Introduction

In the past 6 months, I have been working on and achieved 3 certifications related to offensive security. The 3 certifications are Certified Penetration Testing Specialist (CPTS), Certified Bug Bounty Hunter (CBBH), and Certified Red Team Operator (CRTO) from HackTheBox and Zero-Point Security. This blog post will be detailing my experiences through these certifications and as a comparison.

CPTS

The Certified Penetration Testing Specialist (CPTS) certification was the first certification I achieved. The certification was a great introduction to pentesting web and network applications.

Several months prior to beginning to study for this certification, I was really hooked on the idea that the OSCP certification from OffSec was the “best” and most highly-recognized certification. However, as I have been told by many people in the HackTheBox community and my friends I have networked with, the OSCP certification was too expensive to be worth and it would be better to get it compensated for while I work. Another reason was because I have been working on HackTheBox realated materials for a while now (Machines, CTFs, Pro Labs), and comparing to the OffSec materials of the same kind, the HackTheBox ones seemed to be much more insightful rather than just simple information I should memorize. On that note, the experience and the security-related events shared by the authors of the certification and HackTheBox Academy made CPTS stand out much more to me and made me start learning it.

The process of studying for this certification took me ~3-4 months as I had other obligations like school and clubs alongside it. From my perspective, if someone were a total beginner and spent ~8-10 hours a day studying for the exam, ~3-4 months is definitly doable. For someone who already has prior security experience, especially in offensive security, putting in ~8-10 hours would take them ~1-2 months to study for the exam. There are many modules such as Port Forwarding or Active Directory that include many topics and will take a much longer time to study than others, but pushing through the topics feels insanely rewarding.

For the exam itself, CPTS spanned 10 days long, where the participant needed to exploit several machines to obtain flags, and write a commercial-grade report alongside to prove they have truly understood what it takes to become a pentester.

CBBH

CRTO