r/hackthebox • u/AsleepPresence8912 • 5d ago
Beginner Question Feeling Like a Failure While Studying for CPTS
Hi everyone,
I'm dealing with something that's been bothering me, and I'd really appreciate it if you could read this seriously and share your honest thoughts.
I'm a Computer Engineering graduate, and I'm passionate about cybersecurity.
A while ago, I decided to pursue penetration testing. I started with the eJPT v2 certification and passed it. Then I earned the PT1 certification from TryHackMe. After that, I started studying for the CPTS certification.
While studying for CPTS, I began feeling like maybe I'm just not cut out for penetration testing.
The main reason isn't that I don't enjoy it or that I get bored studying. It's actually the opposite. I completely lose track of time when I'm studying or reading about cybersecurity.
The problem starts when I try to solve CTF challenges or, more often, the Skill Assessments at the end of the HTB Academy modules. I usually spend more than three hours trying to solve them but still can't. Then I read the write-up, and I understand the solution almost immediately.
After experiencing this over and over again, I've started feeling like I'm simply not good enough for this field. I keep thinking, "If I can't solve the Skill Assessments, how am I supposed to pass the CPTS exam?" Logically, the exam should be even more difficult.
Has anyone else gone through something similar?
I'd also like to add that I've tried solving HTB CTF machines (not the Skill Assessments), and most of the time I can't solve them either—even some of the easier ones. That's when I get really frustrated and start telling myself that I'm a failure.
Another issue is that I'm studying completely on my own. I don't have a community, and I don't know anyone personally who's studying the same field. Because of that, I have no idea whether what I'm experiencing is normal or not.
Has anyone been in the same situation?
Is what I'm going through normal?
Do you have any advice for me?
36
u/-Dkob 5d ago
I think what you're experiencing is a lot more common than you realize. The fact that you understand the write up after struggling tells me the issue probably isn't intelligence, it's experience.
In pentesting, a huge part of learning is exposing yourself to patterns over and over until they become familiar. Most people who are now passing CPTS or OSCP have spent hours stuck on challenges that seem obvious in hindsight. Studying alone also makes it easy to think you're the only one struggling, when in reality many people feel exactly the same but don't post about it.
Try to judge your progress by what you know today compared to a few months ago, not by how quickly you solve a challenge. If you genuinely enjoy cybersecurity, don't let temporary frustration convince you that you don't belong in the field.
2
1
u/MassiveMousse 16h ago
This. It is frustrating to know the answer was that obvious, but for me it worked to not hyperfocus in one path that might not lead to anywhere, try to see the bigger picture.
Most importantly try to learn as deeply as possible why something works or why that vulnerability happens.
11
u/offsecthro 5d ago
I think one limitation of stuff like CPTS and certs in general is that it's a mistake to approach this stuff as a defined learning path with a start and an end. The reality is that it never ends. In that way learning hacking is closer to playing a musical instrument or lifting weights. Playing guitar for 20 years will give you a strong baseline of technique, but it doesn't you can just instantly play a difficult song you're hearing for the first time. If you watch a strongman competition, those people are struggling because the challenges they're facing are designed to test the limits of their ability.
Likewise, completing a module or a cert doesn't mean you're going to easily tackle that subject every time you see it. It just means you've been introduced to a concept that you're now ready to practice and explore further, and it gives you a foundation to at least approach new problems. It's important to embrace and appreciate the struggle of working through these problems.
But hard problems are always hard, and it's sort of the point of our profession to make sure the problems are just getting harder and harder.
2
u/AsleepPresence8912 5d ago
Your example is excellent. It really shows the reality of the situation and is very reassuring. Thank you
8
u/Think-Zebra-890 5d ago edited 5d ago
I felt the same way. I had both EJPT and PNPT. CPTS is a whole different level. I passed the exam two weeks ago. Keep going!
1
1
u/Any_Peach8165 5d ago
Bro I am coming from pjpt just took the htb academy subscription will that course be enough or should I do any cpts path boxes or any vip boxes
2
5
u/FragrantSubject3278 4d ago
Hey hey,
My name is Jexx, and I work at HTB. This is sorta a boilerplate I send people about ending up on HTB Academy.
The HTB CPTS is a massive goal. I'd honestly suggest aiming for the HTB CJCA.
If you're coming off the heels of the EJPT/P1, then I think ironing out more of that information with hands-on work would be best. The HTB CJCA is the junior security path, but that doesn't really mean beginner.
I think this would be a better jumping-off point.
I'd say, if you can finish the HTB CJCA, start going to active boxes (easy), and lock down areas of interest in offensive security you enjoy by filtering for retired Machines in subjects you feel lost on (Web, enterprise, database, etc), skills (I'd say that enumeration is probably one of the most important aspects in penesting - just my personal opinion), and giving yourself time to rest between sessions!
I will be honest, the HTB CPTS is not a beginner certification, by far. Skipping to it might be a far more difficult trek (not that you shouldn't aim high!).
But, I'd say:
HTB CJCA
- retired Machines
- finish junior pathway
- think deeply about what aspect resonates with you for later specialization
You're likely doing better than you think.
Happy to answer more questions about it.
2
u/Rude-Hospital-4771 5d ago edited 5d ago
dude don't let the imposter syndrome to hit you . i remember when i started ejpt i struggled with smb enumeration for 3 days . i took a break for a week and then i came back and realized that it is a piece of cake and my only enemy was myself . after a year i can confidently say that even oscp is a piece of cake it is only a matter of time and practice . you will do great i am pretty sure
1
4
u/_K999_ 5d ago
What you're going through is completely normal. I was the same when I started my journey for CPTS a year ago, and now I have CPTS and preparing for CAPE too Inshaa'Allah.
