIA Security+ and TryHackMe's PT1 path before I even started the CPTS material.
That foundation mattered. Security+ gave me the theory scaffolding, and TryHackMe PT1 got me comfortable with basic offensive workflows before I threw myself into HTB's much more hands-on, exam-style content.
If there's one thing I'd tell someone starting out, it's this: **the CPTS track itself is enough to pass the exam.** The exam does not deviate from what's taught in the penetration testing modules. You don't need to go chasing extra boxes or unrelated content to "feel ready" the track covers what you'll be tested on.
## Exam Day-by-Day: The Real Timeline
The CPTS exam gives you 10 days — time to attack, and time to report. Here's how mine actually broke down, flag by flag:
| Day | Progress |
| ------------ | ---------------- |
| Day 1 | 0 flags |
| Day 2 | Flags 1–7 |
| Day 3 | Flag 8 |
| Day 4 | Flags 9, 10, 11 |
| Day 5 and 6 | Flags 12, 13, 14 |
| Days 7 and 8 | Reporting |
That first line is not a typo. **Day 1 ended with zero flags.** Flag 1 alone took roughly **15 hours** to crack. It was, by far, the hardest part of the entire exam for me — harder than any of the flags that came after it.
Once I broke through, though, momentum picked up fast: flags 2 through 7 came comparatively easily, and I cleared all of them on Day 2. Then flag 8 showed up and slowed everything down again a genuine "beast" of a flag that ate an entire day on its own. Flags 9 and 10 were also tough, but 11 and 12 eased back up, with 13 and 14 landing somewhere in the medium-to-hard range.
The next two days went entirely to writing the report.
## What I'd Tell Someone About to Attempt CPTS
A few concrete lessons from getting through it:
**1. Write the report as you go, don't wait until the last day.** Documenting flags, commands, and findings in real time saves you from a miserable final-day scramble trying to remember what you did three days ago.
**2. Make the report genuinely good.** Every figure and command output should have a clear description. Assessors are grading your ability to communicate findings, not just your ability to pop boxes. If you want a reference point for structure and tone, I put together a sample pentest report based on the HTB Reddish machine it's not perfect, but it can give you a feel for what a full write-up looks like: [HTB Reddish Pentest Report](https://ajaykumar-kanthi.gitbook.io/write-ups/blogs/htb-reddish-pentest-report).
**3. If you use AI to help with anything, don't trust it blindly.** Verify everything it gives you commands, explanations, report wording against your own understanding.
**4. Take regular breaks.** Overstressing leads to tunnel vision and pot holes going in circles on the same idea instead of stepping back and re-approaching the problem.
**5. If a path feels totally disconnected from the CPTS modules, it's probably not the intended path.** The exam is built around what the course teaches. If you find yourself needing techniques far outside that scope, stop and reconsider your approach.
**6. Don't overcomplicate things.** The simplest explanation or vector is often the right one. Resist the urge to assume the exam wants something exotic.
**7. Enumeration is everything.** This is the single biggest lesson from the whole exam. Proper, thorough enumeration makes almost every flag fall into place. Rushing enumeration is where most time gets wasted.
**8. Consider the AEN module and, optionally, extra labs.** Try the AEN module blind first, without leaning on notes, to genuinely test yourself. If you feel you need more practice afterward, HTB's Zephyr or Dante Pro Labs can help, they overlap with some CPTS topics, though they're not a requirement to pass.
## Final Thoughts
CPTS rewards patience more than raw skill. A 15-hour flag 1 can feel like a sign you're not cut out for it, it isn't. It's just enumeration taking the time enumeration takes. Trust the process, stick to what the modules taught you, document as you go, and take the breaks you need. I passed on my first attempt, and I genuinely believe anyone who puts in the same level of preparation can too.
If you've put in the reps through the HTB Academy modules and treated the labs seriously, you're more ready than you think.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/blogs/how-i-passed-the-htb-cpts-exam.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
