HTB's CPTS Reclassification

[smurfhunter]

I have been studying (with intent to take) the CPTS course for the last few days. My understanding of the certification is that it is close to content equivalent to the OSCP. While the OSCP's recognition remains above it, the difficulty appears to be close the community's opinion - not necessarily 1:1, but close to it. Some sources will argue it's easier and some will say harder - it might be due to the luck of the draw during the exam. I am not shelling out $1700 to start the OSCP as well any time soon, but a couple community sources to reference are as follows:

https://0xfa7e.github.io/post/cpts-vs-oscp/

https://lim8en1.medium.com/getting-certified-my-thoughts-on-oscp-and-cpts-81b3a6235a8a

Great insight in this thread: https://www.reddit.com/r/oscp/comments/1avnd1m/how_is_oscp_different_to_cpts/

While the experience on the ladder might not be worth adjusting much (I feel that one or two notches higher would be reasonable, given its difficulty equivalent to the OSCP), the certification should be expanded laterally to cover "exploitation," in my opinion. In the first module, the exam elaborates with some of the following verbiage to indicate it explicitly covers exploitation:

The path's modules 18-21 ("password attacks," "attacking common services," "pivoting, tunneling & port forwarding" and "active directory enumeration & attacks") indicate a scope significantly focused on exploitation.

Further, web exploitation is explicitly noted in modules 23 and 25, "attacking web applications with ffuf" and "sql injection fundamentals" along with the sections adjacent to them indirectly supporting web exploitation.

Exploitation also appears to be ingrained into the content of the course as it goes out of its way to cover the full scope of an engagement, from pre-engagement to post-engagement, and indicates as such:

Modules "documentation & reporting" and "attacking enterprise networks" indicate the certification and labs associated go beyond the scope of exploitation and into post reporting and full coverage.

Due to the above, I feel the CPTS should at least be expanded to cover "exploitation" as well as "penetration testing" like the OSCP does, but I feel some level of increase in difficulty may be suitable for the content as well. The seemingly universal recommendation to start with the CPTS so you can steam roll the requirements and labs of the OSCP is becoming more common in the field, and I believe its status should be indicated as such.

Edit to add to this: I feel it might be worth noting that this certification is also practical and doesn't expire, similar to how the MCD notes on its certification status.

[smurfhunter]

I would like to add more to this and feel it's worth another comment - from what I can tell, this is consistently gauged as harder than the PNPT.

Given the exam was created in September 2022, and it is gaining recognition fast, I feel that putting it in line with the PNPT would be a fair placement - it shouldn't be below it.

https://www.reddit.com/r/hackthebox/comments/18hzw9g/cpts_vs_oscp/
https://www.reddit.com/r/hackthebox/comments/1122vb0/ejptv2_vs_cpts_vs_pnpt/

Finding citations outside of reddit and discord are a bit more difficult for this one since the PNPT is also less common, but it seems there is a community agreement that the PNPT is equal or below the CPTS, even if HR recognition isn't quite there yet.

Would also like to cite another person I have found who has passed the OSCP and then the CPTS after who says the CPTS is a more challenging and comprehensive exam: https://www.youtube.com/watch?v=UN5fTQtlKCc

If having someone who can cover all the content of both certifications to better rank them would be desirable in the future, I could potentially do that down the line, but I am one person and that would take me months to reliably do.

Here are the spots I would say most accurately suit the certification - it should definitely cover exploitation regardless.