One piece of advice I'd give, study well, and after the path spend at least 30 days practicing. And above all, always use a methodology, alwayssss.
Also pay attention to blue team, don't underestimate it.
And report as you go, while you're finding things, it saves you time.
Recently passed the CPTS and since there's basically zero offensive security content in Greek, I made a full guide video in Greek. Posting the main takeaways here in English so this is useful to everyone:
Prep that actually mattered
- AEN blind Do the Attacking Enterprise Networks module without reading the questions. Spawn it and treat it like a real engagement. It's the best way to find gaps in your methodology and your notes. (The exam is not like AEN, but the mindset is.)
- Ippsec's unofficial CPTS prep list. Great for associate path techniques to real boxes.
- Dante & Zephyr. The exam is a network, not a box. These teach you to think in terms of pivoting and connecting hosts. Offshore is overkill for CPTS imo .
- Netexec and BloodyAd Learn those tools extremely well , they gonna save you a lot in the AD portion of the exam.
- Pivoting on its own ligolo-ng is a lifesaver, but know chisel/SSH/socat too for when it doesn't work as it should .Always have a backup options for all your tools.
Notes
- If you can't reproduce it in the report, it doesn't count. Write everything down like a walkthrough.
- Keep a separate tips & bugs file: skill assessment solutions, tool quirks, broken versions. It saves hours.
Report
- Most people don't fail because of the report. They fail by not getting 12/14 (enumeration, pivoting, time).
- But don't leave it for day 10. Write a full report before the exam if you want to for practice . SysReptor helps a lot.
Video (in Greek, chapters in the description): https://youtu.be/9acS\_M43nac?is=XOv-2qdixKFkK\_vi
Happy to answer questions in the comments, in English or Greek.
So after I already believed that I would never get a job in this field, at least in this market situation, I got an email from a company I applied to through the “Easy Apply” feature that I even forgot I applied for.
And then they started saying that they saw my resume and thought I was a good fit and stuff.
Then they asked me to solve a technical challenge, and I delivered it way before the deadline.
Then they said sorry, they needed me to solve an additional challenge.
And it was so much harder, and it took a lot of time from me, but I still delivered it way before the deadline.
And then they were happy and gave me good feedback that I was able to solve these hard technical challenges. They told me all the files were correct and everything was good, but they just needed a write-up explaining the steps I took to solve it!
And I did the write-up, and everything was explained, and I told them if they needed me to clarify any step, I was happy and ready to clarify it!
Then they came back to me after a couple of days and basically just said sorry, they don’t think I’m a good fit, without even giving any feedback!!
And I was likeee in my mind, what?? Really?? Are you serious???
After I spent days solving your hard technical challenges, and you confirmed that everything was good, and you gave me good feedback, and you haven’t even done any interview with me, and now you just send me a message saying I’m not a good fit without even giving any specific feedback??
I really feel we should get paid for the time we spend on technical challenges and interviews because it takes days from our time and life, so employers can take us more seriously rather than just playing with our feelings and hope!
When someone meets me and knows that I have done a degree in cybersecurity and tells me, “OMG, I want to get into the field,” at this point I don’t know what to tell them because if I say it’s hard and getting a job is so hard, they will think I’m a gatekeeper, but it’s just sad how it is now!
So now, honestly, I feel with this joke of a market and crazy employers, I would like to say to anyone who is looking for a job that we are really cooked…
Rather than chasing and trying to find just a job and letting employers move us like chess pieces, we should try to consider another field that could possibly be much better, or we open our own businesses!
I also would like to thank my family for supporting me in this journey. Otherwise, I would probably be working at a fast-food place for minimum wage right now!
I don’t know what I will do next in my life, but I really got enough from this field, and I don’t want to lower myself anymore or feel like I’m begging just to get a job.
This life is unfair, and thank you!
I passed on 19 August with 90 points, first attempt, 1 month and 25 days after I started preparing. I had passed the HTB CPTS two weeks before that, which shaped a lot of this and is probably the most useful context for anyone here deciding between the two.
I wrote the whole thing up because when I was preparing, almost every review I found stopped at "the labs are great, the exam is hard, trust the process." I needed the order. Which machines, in what sequence, what to read in the course and what to skip, which challenge labs and why that order.
Short version of the path:
75 Proving Grounds machines in 24 days. LainKusanagi list first, then TJ Null to fill the gaps. Five a day as a ceiling, not a target, because the point of that phase is the note, not the flag.
I did all Linux first, then all Windows, then AD last. This is the contrarian bit. Doing one OS in a long block is what turns enumeration from a checklist you read into something your hands do. I put AD last only because CPTS had already made it my strongest area. If you are not coming from CPTS, flip that and give AD the biggest block you have.
The PEN-200 text in 5 days, skipping the videos entirely. That was only possible because I already had CPTS notes covering most of the syllabus. My course progress bar said 36.3 percent on exam day.
