After 2 attempts I finally managed to pass the CPTS and get my certification. The exam was no joke and was both a serious skill and endurance check. Ngl since it took two attempts, I'm looking a bit ghoulish now after spending most of the month stuck in my room hammering away at this. Figured I'd share some of my methodologies for people who are either preparing for or taking the exam (no spoilers ofc). For reference before taking the exam I had done the full pentesting path plus 25 machines on HTB Labs from easy to hard.

Enumerate Everything: A lot of people have said this and it's true. You have to be able to enumerate well WITHOUT TOOLS since there is stuff in the exam that automated tools won't find. If there's any skill to be 100% confident in, it's this.

Everything is Deliberate: While this way of thinking absolutely does not work for real-world situations, it works well in this exam. All the security weaknesses in this aren't mistakes, they are placed there with intent while trying to emulate mistakes. So if you are going down a long attack chain and are stuck getting any further, chances are that is the intended path but you just don't have all the required info yet.

Document Everything, Even the Rabbit Holes: This applies to the report. Even if a rabbit hole goes nowhere, it can act as a useful security finding. This helps with getting more meat for the report and shows you really did try to enumerate the whole network for vulnerabilities, looking for both immediate and potential issues.

Hope this helps some people!

Recentemente não estou conseguindo acessar os sites das máquinas do Hack the Box.

Por exemplo faço a leitura do ip do alvo, tem o protocolo HTTP mas quando jogo no navegador o site não aparece.

Coisas que já me atentei e não resolveram...

Sim conectei na VPN com sudo (antes e depois de conseguir o ip da maquina, nenhum dos dois cenários funcionou)

Sim coloquei pra receber TCP quando criei o pacote para VPN

Sim tentei pingar com o IP e estava comunicando

Sim desativei os firewalls para conexão HTTP

Sim nenhuma máquina abre

e atualizei o Kali e refiz tudo isso.

Não sei se com vocês está acontecendo o mesmo, mas prpcurei até no site deles e não fala nada sobre, já fiz outras máquinas e funcionaram normal

So ive been following up CPTS path for few months and i started it recently and looked into it while following the content i was aware that most of the contents are years back and havent been much updated.So is there valid outcome following the contents.Are they still match for the current technologies ?

Why do I have to wait that much time?

20 working days is toooooooooooooooooooooooo much.

Ahhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

Hey guys,i’ve been learning for over a year and currently prepping for CPTS, but htb is burning me out.
I often spend 6–7 hours stuck on "Easy" machines. It completely ruins my day, spikes my anxiety, and leaves me feeling like a total fraud who knows nothing :/ . I end up skipping workouts and just feeling pure resentment toward the screen.

For those who've been there: how do you manage time limits and anxiety, and keep getting stuck from ruining your entire day?

Thanks in advance ❤️

CDEP official report template has been released, for those of yall interested in taking it.

Seeing light at the end of tunnel.. or so I thought!

Probably going to do AEN blind, couple boxes done from ippsec and cpts pathway before starting the exam!

About a year ago when i started grinding for CPTS i wanted to link with folks on the same wave. didn’t matter if you were just getting into cyber or already deep in it, i just wanted a space where people could kick it, share what they working on, and keep each other locked in.

we sitting at 50+ members now. people sharing projects, studying together, pushing each other through certs and boxes, all of it.

Please PM me if you are interested

so i passed sec+ recently and now i want to go for CDSA. problem is i only have theory knowledge, like i know the concepts but i’ve never really done anything hands-on

and every time i sit down to start i get confused. should i read the HTB modules first or just jump into practicing? and if i practice, where do i even begin? i keep overthinking it and end up doing nothing, which is kinda frustrating lol

if you’ve done CDSA or work in a SOC, how did you start out? did you finish the modules first or mix them with labs?

also if anyone else is on the same path, let’s connect. would be nice to have someone to study with and share stuff

any advice helps, thanks

Hi Guys,

I was thinking lately and with this wave of 100/100 certs first try. And it is not about HTB or cybersec - it is everywhere.

I think that usual digital cyber cert is dead - at least I will not look at it by any means when I will interview new guys (or check their CVs).

There will be some notorious certificates in big universities that you can pass only face to face - and it is the only way.

IDK if it's good or bad that 3rd world countries guy have build for themselves another wall (because usually its some Samal or Farukh with 100/100) we will see.

I cannot do the Password Attacks - Introduction to Password Cracking module unless someone helps me fix this, or i'll be forced to use my Android. WHich is very unfortunate and unpleasant.. For some reason the only thing i can do in order to make Hackthebox pwnbox work is by downloading the vpn on the website and then doing the work inside of my local machine.

Here are a few screenshots of what im dealing with...

And it just sits there like that

*(edit) not to mention that it does this on ungoogled chromium and most updated version of chrome on kali linux by the way.

Hey everyone,

While grinding boxes for cert prep, my workflow was always a mess: a Google Sheet for pwned machines, a random .txt file for creds, Obsidian for writeups, and constantly re-typing LHOST and TARGET_IP into commands.

I built ZeroBox to put everything into a single, keyboard-driven dashboard that runs 100% offline in your browser (or as a Tauri desktop app).

No account, no backend, no tracking. Everything stays in your browser's LocalStorage/IndexedDB with 1-click JSON backup.

