Hack The Box - CPTS

All of my spare time in 2024 and the first third of 2025 was dedicated to studying the CPTS certification from Hack The Box. I’m absolutely ecstatic to report that I successfully passed the exam and am now a Certified Penetration Testing Specialist! The journey to obtaining this cert has been super challenging, but I’m so glad that I did it. It taught me so much about computers, security, and myself.

Why Did I Do This?

At first, the cool looking certificate drew me towards CPTS. It has lightning bolts and a sword on it! Tell me that isn’t cool. I took a look at the content that the course contained and saw that it was very comprehensive. It covered everything from Active Directory to information gathering to privilege escalation to report writing, so it was clear that I was going to get a very high quality education from completing the learning path. I’ve had an interest in learning more about computer security for a long time, and CPTS offered a very detailed and hands-on experience

The other reason why I got this cert is to become a better developer. I’m now much more paranoid about aware of the various vulnerabilities that can pop up in websites, software applications, and networks. If I’m the one that is building and maintaining those systems, knowing how the bad guys can get in is going to help me plug those security holes during development, and possibly save the organisation a whole bunch of time, money, and headaches. Having completed the cert, I now have a rich knowledge of how vulnerabilities arise, how they can be exploited, and what the consequences of successful exploitation can be.

What Was It Like?

Here’s a picture of me once I handed in my final report.

That should say it all.

But seriously, it was an incredible experience. I wouldn’t change anything about it. It was one of the hardest challenges that I’ve ever taken on, but also the most rewarding. I’m super proud of what I was able to achieve, and so glad that I didn’t give up. The certificate is now a constant reminder that when things seem impossible, they really aren’t.

What Did I Learn?

I learned sooooooo much from CPTS. Before receiving the certification, candidates must complete the Penetration Tester job role path on Hack The Box Academy. It consists of 28 individual modules that cover all the most important topics that a penetration tester needs to know including Active Directory, Web Attacks, Password Attacks, and Information Gathering just to name a few. The path overview page linked above does a good job of describing all of the technical skills that are taught, so I won’t repeat them here. Check out the academy for more details about the learning path.

In addition to the hacking skills, I also picked up some soft skills that I truly believe are just as important as the technical knowledge.

1. Be Humble

Every hacker has two sides to them.

They’re likely only ever going to show you one side.

Being humble is a really important quality to have. Nobody likes a know-it-all or a show-off. Clients want someone that can speak clearly and in a matter-of-fact way about the security issues that are plaguing their environment. They don’t care about how good of a hacker you think you are. You may also find that after you’ve hacked one thing, the next thing totally throws you for a loop. Remaining humble will ensure you won’t falter, and will continue to persist with confidence in the face of uncertainty. It will also keep you grounded, allowing you to communicate with your client effectively.

2. Be Resilient

Cybersecurity needs you to be mentally strong. You need resilience and grit as well as extensive technical knowledge. The ability to keep going when it feels impossible to do so and when the odds are stacked against you is something that can only be gained from experience. It’s also something that can’t be perfected, only practiced.

3. Be Note-Taking

Being skilled at note-taking is almost as important as any technical competency that a penetration tester might have. What’s the point in pwning a client’s network if you can’t even explain to them how you did it? Or even worse, you can’t even remember how you did it!

Your brain is for having thoughts and ideas, not for holding them, so you need to write them down. There are lots of note taking apps out there to help you do this. I personally use Obsidian for my notes. It lets you write notes in Markdown, map out ideas and concepts using it’s canvas feature, and also link notes together so that you can quickly hop between related topics. There’s also tags, searching, file tree structures, frontmatter, it goes on and on.

I also sprinkle some memes into my notes. When you’re stressed out or frustrated while looking for that needle in your haystack of information, a funny meme popping up can provide a nice boost to your mood.

4. Be Kind To Your Future Self

You’re only human, and you’re trying your best to learning something hard, so stop being so hard on yourself. Negative self talk is a really common problem, and we can become our own worst enemy if we’re not careful. How can you avoid that? One way is to leave small thoughtful notes for yourself somewhere where you’ll find them after a while (hopefully after you’ve forgotten about them). Tuck them into your notebook or paste them into some random note in your notes app. Stumbling upon small pockets of encouragement from your past self feels good ❤.