9 challenge labs in 10 days: Secura, Zeus, Poseidon, Laser, MedTech, Relia, then OSCP A, B and C. A, B and C are closest to the exam in shape but not in content, and skipping the first six to rush them is the most expensive shortcut available.
Two honest admissions. I did not take A, B or C blind and timed, because I was on a compressed schedule and chose speed. I think that is directly why I burned five hours on my first exam machine. And I wrote no challenge lab reports, which was only safe because I had just written a 189 page CPTS report.
Exam day, the part worth reading:
I went at the AD set first and hit a wall for five hours. Zero points. The cause was not a hard machine, it was me running CPTS brain, building theories and chaining ideas because I assumed the answer had to be sophisticated. I took a 15 minute break, came back, decided to stop being clever, and ran the simple enumeration I should have run at minute ten. The whole AD set fell in the next 35 minutes.
That is the single thing I would tell anyone coming from CPTS. The OSCP rewards the boring answer. Try the documented exploit for the version in your nmap output before you build anything.
After that I sorted the standalones by open port count and started with the fewest. Smaller attack surface usually means a more focused intended path. User and root on the first in an hour, then user only on the other two, then back around for one more root. 90 points at about 3:30 AM, then I slept, verified evidence in the morning, and stopped.
One more thing that nearly cost me everything. During the report window I left my VM running and stepped out, and a driver issue restarted my Windows host. Every terminal and tab gone. I lost nothing, because every flag went into Notion with its screenshots the instant I got it, not at the end of the machine. If you take one habit from this, take that one.
Tools that earned their place: Ligolo-ng for pivoting, NetExec for the AD set, BloodHound CE rather than the legacy build, and more than one privesc tool because WinPEAS misses things that SharpUp and PowerUp catch.
Report was 68 pages, written in SysReptor using their OSCP template.
Full writeup with the dates, the lab order, the exam hour by hour and the screenshots:
https://medium.com/@hydra007/how-i-passed-the-oscp-with-90-100-in-1-month-and-25-days-straight-after-cpts-fa2122edea76
And the CPTS one that came before it, if you are weighing that path:
https://medium.com/@hydra007/how-i-passed-the-htb-cpts-with-a-perfect-100-100-on-my-first-attempt-736226738cde
Happy to answer anything in the comments.
Man, that was not an easy exam. The first question had me tripping, and I spent hours falling down rabbit holes thinking I had the right answer when I didn't.
I'll be completely honest, I used Al to help guide me out of a few dead ends when I got stuck, but a win is a win. Huge weight off my shoulders. Time to start the OSCP grind!
backupprep.ps1) runs with administrator privileges every 2 minutesread and write access to this script, which allowed us to modify itjohn to the administrators groupjohn was successfully added to the administrators groupWhat kind of attack is this?
Its not Privilege Escalation
Its not Task Manipulation
Its not Script Injection
Its not Task Hijacking
What is it?
I just made an account on htb and started out with 'Meow'. I read the documentation/write up and used Claude to help me break it down and understand it better especially on the networks and ports. I'm on the journey of transitioning from a scriptie to a ctfer or pentester hopefully 🤞🏾.
Any tips and tricks or pitfalls I need to know?
Help a brother out 👊🏾
Hey everyone,
Tired of tracking CTFs and 24h exams across messy spreadsheets and scattered notes?
I built ZEROBOX — a fast, local-first operational cockpit for OSCP/CPTS prep and CTFs.
It’s 100% free, MIT open-source, and runs completely offline in your browser (no accounts, zero telemetry).
Quick highlights: • 920+ Preloaded Labs: Instant offline search for HTB & THM targets with tags. • Attack & Pivot Graph: Visually map compromised subnets (exports to Obsidian .canvas). • 24h Exam Cockpit: Pacing engine, bio-break timers, and 1-click Markdown reports. • Evidence Vault & Playbooks: Track hashes/creds on a kill-chain timeline + offensive field manual. • Global Quick-Bar: Propagate LHOST/RHOST automatically across all payloads.
🌐 Live web: https://ctftracker.com/#/tracker
⭐ GitHub (MIT): https://github.com/0xdnd/ctf-tracker
All data stays in your local browser storage. Feedback and PRs are welcome!
Would love feedback or feature requests from the community!
Has anyone else had difficulty canceling a sub or changing payment details on HTB. So frustrating that this is not so straightforward.
Rule: Move from left to right. Ask: "Does this value fit into the remainder?"
128 ≥ 192? ✅ → 1 → remainder = 64
64 ≥ 64? ✅ → 1 → remainder = 0
32 ≥ 0? ❌ → 0
16 ≥ 0? ❌ → 0
8 ≥ 0? ❌ → 0
4 ≥ 0? ❌ → 0
2 ≥ 0? ❌ → 0
1 ≥ 0? ❌ → 0
Result: 1100 0000
| State | Binary | Decimal |
|---|---|---|
| Minimum | 0000 0000 | 0 |
| Maximum | 1111 1111 | 255 |
I cant seem to login to the thingy. Its asking for an input access key event, which im not sure how to get.