Certified Penetration Testing Specialist (CPTS / PNPT)
Demonstrate mastery in practical, real-world penetration testing methodologies, open-source intelligence (OSINT), external network penetration, internal Active Directory exploitation, lateral movement, and commercial report writing.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The Certified Penetration Testing Specialist (CPTS by Hack The Box) and Practical Network Penetration Tester (PNPT by TCM Security) are premier real-world, hands-on certifications simulating commercial corporate penetration tests.
PNPT provides 5 full days (120 hours) of continuous lab access followed by 2 days for report writing and a 15-minute live executive debrief. CPTS provides 10 days of lab access followed by 2 days for reporting.
They eliminate artificial capture-the-flag (CTF) puzzles. Candidates must conduct realistic reconnaissance, gain external footholds, pivot through internal Active Directory networks, and deliver professional commercial reports.
Domains include: (1) Open Source Intelligence (OSINT), (2) External Network Penetration Testing, (3) Internal Network Penetration Testing, (4) Active Directory Exploitation, and (5) Report Writing and Executive Debrief.
LLMNR/NBT-NS Poisoning (Responder), AS-REP Roasting, Kerberoasting, BloodHound graph analysis, SMB Relay, Pass-the-Hash, GPO exploitation, Token Impersonation, and Domain Controller compromise.
Candidates perform reconnaissance using search engines, LinkedIn, GitHub, breach data, and Shodan to identify employee emails, exposed credentials, external infrastructure, and phishing targets.
When DNS fails to resolve an internal hostname, Windows broadcasts LLMNR/NBT-NS queries. Responder answers these queries, poisoning the response and capturing NTLMv2 challenge-response password hashes.
SMB Relay captures NTLM authentication from one machine and relays it to another target machine to execute commands (e.g. via Impacket ntlmrelayx). It succeeds when SMB Signing is disabled or not required.
Chisel, Ligolo-ng, Proxychains, SSH port forwarding, and Socat to route traffic through dual-homed compromised hosts into private corporate subnets.
Candidates deliver a live 15-minute video presentation to a board of assessors simulating client executives, explaining technical findings, business risk impact, and prioritized remediation strategies.
Inadequate enumeration, rabbit holes, poor note-taking, failing to compromise the final Domain Controller, or submitting an unprofessional report lacking reproduction steps.
Penetration testers, security consultants, ethical hackers, red teamers, and SOC analysts seeking validation of real-world corporate network penetration testing capabilities.