Hack The Box HTB Certified Active Directory Pentesting Expert (HTB CAPE) Domains Explained: What to Study, Practice, and Review

The HTB Certified Active Directory Pentesting Expert, or HTB CAPE, is not a theory-heavy exam you pass by memorizing tool names. It tests whether you can move through a realistic attack path, make good decisions under pressure, and understand why each step matters. That is why many candidates get stuck on a simple question: what exactly should I study first, and how deep should I go in each domain? This guide breaks the exam areas into practical study units. It focuses on what to learn, what to practice repeatedly, and what to review right before you attempt practice tests or the exam itself.

What the HTB CAPE really tests

At its core, HTB CAPE measures whether you can assess and exploit an Active Directory environment in a structured way. That includes technical execution, but also judgment. You need to know when to enumerate quietly, when to validate assumptions, when to pivot, and how to chain findings into privilege escalation.

Most candidates think in terms of isolated topics like Kerberos, MSSQL, or delegation. The exam is better understood as a workflow:

• Initial access or foothold discovery
• Host and service enumeration
• Credential discovery and abuse
• Privilege escalation on Windows systems
• Active Directory enumeration and attack path mapping
• Lateral movement and pivoting
• Domain privilege escalation
• Evidence handling, documentation, and validation

If your study plan only covers commands, you will miss the bigger skill: turning one piece of access into the next meaningful step.

The major knowledge areas to study before practice tests

Even though Active Directory is the center of the exam, strong candidates prepare across several connected areas. Each one supports AD exploitation in a real environment.

• Windows and Active Directory fundamentals
  Learn how domains, forests, trusts, users, groups, OUs, GPOs, SPNs, Kerberos, LDAP, SMB, WinRM, and DNS work. This matters because many attacks only make sense if you understand normal AD behavior first.
• Enumeration methodology
  Practice discovering hosts, shares, users, groups, sessions, ACLs, policies, certificates, service accounts, and trust relationships. Good enumeration is what reveals attack paths that are not obvious on first look.
• Credential attacks
  Study password spraying, Kerberoasting, AS-REP roasting, token abuse, saved credentials, insecure files, misconfigured services, and secrets in scripts or shares. Many CAPE-style paths depend on careful credential collection rather than a single exploit.
• Windows privilege escalation
  Review services, scheduled tasks, weak permissions, SeImpersonate-style abuse, vulnerable software, DLL hijacking concepts, and misconfigurations in local groups and policies. If you land as a low-privilege user, you need to know how to turn that into local admin.
• AD object control and ACL abuse
  Understand GenericAll, GenericWrite, WriteDacl, WriteOwner, AddMember, ForceChangePassword, and related rights. These are common in modern AD attack paths because environments often fail through access control, not patch level.
• Delegation and Kerberos abuse
  Study unconstrained delegation, constrained delegation, resource-based constrained delegation, ticket types, and common abuse flows. These topics matter because they often create indirect routes to high privilege.
• AD CS and certificate abuse
  This has become a key study area. Learn templates, enrollment rights, EKUs, SAN abuse, ESC-style misconfigurations, and how certificates can lead to authentication as another user. Many candidates underprepare here.
• Lateral movement and remote execution
  Practice moving with SMB, PsExec-style methods, WinRM, WMI, RDP, scheduled tasks, and service creation. You need to know not just how to move, but which method fits the access you have.
• Pivoting and tunneling
  Study SOCKS tunnels, port forwarding, host-based pivots, and segmented network access. In realistic labs, not every target is directly reachable.
• Defensive awareness and log-conscious actions
  You are not taking a blue-team exam, but you should understand what common actions reveal, why some methods are noisier, and how defenders might detect them. This helps you choose safer enumeration paths and avoid wasting time.
• Basic web exploitation and app-driven access
  Some environments expose web apps that leak credentials, permit command execution, or reveal internal systems. You do not need deep full-stack exploitation, but you should be able to test auth issues, file upload flaws, insecure config, and basic injection cases.
• Wireless and adjacent environment awareness
  Wi-Fi is not always central, but if your training path includes enterprise attack surface exposure, know authentication basics, credential reuse implications, and how wireless weaknesses can connect back to domain compromise.
• AI security awareness
  This is more of an emerging support topic than a core AD domain. Focus on practical risk: exposed AI tools, prompt leakage of secrets, insecure plugin integrations, over-permissioned service accounts, and sensitive data handling. Treat it as another possible source of credentials or internal intelligence.

