HTB Certified Active Directory Pentesting Expert
Preparing the CAPE
Compromising a complex Active Directory environment with several domains and trust relationships, by chaining misconfigurations and advanced attacks.
Offensive · Active DirectoryAdvancedActive Directory Penetration Tester path
The exam at a glance
Duration10 daysThe countdown never stops
Prerequisite15 modulesActive Directory Penetration Tester path completed at 100%
PassingPoints + reportPoints threshold and a professional report
ReportIn EnglishSubmitted once, cannot be changed
Good to knowLaunched late 2024. The CPTS is not mandatory but strongly recommended: the path's first module is the CPTS Active Directory module.
Rules shared by every exam (attempts, deadlines, AI, Pwnbox): shared rules.
Page updated on 13 November 2026. Exam conditions change: check them on the HTB Help Center before booking.
Review
Study notes, flashcards and quizzes. Mastered cards and your best score are saved in this browser.
Module tracking
The 15 modules of the Active Directory Penetration Tester path, grouped by theme. Tick them off as you go: progress is saved in this browser.
Enumeration
- Active Directory Enumeration & Attacks
- Active Directory LDAP
- Active Directory PowerView
- Active Directory BloodHound
Lateral movement
- Windows Lateral Movement
- Using CrackMapExec
Identity attacks
- Kerberos Attacks
- DACL Attacks I
- DACL Attacks II
- NTLM Relay Attacks
- ADCS Attacks
Forests, C2 and evasion
- Active Directory Trust Attacks
- Intro to C2 Operations with Sliver
- Introduction to Windows Evasion Techniques
- MSSQL, Exchange, and SCCM Attacks
What the exam assesses
- Enumerate a domain in depth: LDAP, PowerView, BloodHound.
- Exploit Kerberos, ACLs and DACLs, NTLM relaying and certificate services (ADCS).
- Move laterally between Windows machines.
- Cross trust relationships between domains and forests.
- Operate through a C2 framework and get past common defences.
- Attack AD-related enterprise services: MSSQL, Exchange, SCCM.
Study plan
An example to adapt to your pace. Always alternate modules and practice.
- PrerequisiteThe CPTS AD syllabus mastered.
- Wk 1–3Enumeration (LDAP, PowerView, BloodHound) and lateral movement.
- Wk 4–7Kerberos, DACLs, NTLM relaying, ADCS.
- Wk 8–9Trusts, C2, evasion, enterprise services.
- Wk 10Multi-domain AD labs and a report under real conditions.
Exam tips
Specific to the CAPE
- Keep a BloodHound graph up to date after each new account obtained.
- For each account, note how it was obtained, its rights and where it works.
- Knowing the Event IDs your actions generate helps explain their detection in the report.
Valid for every HTB exam
- Split the time: keep at least a third of it for the report.
- A screenshot at every key step, timestamped notes.
- Stuck for two hours? Note the lead and move on.
- Use the official template or SysReptor's from your practice runs onwards.
Review on this site
Ready to book?
- Active Directory Penetration Tester path completed at 100%
- Exam voucher available
- Personal notes organised and easy to search
- Report template ready, already used at least once
- At least one full practice run under real conditions
- 10 days blocked out in the calendar