I started my HTB CAPE exam on a Monday. Nearly two days later, I still had not captured a single flag.
The problem was not a missing exploit, a broken tool, or an unstable target. I had gone too far down a rabbit hole because my initial reconnaissance was incomplete. Once I stepped back, reviewed the environment properly, and rebuilt my attack map, the exam began to make sense.
That experience summarizes the most important lesson CAPE taught me: advanced Active Directory penetration testing is not about memorizing more commands. It is about enumeration, understanding why an attack works, and recognizing how individual weaknesses connect into a complete attack path.
In this review, I will share my experience with the training path and exam without revealing any exam specific attack paths, credentials, flags, or solutions.
You can verify my result through my HTB CAPE achievement badge.
What Is HTB CAPE?
HTB CAPE stands for Hack The Box Certified Active Directory Pentesting Expert. It is the certification associated with the Active Directory Penetration Tester Job-Role Path on HTB Academy.
The path contains 15 modules covering the major components of modern on-premises Active Directory penetration testing, including deep enumeration, Kerberos and NTLM attacks, DACL abuse, AD CS, domain trusts, lateral movement, enterprise services, C2 operations, and Windows evasion.
The exam is a practical internal Active Directory assessment rather than a multiple choice test. Candidates receive an engagement scenario and an internal foothold, then have ten days to identify and exploit attack paths and submit a professional penetration testing report. At the time of my attempt, the environment contained ten flags, and 90 points the equivalent of nine flags were required to pass. I captured all ten flags.
My Background Before CAPE
I have worked in offensive security since around 2015. I began with web application penetration testing, moved into network and infrastructure assessments, and later focused more heavily on Red Team operations and enterprise Active Directory environments.
Before attempting CAPE, I had already completed many HTB machines and Pro Labs, along with training and certifications such as CRTO, CRTL, Summus(ERTL), C-ADPenX, CRteamerX, CRTSv2, and several other Red Team challenges. Each of those experiences had its own strengths and helped me develop a practical methodology.
This background certainly helped, but it did not make CAPE effortless. The environment was large enough to punish weak assumptions, incomplete notes, and rushed enumeration. Experience gave me more options, but I still had to slow down and follow a disciplined process.
Is the CAPE Training Path Enough to Pass?
In my opinion, yes the official path provides enough knowledge to pass the exam, provided that you genuinely understand the material.
Simply completing every section and saving the commands is not enough. You should understand what each technique changes in Active Directory, which permissions or protocol behaviors make the attack possible, what prerequisites it has, how to confirm that it worked, and what alternative tooling you can use when your preferred tool fails.
This is one of HTB Academy’s biggest strengths. The material does more than provide a list of commands. It usually explains the underlying concept, the relevant protocol or Windows behavior, the logic of the attack, and then the practical exploitation process. Someone with limited AD experience can learn a great deal if they take the time to study the explanations and repeat the labs.
That said, several tool specific sections would benefit from updates. Offensive tools change quickly, and this is especially noticeable in areas such as Windows evasion. I recommend supplementing the modules with current tool documentation, changelogs, and recent technical research. The concepts remain valuable, but a command or bypass that worked when a module was written may behave differently against a current environment.
How I Prepared
After completing the Academy path, I spent roughly two additional months practicing in HTB Pro Labs and mini labs. I used that time not only to solve attack paths but also to test my operational setup: C2 payloads, tunneling, listeners, tool versions, and alternative commands.
This preparation made the exam feel less like an unfamiliar certification challenge and more like another large Pro Lab although one with a different level of difficulty, more pressure, and a professional reporting requirement.
My preparation focused on four areas:
- Repeating the module labs until I understood the attack logic rather than only the commands.
- Building my own searchable notes for each technique, including details and alternatives beyond the Academy material.
- Practicing larger attack chains in Pro Labs instead of treating each technique as an isolated exercise.
- Testing my tools, C2 setup, payloads, and tunnels before starting the exam.
My strongest recommendation is to test your entire workflow in advance. The exam is not the right place to discover that a dependency is missing, a Python environment is broken, a payload no longer works, or two tool versions behave differently.
