Certified Penetration Testing Specialist:

A Personal Comment:

So after i changed platform from TryHackMe to HackTheBox I decided to go through their academy to become better at cybersecurity.

Even though I did complete the Jr. Penetration Tester Path on TryHackMe I have decided to go through all the modules of CPTS Certification Path and maybe take the certification exam.

I’ll update this post as i progress through the modules.

Certification Description:

HTB Certified Penetration Testing Specialist (HTB CPTS) is a highly hands-on certification that assesses the candidates’ penetration testing skills.

HTB Certified Penetration Testing Specialist certification holders will possess technical competency in the ethical hacking and penetration testing domains at an intermediate level.

They will be able to spot security issues and identify avenues of exploitation that may not be immediately apparent from searching for CVEs or known exploit PoCs. They can also think outside the box, chain multiple vulnerabilities to showcase maximum impact, and actionably help organizations remediate vulnerabilities through commercial-grade pentesting reports.

Path Description:

The Penetration Tester Job Role Path is for newcomers to information security who aspire to become professional penetration testers.

This path covers core security assessment concepts and provides a deep understanding of the specialized tools, attack tactics, and methodology used during penetration testing. Armed with the necessary theoretical background and multiple practical exercises, students will go through all penetration testing stages, from reconnaissance and enumeration to documentation and reporting.

Upon completing this job role path, the student will have obtained the practical skills and mindset necessary to perform professional security assessments against enterprise-level infrastructure at an intermediate level. The Information Security Foundations skill path can be considered prerequisite knowledge to be successful while working through this job role path.

The student will go through the following 28 modules:

• Penetration Testing Process ( Completed )
• Getting Started ( Completed )
• Network Enumeration ( Completed )
• Footprinting
• Information Gathering - Web Edition
• Vulnerability Assessment
• File Transfers
• Shells & Payloads
• Using The Metasploit Framework
• Password Attacks
• Attacking Common Services
• Pivoting, Tunneling, And Port Forwarding
• Active Directory Enumeration & Attacks
• Using Web Proxies
• Attacking Web Applications With Ffuf
• Login Brute Forcing
• SQL Injection Fundamentals
• SQLMap Essentials
• Cross-Site Scripting (XSS)
• File Inclusion
• File Upload Attacks
• Command Injections
• Web Attacks
• Attacking Common Applications
• Linux Privilege Escalation
• Windows Privilege Escalation
• Documentation & Reporting
• Attack Enterprise Networks

Penetration Testing Process:

In this module, we learned about the entire penetration testing process, how it is created, its essential components, and how it is divided into the corresponding stages. This will make it very easy for us to find our way around each stage as we follow the process and quickly find out which parts of the process we need to work on to improve.

Module Key Takeaways:

• Penetration Testing process overview
• Preparation for a penetration test
• Contracts and their components
• Handling meetings with clients
• The structure of information gathering
• Vulnerability Assessments and the analysis process
• Exploitation components and prioritization
• Steps from the internal network of the company
• Steps of the Lateral Movement stage
• Proof-of-Concept
• Finishing the penetration test
• Practicing

Badge of completion - Tactical:

Getting Started:

This module covered the essentials for getting started in penetration testing and on the HTB platform. We completed a skills assessment consisting of attacking our first box without a guide.

Module Key Takeaways:

• An overview of penetration testing
• Penetration testing distros and note-taking
• An overview of common terms and technologies
• An introduction to scanning and enumeration
• Using public exploits and shells
• Basics of file transfers
• Privilege escalation primer
• Navigating the HTB platform, getting help, asking questions, and common pitfalls
• Completed our first two boxes (one guided and one without a guide)

Badge of completion - Your first battle:

Network Enumeration with Nmap:

In this module, we covered the ever-important network enumeration and scanning tool, Nmap. We covered basic tool usage, working with scan results, extending the tool with the Nmap Scripting Engine (NSE), and evasion tactics. We completed various practical challenges and a skills assessment to reinforce the various topics introduced throughout the module.

Module Key Takeaways:

• A strong grasp of key techniques for network enumeration using Nmap
• Host discovery, port scanning, service enumeration, and operating system detection
• Working with saved Nmap scan results
• Evading network defenses to obtain accurate scanning results

Badge of completion - The eye that sees all:

Footprinting:

In Progress..