Beginner-friendly methodology: how to approach a CAPE-style environment

Many learners know individual attacks but struggle to order them. A simple methodology helps.

• Start broad, then narrow down. Identify reachable hosts, domain details, exposed services, and obvious user access. Early mistakes often come from diving too deep into one host too soon.
• Validate every credential everywhere it makes sense. A password from a share, script, note, browser store, or config file may work on SMB, WinRM, MSSQL, or a web app. Reuse is common.
• Collect identity context early. Know who you are, what groups you belong to, what rights you have, and which machines trust that identity. In AD, your current user often matters more than your current host.
• Map object relationships, not just machines. If one user can reset another user’s password, or one group controls a service account, that may be the real path forward.
• Chain low-risk checks before high-noise actions. LDAP queries, share reviews, BloodHound-style relationship analysis, and rights inspection usually tell you more than blind brute force.
• Document as you go. Write down credentials, hosts, failed assumptions, access levels, and next ideas. This is not just for reporting. It prevents loops and missed paths.

How to separate memorization topics from scenario-based topics

This is one of the smartest ways to study efficiently.

Memorization topics are facts or patterns you should recall quickly without much thought. Examples:

• Common ports and what they suggest in Windows environments
• Kerberos ticket types and what they are used for
• Important AD rights such as GenericAll or WriteDacl
• Common places to find stored credentials on Windows
• Typical signs of AD CS misconfiguration
• Tool syntax you use often enough to need fluency

Scenario-based topics require decision-making. Examples:

• Choosing whether to roast, spray, or inspect shares first
• Determining if a service account is more useful than a local admin foothold
• Selecting the best lateral movement method for a given access level
• Recognizing that an ACL path is safer than trying exploit-heavy privilege escalation
• Using certificate abuse only after confirming enrollment rights and template conditions

The reason this distinction matters is simple. Memorization helps with speed. Scenario practice helps with passing. You need both, but most candidates overinvest in the first one because it feels easier to measure.

Topic-by-topic study advice

Active Directory basics: If you cannot explain how authentication, group membership, and delegation work in plain English, slow down and rebuild your foundation. Advanced attacks make more sense when you understand normal identity flow.

Enumeration: Practice reading the environment, not just running tools. If a scan shows LDAP, SMB, WinRM, MSSQL, and a certificate service, ask what that combination implies. Enumeration is interpretation.

Windows privilege escalation: Do not just memorize checklists. Learn why weak service permissions matter, why a scheduled task can be abused, and what rights are required to turn a local foothold into admin.

Credential abuse: Build a habit of hunting for secrets in files, shares, command history, scripts, registry locations, config files, and application data. In many labs, credentials are hidden in ordinary places because that mirrors real environments.

ACL abuse: Spend extra time here. Many candidates understand passwords and hashes better than object control. Yet modern AD attack chains often depend on rights abuse more than cracking.

AD CS: Treat this as a full exam domain, not a side topic. Be able to identify vulnerable templates, understand enrollment logic, and explain how certificate-based authentication changes the attack path.

Lateral movement: Practice from the perspective of constraints. What if SMB works but WinRM does not? What if you have local admin but no interactive login? What if outbound traffic is restricted?

Web and app-driven access: Focus on realism. Can the app reveal internal hostnames, credentials, upload paths, database access, or code execution? Web flaws often matter because they bridge into the domain.

Defensive analysis: Learn enough Windows logging and telemetry concepts to understand why some actions are obvious. This will improve your choices and make your methodology more disciplined.

Recommended review order before attempting practice tests

A good review order reduces overload and exposes weak spots early.

