I want to do following paths only:
Pentester
web pentester
Senior web pentester
I am not interested in other paths right now. i don't decided yet for certifications.
which subscription should i take? monthly or yearly or cubes only? silver or gold or platinum?
I got it for $250 (my brother contributed the rest) but a couple of my frnds said that all the pro labs could have been done in 2-3 months and 250 wasn't worth it? (For context I'm a full time student so not working, and already have crtp and crto) I didn't spend 250 for any exam. Cos i feel like labs teach me more than the courses and I'm already doing maldev by WKL.
Was this 250 spent well or not worth it?
Not been a good day, takes like an hour and multiple attempts, am I the only one? Thanks
I’ve been experimenting with supervised AI-assisted pentesting in authorised lab environments, and I’m curious how people here think it should fit into platforms like Hack The Box.
There’s obviously a big difference between:
“Explain why this HTTP response is interesting”
and
“Here’s the target — enumerate everything, exploit it and give me the flag.”
The second might get you a solve, but I’m not convinced it teaches you much.
What I’ve found more interesting is using an agent almost like a structured pentesting partner:
- keep track of observations
- turn them into hypotheses
- suggest the cheapest useful test
- preserve command output and evidence
- challenge assumptions when a path goes nowhere
- require an actual verification step before calling something vulnerable
But leave the human responsible for understanding why each test makes sense.
That feels closer to the methodology HTB tries to teach, particularly in paths like CPTS where enumeration, evidence and reporting matter just as much as running the exploit.
I also think there should be a hard distinction between assistance and spoilers.
For active boxes/challenges, an AI system shouldn’t have access to walkthroughs, leaked solutions or previous solve data any more than a human learner should.
So I’m curious:
Where would you personally draw the line?
Would you use AI for:
- explaining tool output?
- maintaining notes?
- suggesting hypotheses?
- generating commands you then review?
- automating enumeration?
- exploitation?
- reporting?
And at what point do you think it stops helping you learn and starts solving the box for you?
No active-box spoilers please.
Please don't mind me for this little excitement today. I successfully retrieved the key from the lab without any hints. The optional exercise was difficult and delayed my study schedule by a day. However, for a non-red teaming member in this field, this is a big step for me.
I will try making it quick .. I'm Looking for people on the same HTB path
I’ve completed the CPTS path and I’m currently working through CJCA and CWES. I’m looking to connect with others who are on a similar path and want to learn and improve together.
I’ve created a small Discord server (https://discord.gg/EzFarPnXVB) where we can:
- Discuss HTB machines and challenges
- Share approaches, resources, and learning material
- Work through CTFs together
- Participate in HTB seasonal machines
- Help each other when we get stuck
- Stay consistent and keep progressing through the paths
The goal isn’t just to have another Discord server, but to build a group of people who are genuinely interested in learning and improving together.
I will finish CPTS path by the end of the month and i wonder about the 14 exam flags is it gonna be related to each other and it must be finished before continuing or you can skip them ? (I am willing to skip number 8 hhh)
my second question is does the skills assessments enough to pass the exam ? I am willing to take them again as my final prep bc someone told that these would be enough
Hi , i am currently studying for the cpts and i am wondering if i could get a job after i pass the cpts exam, so could you tell how did you get your first pentesting role and if you actually had a prior job experience in any it role .and i heard from people that it is “impossible “ to get a job as a junior pentester so you need to get an it job first like IT help desk and then climb your way to a penetration testing role , is this right?
Note: i am 17 years old and i live out of the us and i have some experience in bug bounty.
Hello, everyone! I'm working through the SQLi section. In the first lab, I'm asked to connect to a database. I go to Pwnbox, type `mysql -u root -h <target ip> -P <port> -p`, press Enter, and enter the password, but after I enter the password, Pwnbox freezes. Please help me solve this problem—I'm really eager to move on.
Hi, i am beginner, i started later in other platforms , but i need to begin use the platforms and need tutorials.for.the CTF and how can i begin solve it
My question is pretty simple about the cpts exam. What I know about the exam is that I have to take 14 labs(or just flags?) in 10 days and they are kind of connected(not sure how much though). Without factoring in the time limit or the number of flags to gather how hard is each flag to get compared to HTB boxes where you have to get the user and root flag. Are they like easy/medium difficulty boxes by themselves or are they more comparable to the hard/insane boxes?
I am doing both academy modules and seasonal HTB at the same time while also taking notes on CPTS modules and wonder if I should attempt to take the exam only when I can consistently do boxes of a certain difficulty level.
Edit: boxes have submission guidelines for each difficulty. To make it more clear I am asking based on mostly those guideline.