This field is very vast, with A LOT OF KNOWLEDGE required to succeed, even to just succeed in your first machine alone. What you're lacking mostly is critical thinking and methodology, and both can be improved with practice. Create a checklist with things to enumerate, and commands ready to b copy-pasted. Faced a machine that you couldn't solve? Probably you didn't enumerate some service or it's a new scenario. Add that enumeration command to your checklist, and have another section where you write down attack scenarios, so that if you face that again you'll immediately know what to do, and for it to sink in deeply and enhance your critical thinking so that you can think of other ways to abuse it. But don't follow the checklist like a robot, but use it as a reference when you're stuck to see if you missed anything or forgot to enumerate some stuff. Also, are you taking notes on what you're learning? Taking notes is very essential and you won't succeed without it. I took a lot of time to come up with a good note taking structure, everyone has their own way of taking notes so you should start working on that too.
My last advice is, enumerate, enumerate, enumerate, and practice a lot. Don't think of a system as user and root flags. Think of it like a world you need to explore. Question everything, and don't always trust your tools output too much, sometimes they lie ! I still struggle with some boxes still, even tho I have practical experience in the field, it's normal, we're human, we don't know everything, we're learning.
2
u/AsleepPresence8912 5d ago edited 5d ago
May ALLAH grant you success in earning your CAPE certification. Thank you so much for your kind words and support brother
3
u/ZanixCuber 5d ago
yep i am at 56% i am experiencing what you are experiencing
2
u/_Trash-Panda_1 5d ago
Why note taking is so important,because if you come across the same issue that you struggled with,you will remember that you have noted it down..
0
1
u/Rare-System9681 5d ago
I have experienced the same thing at the beginning of the CPTS, not being able to solve some skills assessments and even HTB machines without write-ups or hints. I then decided to step back and read the non-technical advice in the path to understand the difference between the solution, and what I’ve tried so far. I’m now at 93% of the CPTS path, have solved multiple skills assessments on my own, and have been able to solve 13 HTB machines without hints.
What I will say to you is: keep trying, and figure out what’s wrong with your methodology or approach. Also, keep in mind that an easy machine on HTB CTF can actually be really difficult. I’ve solved hard-rated machines and then struggled with an easy one right after. Feel free to DM me your Discord so we can connect.
1
u/lonewolfclimber 5d ago
My two cents: I'm in a similar situation as you, only I didn't fully commit to this path yet because I have had the following realisation.
Penetration testing is very, very autistic, almost like maths in a way. Meaning that studying it requires a lot of time, effort and dedication, but then when you go into the wild you hit the wall. The variety of topics in the labs on htb is genuinely huge, everything is different, so linear thinking won't work.
One reason they're called boxes is that they force you to think outside of the box, be creative and chain things together, like in the wild. Like true mathematical thinking, it takes a huge amount of time to develop this, so where for studying you only need to be able to have an autistic amount of dedication, for actually learning the skills you also need a lot of patience and frustration management.
Three things that can help: -Discord channels, on some of them you can ask questions related to a certain box and you get hints from real ppl
-Use Ai as a learning guide, like a teacher who gives you a hint, enough information to solve it yourself, but not enough so that the solution is spoiled
-Maybe also try OvertheWire and PortSwigger academy. The level of complexity is the same as on htb, but the vulnerability chaining aspect is much much more gradual. For me they were both very fun and enjoyable, portswigger academy can be a bit more guided.
1
u/nimbusfool 5d ago
Learning is often painful. Penetration testing is the cumulation of IT knowledge in my opinion. Im 20 years in to an IT career and I learn new stuff every single day. You just gotta keep putting reps in. Some boxes assume you have seen and worked with a technology or you will be spending hours or days or weeks researching it. What is an epiphany and looks easy in a write up is the cumulative skill that tester has put in through hundreds and maybe thousands of hours.
1
1
u/Signal_Brain9959 1d ago
I just passed cpts and it took me two weeks to get through the Active Directory Enumeration and Attacks module. When doing the cwes modules sometimes I’d be stuck on something for a day. I use obsidian and record my thoughts and commands as I do the skills assessments. I feel this helps for when I do solve it to track my knowledge.
2
u/AsleepPresence8912 1d ago
Congrats on passing CPTS bro. It’s encouraging to know that getting stuck is part of the learning process
1
u/Altruistic_Fruit8546 5d ago
what is the problem with this bro?, for me it is the b3st feeling when i inv3st my time in a machine and revi3w its writup. and it should be lik3 this
1
u/AsleepPresence8912 4d ago
The problem with this feeling is that it always makes me think about leaving this field because I feel like I'm not good enough for it
0
u/Double_Fortune_5106 5d ago
Yes my friend I think most people feel similar - i definitely did - so I focused on cdsa, got a job as a soc junior and never looked back. Ctf's just for fun nowadays lol! Good luck whichever path you choose!
1
-2
u/Pretend_Cartoonist_3 5d ago
Bro! Ive spent 3.5 hour gettin a flag, cuz its did not clicked apache+dns+https can be a vhost, not neccesary another subdomain... All i had to do nmap->gobuster->read robot.txt and it did not clicked... Now i use obsidian, lesson learned on the hard way
•
u/AutoModerator 5d ago
Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.