My pt1
Hello everyone! ~
After my experience with the eJPT, I decided to challenge myself with another practical penetration testing certification: PT1 (Practical Pentesting) by TryHackMe.
In this post, I'd like to share my thoughts about the exam, its difficulty, and a few things I wish I had known beforehand. I won't be sharing any specific vulnerabilities, exploitation paths, or flags, so don't worry about spoilers!
You can find some room I played to do this certification here
Exam Overview¶
The PT1 is a hands-on penetration testing exam with 48 hours available to complete the assessment. I completed the PT1 exam in approximately 10.5 hours of actual work, spread across two days, including exploitation and report writing.
Unlike certifications based on multiple-choice questions, the PT1 requires you to perform an actual penetration test against a simulated environment, identify and exploit vulnerabilities, collect flags, and document your findings in a professional penetration testing report.
The exam covers three main areas:
- Web Application Penetration Testing
- Network Penetration Testing
- Active Directory Penetration Testing
Each section tests different skills, making the exam a fairly complete introduction to real-world penetration testing engagements.
One thing I particularly appreciated is that finding a vulnerability isn't necessarily enough. You also need to demonstrate its impact, understand how it can be exploited, and explain how it should be remediated.
Difficulty – Not All Sections Are Equal¶
This was probably the most interesting aspect of the exam for me.
Network Penetration Testing¶
Personally, I found the Network section quite straightforward.
If you have experience with TryHackMe or Hack The Box machines, especially those involving enumeration, exploitation, and privilege escalation, you should feel comfortable with this part.
The vulnerabilities were reasonably easy to identify, and the exploitation paths were relatively intuitive once the initial enumeration was completed.
I wouldn't say this section was particularly challenging for someone who already has some hands-on experience.
Active Directory¶
Surprisingly, I also found the Active Directory section easier than expected.
Despite involving more concepts and requiring an understanding of how different systems interact within a Windows domain environment, the overall exploitation path felt quite logical.
Having a solid understanding of Active Directory enumeration, privileges, authentication, and lateral movement definitely helps.
I think the most important thing here is not to rush. Take your time to understand the environment, identify the relationships between systems and users, and build a clear picture of what is happening.
Web Application Penetration Testing¶
This was definitely the most challenging section for me.
Unlike Network and Active Directory, where the exploitation paths felt more straightforward, the Web Application section required significantly more investigation, experimentation, and patience.
Some vulnerabilities are not immediately obvious, and simply running automated scanners won't necessarily get you very far.
You really need to understand how the application works, how its different features interact, and whether the expected behavior matches what actually happens on the server.
I spent considerably more time testing different scenarios, analyzing HTTP requests and responses, and trying to understand the application's business logic.
In my opinion, this section requires a different mindset: rather than just looking for known vulnerabilities, you need to think about how the application was designed and what could go wrong.
If you're preparing for the PT1, I strongly recommend spending extra time practicing Web Application Penetration Testing, especially manual testing.
A Few Things Worth Knowing¶
There are a couple of things that I think are useful to know before starting the exam.
Flags Are Obtained Through Exploitation¶
One thing I appreciated about the PT1 is that flags are generally obtained by successfully exploiting vulnerabilities.
This means that simply identifying a potential security issue is not always sufficient. You need to demonstrate that the vulnerability actually exists and can be exploited.
Sometimes you may identify unexpected behavior, but that doesn't necessarily mean you've found the intended vulnerability.
My advice is to focus on understanding the underlying issue rather than blindly trying different payloads in the hope that something works.
Not Everything Will Work as Expected¶
Another important consideration is that some things might not work exactly as you expect.
You may encounter unexpected errors, tools that behave differently from what you've seen in tutorials, requests that fail, or exploitation techniques that require adjustments.
This can be frustrating, especially during a timed exam.
However, I think it's also part of what makes the assessment interesting. Real penetration testing rarely follows a perfectly predictable path.
When something doesn't work, don't immediately assume you're doing everything wrong. Check your assumptions, examine the responses, verify your tools and configurations, and consider alternative approaches.
And, most importantly, don't waste hours repeating the exact same unsuccessful attempt.
Take Notes and Collect Evidence¶
This is something I can't stress enough.
Since the exam requires a penetration testing report, documenting your activities is just as important as exploiting the vulnerabilities.
Save relevant HTTP requests and responses, commands, screenshots, and any evidence that demonstrates the impact of a finding.
I recommend writing down your observations while working through the assessment rather than trying to reconstruct everything at the end.
A good report should explain what was found, why it matters, how it can be reproduced, and what should be done to fix it.
Manage Your Time¶
Even though 48 hours might sound like plenty of time, they can pass surprisingly quickly, especially if you get stuck on a particular vulnerability.
Personally, I would recommend approaching the exam section by section, keeping track of your progress and moving on when something is taking too long.
It's usually better to make progress elsewhere and return to a difficult problem later with a fresh perspective.
PT1 vs eJPT¶
Having previously taken the eJPT, I think the two certifications offer somewhat different experiences.
The eJPT is an excellent entry-level certification, especially for people taking their first steps into penetration testing.
The PT1 feels more focused on performing and documenting a complete penetration testing assessment.
The biggest difference for me was the Web Application section, which required considerably more manual investigation than I initially expected.
I also appreciated the reporting component, as it encourages you to think beyond simply compromising a system.
Finding a vulnerability is one thing; explaining its impact and proposing realistic remediation measures is another skill entirely.
Overall, I wouldn't necessarily describe every part of the PT1 as harder than the eJPT. The difficulty varies quite a bit depending on the section and your previous experience.
Final Thoughts¶
Overall, I found the PT1 to be an enjoyable and worthwhile practical assessment.
The Network and Active Directory sections were relatively straightforward for me, while the Web Application section provided the biggest challenge and required the most time.
I particularly liked the emphasis on demonstrating vulnerabilities through exploitation and documenting the results in a professional report.
If you're already comfortable with basic enumeration, exploitation, privilege escalation, and Active Directory concepts, I think you'll have a good foundation for the exam.
However, don't underestimate Web Application security. Knowing how to use automated tools is useful, but understanding HTTP, application workflows, authorization mechanisms, and business logic is far more important.
My biggest takeaway is simple: enumerate carefully, understand what you're testing, document everything, and don't assume that a vulnerability exists just because something behaves unexpectedly.
Good luck to everyone preparing for the PT1!
Happy hacking! ~