HTB CAPE study guide
HTB CAPE · Work through your exam, one topic at a time.
CAPE (Certified Active Directory Pentesting Expert) is a vendor-issued practical certification from Hack The Box that tests whether you can attack a Windows Active Directory environment end to end, not just recite attack names. It suits penetration testers, red teamers, and SOC or blue team analysts who already work with AD daily and want an assessment that proves hands-on capability. The HTB CAPE study guide has 7 sections and about 2,042 words.
01Active Directory Fundamentals and Enumeration
Active Directory Fundamentals and Enumeration tests whether you can map an AD environment before touching it: forest, domain, OU structure, DNS, trusts, sites, and the identity graph of users, groups, computers, and ACLs. The exam expects methodical, low-noise collection rather than blind scanning.
341 words, about 2 min02Initial Access and Foothold in AD Environments
Initial Access and Foothold tests how you turn enumeration into a first valid credential or shell inside AD. Common paths are password spraying, AS-REP roasting, Kerberoasting, NTLM relay, and abusing exposed services such as MSSQL or WinRM.
310 words, about 2 min03Credential Access and Privilege Escalation
Credential Access and Privilege Escalation tests harvesting secrets from memory, disk, and AD, then converting them into higher privilege. The exam rewards knowing which credential type you have, plaintext, NT hash, Kerberos ticket, or certificate, and which escalation path it unlocks.
297 words, about 1 min04Lateral Movement and Pivoting
Lateral Movement and Pivoting tests moving from one compromised host to another and reaching segmented networks. You must choose a transport that matches the credential type and the target defenses.
280 words, about 1 min05Domain and Forest Compromise (Kerberos, ACL Abuse, Trusts)
Domain and Forest Compromise tests full takeover through Kerberos ticket abuse, ACL escalation, and trust attacks. The exam expects you to distinguish domain compromise from forest compromise and to prove your access.
288 words, about 1 min06Persistence and Defense Evasion in AD
Persistence and Defense Evasion in AD tests maintaining access without losing the domain or tripping defenses. It covers domain-level backdoors, host-level persistence, and the logging that exposes both.
258 words, about 1 min07Reporting and Remediation Guidance
Reporting and Remediation Guidance tests translating technical compromise into a clear report and fixes. The exam expects evidence-backed findings, business impact, and remediation that an AD administrator can actually implement.
268 words, about 1 min