1. Windows and AD fundamentals
2. Core enumeration on hosts, users, groups, shares, and services
3. Credential discovery and password attacks
4. Local privilege escalation on Windows
5. AD enumeration and graphing attack paths
6. ACL abuse and delegation abuse
7. AD CS and certificate-based escalation
8. Lateral movement and pivoting
9. Web-to-domain attack paths
10. Timed mixed-scenario labs and review notes

This order works because it moves from understanding the environment to exploiting relationships inside it. If you start with exotic escalation methods too early, you may miss the simple path sitting in front of you.

How to convert each domain into practice sessions

The best way to prepare is to turn every domain into a repeatable lab block. Do not study topics only by reading notes. Build short, focused sessions with a clear output.

• AD basics session: Explain a domain structure from memory. Then enumerate a lab and identify users, groups, service accounts, trusts, and authentication methods.
• Enumeration session: Start from one foothold and produce a map of hosts, services, shares, users, sessions, and likely attack paths within a fixed time.
• Credential session: Hunt only for passwords, hashes, tickets, keys, and reusable secrets. The goal is not domain admin. The goal is finding every credential source you can.
• Privilege escalation session: Land as a low-privilege user and find at least two possible local escalation routes, even if you only execute one.
• ACL and delegation session: Enumerate rights, identify control edges, and explain in writing how one user or group can affect another object.
• AD CS session: Inspect certificate services and templates. Decide whether there is abuse potential and justify your conclusion.
• Lateral movement session: Use one credential set across multiple remote management paths. Compare what works and why.
• Web-to-AD session: Start from an application and ask one question: can this app produce credentials, code execution, or internal visibility that helps domain compromise?

If you want to pressure-test your readiness after this kind of domain-by-domain practice, use a dedicated question bank or scenario set that reflects CAPE-style thinking, such as this HTB CAPE practice test. The value is not just checking answers. It is seeing which domains break down when you are under time pressure.

How to track weak areas without guessing

Many candidates say they are “bad at AD CS” or “weak in privesc,” but they do not define the problem clearly enough to fix it. Track weak areas in a simple table with three columns:

• Topic
• Failure type
• Fix action

For example:

• Kerberoasting — failure type: forgot validation steps — fix action: rehearse full flow twice in lab
• ACL abuse — failure type: did not recognize object control opportunity — fix action: review rights meanings and solve two pathing labs
• Pivoting — failure type: tool confusion — fix action: build one clean cheatsheet and repeat setup from scratch

This matters because “I need more review” is too vague. You want a direct link between what failed and what to practice next.

Mini FAQ

Which domains matter most?
Active Directory enumeration, credential abuse, object control, privilege escalation, and lateral movement are the core of the exam mindset. AD CS is also a high-value topic and should not be treated as optional.

Is there a public domain weighting I should rely on?
It is better to think in terms of attack chain importance than percentages. A small topic on paper can become the key pivot in a real scenario. Study for coverage and depth, not just weight.

Should beginners skip advanced topics like delegation or certificate abuse at first?
No, but sequence them properly. Build fundamentals first, then learn how those advanced topics fit into a real path. Skipping them too long creates a major blind spot.

How do I know if I am ready for practice tests?
You are ready when you can explain your method, not just your commands. If you can move from foothold to path analysis with clear reasoning, practice tests will be useful.

What is the most common study mistake?
Studying tools instead of situations. Tools change. The logic behind enumeration, privilege, trust, and control is what carries over into every environment.

Final review advice

For HTB CAPE, your goal is not to become perfect in every AD niche before touching a practice test. Your goal is to become reliable. Reliable at enumerating. Reliable at spotting credential opportunities. Reliable at reading rights and relationships. Reliable at turning one small foothold into the next step.

If you keep your study plan organized around domains, methodology, and repeatable hands-on sessions, the exam becomes much more manageable. Learn the facts you need to recall quickly. Practice the scenarios that force you to think. And review in an order that builds from fundamentals to chain-building. That is the preparation style that usually leads to better results.