So i was trying to get the flag for the med lab of nmap enumeration IDS IPS evasion and no matter waht i try i dont seem to understand why i am not getting the flag. The flag was supposed to be the version of the domain service running on port 53. TCP was closed so had to try UDP which showed the version being "NLnet Labs NSD". The flags i used were "sudo nmap -p53 -sUV -Pn -n --disable-arp-ping --source-port 53 10.129.152.83 -S 10.129.152.80 -e tun0". Now idk what ts is supposed to mean but maybe im missing something. Please dont mind my english im on 4 hrs of sleep and im solving ts after 3 hr college lecture.
How did you guys prepared and How long did you guys take to OSCP? Also need some advise on career in cybersecurity and penetration testing.
I’m currently studying for the HTB CPTS and working through the modules. I’ve also done a decent amount of CTFs and have some hands-on experience from them.
For anyone who has already completed and passed the CPTS, did it actually help you get a job?
I’m wondering what kind of entry-level roles I could realistically apply for with CPTS + CTF experience, but without much professional experience. Would junior pentesting roles be realistic, or should I also look at SOC/security analyst positions?
I’d also like to know whether CPTS is enough to get interviews ?
So back in June 2025, I started my journey at the academy by taking CBBH, then CWEE, and finally I recently finished CPTS after them. (I only took the job role path I haven't taken the exam for any of them yet.) I solved almost all skill assessments blindly without looking at solutions and took notes for each course. After finishing all of these courses, I really felt confident, like I could conquer any system in front of me. Then I decided to start on the main app and solve some boxes and challenges.
In my first week, I only took 5 machines and 2 challenges (all of them had Very Easy or Easy difficulty and were Linux based), and I COULDN'T SOLVE ANY OF THEM without looking at the writeup. Even though I had my notes to use, it felt like I was just looking at some useless bullshit, because used to copy paste most of the text in each module.
I usually do fine with the foothold (since all of the easy machines rely on CVEs) and get a shell, but doing privilege escalation feels so hard and forces me to spend at least 1–3 hours on a machine.
Even when I take a look at the writeup, sometimes it ends up being a technique that I already know, which makes me so mad because I wasted my time on something I could have done way earlier.
In the last few days, I decided to watch more IppSec videos to improve my methodology, and I think it helped a little bit, but I still could not solve a machine all by myself.
It is really frustrating, and I am feeling like I just wasted my time taking the courses and ended up not being able to apply most of the things.
Have any of you guys experienced this? if so how can overcome it ? It is so annoying, I almost broke my laptop because of it.
Hey guys,
I'm gonna take my CPTS exam probably October or November, depends on how I get off time from the SOC.
My question would be like, how hard is the web content in the CPTS exam, I mean, ye they'll ask you a lot probably from the curriculum... The only problem of mine is that I'm kinda bad at web pentesting, and I can play the easier plays like IDOR, basic SQLi etc... But on the trickier ones for example the verb tampering from the AEN is like hard for me...
I'm pretty good at AD territory like I taken on Rastalabs kinda easily for example, I was handling good in Zephyr also, so my question is like can I take on the CPTS with this skill set or should I just skip it and just let it be?
I just need context about the hardness of the web part. After the foothold i'm probably good to go with the AD stuff etc. I know it's ain't right but ye i'm not good in the web content at all
Hello community, I passed CDSA a couple days ago and I am wondering which path to take on next. My background: I am a cybersecurity student in Europe and will be graduating next year, I have never worked in security related jobs but I did worked as Software Dev for about 1 year before. After graduation, I want to land a blue team job, likely a SOC L1 or a SecOps position, which of these certs can help me stand out for? Or maybe any other recommendations? I find these two certs cheapest and most affordable, can I skip CCDL1 and take CCD instead?
Hello everyone,
I have tried to pass the exam before the revamp but I didn't find the time to do a 2nd try to complete it, so this is technically my "second attempt" on the exam.
I am planning on starting it today. If anyone is interested in embarking on the journey with me, do ping me. I'll give a feedback at the end.
I have been doing the Pentester path - right now I'm on the shells and Payload section - the final assessment, and I've run into some problems.
During my first try, it worked fine - but I couldn't complete it as I couldn't figure it out. But during my third try with the box, RDP wasn't initially connecting. After restarting the server, the RDP worked but gets on disconnecting.
During my fourth it was better but after 30 mins it started getting disconnected again. Combined with that and the fact that the machine is extremely slow I'm having a really difficult time. I didn't even know the machine had a browser until I checked the forums/walkthroughs because there wasn't anything listed on the menu.
Has anyone run into these same issues? I assume that the issue is because too many people are connecting to the same machine and it's nothing from my side - is my assumption correct, is there any solutions?
Thank you!
So i have finished CJCA job role path. I wanted to explore the web side.
What cert/path should be my next target, considering i just finished CJCA and want to start web exploitation?