> For the complete documentation index, see [llms.txt](https://divyeshs-organization-1.gitbook.io/cpts-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://divyeshs-organization-1.gitbook.io/cpts-cheatsheet/readme.md).

# Home

A comprehensive penetration testing cheat sheet built for **HTB Certified Penetration Testing Specialist (CPTS)**, **HTB Pro Labs** (Dante, Zephyr, Offshore), and **CTF** competitions.

## Categories

| Category                                | Description                                                                       |
| --------------------------------------- | --------------------------------------------------------------------------------- |
| **Enumeration / Information Gathering** | Network scanning, service enumeration, web recon, AD enumeration                  |
| **Pre-Exploitation**                    | Password attacks, hash attacks, relay/coerce, shells & payloads                   |
| **Exploitation**                        | Web attacks, AD exploitation, database attacks, CVEs, buffer overflow             |
| **Post-Exploitation**                   | Privilege escalation, persistence, credential dumping, pivoting, lateral movement |
| **Methodology**                         | Step-by-step penetration testing methodology and checklists                       |
| **Tools & Utilities**                   | Metasploit, Mimikatz, PowerShell, CrackMapExec, BurpSuite, deployment tools       |
| **Other**                               | Evasion/bypass, kiosk escape, AS/400, red team initial access, MITM               |

## Quick Start

Use `Ctrl+K` or GitBook search to find specific commands, tools, or techniques fast during your exam.

## Sources

Compiled from 230+ cheat sheet files covering Active Directory, web exploitation, privilege escalation, pivoting, red team operations, and more. Includes techniques from HTB Pro Labs (Dante, Zephyr, Offshore), 35 HTB retired machine walkthroughs, 66 Active Directory attack guides, 23 red team operation notes, and eJPT/eLearnSecurity study notes — all sanitized for general use with no lab-specific data.