Starting My CPTS Journey on a 10-Year-Old HDD Laptop

Most "how I started pentesting" posts assume you own a machine that can actually run a virtual lab. Mine can't not comfortably, anyway.

I'm a self-taught developer and cybersecurity/digital forensics student in Uganda, and my daily driver is a Toshiba laptop with a spinning HDD, running Windows 10. When I decided to go after the HTB Certified Penetration Testing Specialist (CPTS) the first obstacle wasn't a vulnerable web app. It was my own hardware.

The problem with "just spin up a VM"

Every pentesting roadmap says the same thing: install VirtualBox, download Kali, spin up a lab. On an HDD, that advice quietly assumes you have RAM and disk speed to spare. A local VM on a mechanical drive means slow boot times, laggy snapshots, and a machine that struggles to run a browser and a hypervisor at once. I tried it. It wasn't unusable, but it made every study session feel like a fight against my own tools instead of the material.

So I stepped back and asked a more useful question: what am I actually trying to do? I don't need a "real" virtual machine I need a Linux environment with the right tooling, close enough to my host that I'm not burning cycles on VM overhead.

What I landed on

Two adjustments changed everything:

WSL2 with Kali, instead of a full VM. It runs as a lightweight layer on Windows rather than emulating an entire machine, which matters a lot when your bottleneck is disk I/O, not CPU. A cloud VPS for anything heavier sustained scans, larger labs, or work I want accessible from any device without depending on my laptop's uptime.

Before any of that, I had to clean house. Android Studio, MinGW64, MongoDB, XAMPP — tools from earlier projects that were quietly eating disk space and background resources. None of them were doing me any favors on an HDD, so they had to go before WSL2 setup could breathe.

The roadmap I'm following

With the environment sorted (or nearly cleanup first, then WSL2), the learning path is:

1. PortSwigger Web Security Academy free, deep, and the best place to actually understand web vulnerabilities rather than just recognize their names.
2. TryHackMe guided rooms to build methodology and get comfortable with tooling.
3. HTB Academy the direct on-ramp to CPTS itself.

I've already set up my PortSwigger account and started working through it, treating it as the foundation everything else builds on.

Why I'm writing this down

There's a version of the offensive security community that assumes a baseline: decent hardware, reliable power, unmetered internet. That's not the reality for a lot of learners across Africa, myself included. I'm documenting this journey hardware constraints and all because if you're learning pentesting on a machine that wasn't built for it, I want you to know it's still a viable path. It just means being deliberate about your setup before you're deliberate about your exploits.

Next up: what I actually found once I started working through PortSwigger's labs.

I'm Mercy, a cybersecurity and digital forensics student in Uganda, and co-founder of CodeOn, a youth-powered software agency. Follow along as I document the road to CPTS.