How Long Did It Take?

I didn’t really keep a close eye on how long it took me to complete the learning path. My best estimate would be a year and a third. I have a day job, so I worked that all day and then came home and studied CPTS in the evenings. I also put in many hours over the weekend too. Because I was only able to use my spare time for study, it took quite a while to get through everything. This was just me though. If you’re planning on studying this cert yourself, your mileage is going to vary greatly.

What Did I Struggle With?

I had plenty of struggles. These were the biggest ones.

1. Working and Living

As I mentioned above, I have a day job to work and a life to live. CPTS is a lot of work, and fitting that around other commitments can be a real challenge. I tried to balance everything as best I could. Sometimes that meant that I didn’t get as much done as I wanted to during a given study session. I can’t really offer many tips for how to balance CPTS and the rest of your life since everyone has different circumstances and different obligations to fulfil. All I can say is make sure you still give some of your time to yourself and the people you care about. They matter more than a hacking certification!

2. Doing Less

It’s easy to get wrapped up in what you’re doing, so much so that you don’t eat or get outside. This definitely got me good. I would often start studying in the morning and before I even realised it was mid-afternoon and I hadn’t eaten anything. Reminding myself to take care of my basic needs and get outside helped me immensely. When my head was swimming with thoughts, I would go out for a walk, find a bench to sit on, and just watch the world go by for half an hour. It’s often in those moments when you’re focussed on something else that a new idea just pops into your head. Getting out and touching grass is a great technique for problem solving. Watch this if you need more convincing about that. Sometimes the best thing to do in the moment is to walk away from the computer. It sounds counter-intuitive but it’s true.

3. Frustration

Something that they don’t really tell you from the outset is that pentesting can be a really frustrating experience. You’re likely going to spend hours bashing your head against the keyboard trying to get something to work. It is really easy to get discouraged when that happens. When I found myself in this position, I remembered why I was doing this.

• I want to learn how to keep computer systems safe and secure
• I want to learn valuable skills
• I want to do hard things
• I want that certificate

Keeping my “why” in mind kept me motivated.

4. Taking It Slow

Despite taking quite a while to finish the learning path, I wouldn’t have wanted to finish it any quicker. Taking my time ensured that I properly absorbed the material and was able to retain it. It also allowed me to properly structure my notes so that they made sense to me. Just copying information isn’t learning. Organising it into a form that facilitates understanding and retention is learning. Of course, doing it slow isn’t very satisfying, so fighting the urge to move faster and faster was a constant battle.

What Are My Tips?

I have a few.

1. Study The Path

This one sounds kinda dumb, but there’s a very good reason why you’re required to finish the entire path 100% first. Study, learn, and absorb absolutely everything that the path teaches you. Read all the things and make sure you take good notes. I really can’t stress enough how important it is to be thorough in your note-taking and in your understanding of the technologies you encounter. Even if you could get into a client’s network by vibe-hacking, writing the report on that would be very difficult indeed.

2. Protect Your Notes

Back up your notes! This should really go without saying, but make sure you store a copy of your notes in a secondary location, and update it frequently. Automate this process so that you don’t even need to think about it. When it comes to numbers of backups; three is two, two is one, one is none.

3. Automate Your Setup

I wrote my own short scripts for quickly setting up my work environment at the beginning of each study session. This only saved about a minute-ish each time, but the time saved was certainly measurable when multiplied over many study sessions. Reducing the friction of starting study is the key to doing more of it.

4. Trust Yourself

Trust your knowledge and abilities. If you’ve studied the path and taken lots of notes, you’ll do just fine. You’ve got this 💪.

The Certificate

Here is my hard-earned certificate.

If you want to hire me, just message me on LinkedIn ;)

What Is Next?

I’m just going to chill for now. A break is long overdue, so it’s just going to be video games and spending time with friends for a bit. Once I’m feeling recovered, I might considering going after another certification. HTB also offer certs for web exploitation and Active Directory which both look interesting. There are also upcoming CTFs to play, blog posts to write, books to read, and side project ideas to develop. In short, I don’t really know yet - but I’ll work it out.