Hack The Box

How Hack The Box grades your exam report

Applies to CPTS, CDSA, CBBH, CWEE, CJCA.

What the CPTS, CBBH, CDSA and CWEE report has to contain — a client-ready commercial deliverable, not an exam answer sheet.

CPTS: 10-day window
CDSA: 7-day exam
CBBH: 7-day exam
CWEE: 10-day window
CJCA: 5-day exam

Hack The Box asks for something different from OffSec. OffSec wants a document that proves reproducibility to a marker. HTB wants a document you could hand to a paying client without editing it first.

That difference decides everything about how you write it.

The standard

A commercial penetration test report. Two audiences in one document: an executive who needs to understand business risk in two pages, and an engineer who needs to reproduce and fix each finding. Write for both, in that order.

If your report reads like exam homework — “I then ran nmap and found port 445 open” — it is the wrong document, however technically correct.

Structure

Executive summary. Non-technical. What was tested, what you found, what it means for the business, what to do first. No tool names, no CVEs, no jargon. A board member reads this and nothing else.

Scope and methodology. What was in scope, what was not, when you tested, what standard you followed.

Findings, each with:

A plain-language title describing the issue, not the tool that found it
Severity, with the reasoning behind the rating rather than a bare label
Affected hosts and services
Reproduction steps with evidence
Business impact — what an attacker gets, in terms the client cares about
Remediation that is specific and actionable

Attack path narrative. How the individual findings chained into a full compromise. This is what separates a good report from a vulnerability scan export, and HTB weight it accordingly.

Appendices. Raw output, full command logs, supporting evidence.

Severity ratings

Rate on impact to the business, not on CVSS alone. A medium-severity issue that completes your path to domain admin is a critical finding in context, and saying so — with the reasoning — is what a client is paying for. An unexplained “High” label is worth less than a “Medium” with a paragraph of argument behind it.

The time split

CPTS gives ten days: five for the practical, five for the report. CBBH and CDSA run seven days hands-on plus three to write. That is a genuinely large writing window, and it is there because the deliverable is genuinely large.

Use it. A ten-day exam where you spend nine days hacking and one day writing is a failed exam with good notes.

What fails

An exam answer sheet. Findings listed in the order you found them, with no narrative and no client framing.
Copied remediation. “Apply vendor patches” tells a client nothing. Name the setting, the version, the configuration change.
Evidence that proves nothing. A screenshot of a terminal with no context, no command visible, no host identified.
No executive summary, or one full of tool names.