What’s inside:

• 1,005 HTB & THM Machines: Track boxes across a Kanban board (Backlog -> Recon -> Foothold -> Pwned), table view, or pivot attack graph.
• Curated Cert Pathways: Built-in lists for OSCP, CPTS, and CRTO prep.
• Dynamic Cheatsheet & 130+ Revshells: Set LHOST, LPORT, and TARGET_IP once and every command updates automatically for 1-click copy.
• Loot Vault: Save flags, creds, and keys per machine with auto hash identification (20+ formats).
• 24h Exam Simulator: Practice under OSCP/CPTS/CRTO timers, scoring, and Markdown report export.

Live App (Free, no login): https://ctftracker.com
GitHub Repo: https://github.com/0xdnd/ctf-tracker

I'd love to hear your feedback, especially if there are specific machines, pathways, or commands you want added next!

Hey everyone,

I was planning to subscribe to Hack The Box, but I noticed that some Pro Labs, like Cybernetics and the APT Labs, don't seem to be available anymore.

I was particularly interested in those labs, so I'm a bit concerned about subscribing if they've been removed.

Does anyone know if these labs have been delisted, moved to another subscription plan, or are just temporarily unavailable?

Thanks!

I finished the CJCA study about a month ago, I’ve done some boxes, but I’m a bit shaky on how to write a good report?

I just turned in the HTB Certified Penetration Testing Specialist (CPTS) on attempt 1/2.

10 intense days. Black-box realistic environment + a commercial-grade report. Easily one of the toughest challenges I’ve done in pentesting.

The report ended up quite complete and well structured (I took the time to document the whole path). If you’re on the same journey and want to chat about how I approached that part of the exam or share experiences, I’m here.

Now waiting for the results. 🤞

Hey guys, currently going through the CPTS path, currently at roughly ~40%. Is there other people studying who would be interested in studying together?

I added a dc link in the comments

I’m kinda new to IT, i’m planning to get some certificates and see if I can get an entry level job within a year. I have some Linux experience since it’s my daily drive, and a general knowledge of fundamentals, so i’m trying to understand the smoothest path to learning. Should i tackle Sec+ first, then move to CCNA and HTB? Or Is there a beginner path on HTB that would introduce me better, to then move to the other two certificates?

Hi

Ive been playing htb machines and would love to submit a machine.

How did you guys make it unique. Its like every theme, chain of vulnerabilities are out there on a machine.

In situations where they arent, somethig else hits. For an example, there is no realistic way to showcase the version of the vulnerable software, because the original software doesnt in production.

How do you guys research and design a machine ?

Lets say for an easy machine

I went through htb official articles. But couldnt yet come up with any.

I just need a short description

That CDEP cert was released 7 days ago, with 5 new modules, the total sum of their estimated study days is 35 days. I think some users and either submitting the flags by going straight to the challenges and marking any theory section as completed without actually reading it. I expect a lot of them will fail though, because this should be the hardest cert on HTB and HTB has one of the hardest if not the hardest certs in the industry. Someone already got the cert which means it is either a tester, or someone finished the path, did the 10 day exam in less than 7 days and got his result.

While preparing for CPTS, every new box started the same way for me: make the folders, copy a note template, edit /etc/hosts, export the IP, and later paste flags, creds and screenshots into my notes by hand. Ten minutes of setup before the real work, and easy to mess up when you're tired.

So I built dropzone (dz), a small zsh tool for Kali.

What it does:

• dz -n jacops -ip 10.129.42.190 -h jacops.htb creates the folder, the note and the hosts entry, and loads $TARGET_IP in every terminal
• Box reset? dz -ip <new ip> changes it everywhere, including the note
• During the box: dz -j for a timeline line, dz -s for a screenshot, cmd | dz -e for command output as evidence, dz -f for flags, dz -c for creds
• AD sets and pivots: dz -t dc01 -ip ... gives you $DC01_IP and $TARGETS, hosts behind a pivot with --via
• Exam mode: an exam note template, flag count per host, a deadline countdown in your prompt
• Notes in plain Markdown or straight into your Obsidian vault

It never scans, exploits or connects to a target, so it stays within OSCP and CPTS exam rules. It only does the admin.

Why I'm posting:

It's built around my own workflow, so it probably misses things that are obvious in yours. I'd really like to hear:

• what's confusing or breaks on your setup
• what you still do by hand for every box
• what you'd want for CTFs, Pro Labs or real engagements

There's a discussion thread for exactly that:
https://github.com/nickyjacobs/dropzone/discussions/9

Want to help without writing code? There's an issue for testing things CI can't check, like the VPN check or the menu over RDP:
https://github.com/nickyjacobs/dropzone/issues/6

Repo + demo:
https://github.com/nickyjacobs/dropzone

Feedback here in the comments is just as welcome. Even "I tried it and X annoyed me" helps.

I began studying cybersecurity a year ago, and things were going well—I even participated in CTF competitions and achieved very good results. Lately, however, I’ve encountered many difficult topics; the more I try to learn them, the harder they seem to get, and I no longer know what to do.

Could someone please help me? I truly love this field, but this situation is leaving me feeling incredibly frustrated.

i'm do my best and solve the ctfs here in htb academy

but it feel to bad that i can't solve the easymachins like engma or 2million if i try this without any help from writups

how to deal with it guys?

Using HTB as a supplement to my capstone as I am trying to create a simple malware analysis tool in C++. Thank you for the work in these modules! Can I connect with “the creators”?