The exam is open book, and the ten day window gives you enough time to consult your notes or return to a specific Academy section when necessary. However, this only helps if your notes are organized and searchable. I wrote my own notes for every major technique and added troubleshooting details, alternative tooling, and observations that went beyond the module text. This saved a significant amount of time during the exam.
My Exam Experience
I began the exam on a Monday and initially approached the environment with too many assumptions. For almost two days, I made no meaningful progress because I had followed a rabbit hole created by incomplete reconnaissance.
Once I returned to enumeration and reviewed the information from a different angle, I found the gap in my methodology. From that point onward, the attack paths became much clearer.
Whenever I became stuck later in the exam, I first asked myself whether I had enumerated the environment properly and whether I had repeated enumeration after gaining new access. In my experience, most blockers were caused by a missing piece of reconnaissance not by an obscure exploit.
This does not mean that every issue is your fault. If a target behaves unexpectedly, the exam platform allows systems to be reverted. However, reverting should not replace troubleshooting and validation. Before blaming the lab, confirm your prerequisites, credentials, name resolution, time synchronization, routes, tickets, and tool output.
I enjoyed the challenge. Because I had already spent significant time in Pro Labs, CAPE felt like a new enterprise lab in which I had to combine familiar techniques across a larger environment. The individual attacks were important, but the real challenge was identifying the relationships between them and continuously updating my understanding of the network.
I also experienced a technical issue during my attempt. After I contacted HTB, the support team reviewed the situation and granted me one additional day. I appreciated how quickly and fairly they handled it.
Reconnaissance Was the Most Important Skill
If I had to reduce my advice to one word, it would be: enumerate.
Good reconnaissance in CAPE is not a single scan at the beginning. It is a continuous process. Every new credential, group membership, session, host, service, trust relationship, certificate template, or delegated permission can change the attack graph.
Do not depend on one tool. Automated collection is useful, but it can fail, return incomplete data, or hide the detail you need. Be comfortable validating results manually and using alternative tools. Most importantly, understand what you are looking for instead of waiting for a tool to label an attack path as vulnerable.
My first two days would have been very different if I had followed this discipline from the beginning.
Topics That Deserve Extra Attention
Every module matters, but I would spend extra time on DACL/ACL abuse and Kerberos attacks. These areas require more than command memorization because small differences in permissions, delegation, SPNs, ticket types, or trust boundaries can completely change the correct approach.
Make sure you can:
- Explain why an access control relationship is exploitable and identify the exact right that enables it.
- Perform the same core enumeration from both Windows and Linux.
- Understand Kerberos ticket flows rather than treating tools such as Rubeus or Impacket as black boxes.
- Recognize when newly obtained access requires complete re-enumeration.
- Work without depending entirely on BloodHound or any other single data source.
- Adapt commands when usernames, domains, SPNs, encryption types, or network conditions change.
C2 knowledge is also useful, but the framework itself is not the objective. Operational reliability matters more than choosing the most impressive tool. Use the framework you understand and test it before the exam.
Using My Own Kali Machine
Candidates can work through HTB’s browser based Pwnbox, but I am much more comfortable with my own Kali environment. I performed most of the assessment from my Kali VM and used the provided internal Linux host primarily as a pivot point for tunneling traffic into the target networks.
This worked well because all my tools, notes, aliases, and terminal setup were already available. The trade off was tunnel persistence. When I shut down or suspended my Kali VM to rest, the local tunnel disconnected, and I had to restore the relevant connections and routes when I returned.
Using Pwnbox can simplify that workflow for candidates who prefer to keep their tooling inside the HTB environment. Either option is valid. The important point is to choose one before the exam and practice the full connection and recovery process so that rebuilding a tunnel does not become stressful.
Reporting Was One of the Hardest Parts
For me, exploitation was only part of the challenge. Producing the final report was one of the most demanding stages of the exam.
HTB expects a professional deliverable that follows its reporting requirements. Do not wait until the end and do not invent a completely different structure. The supplied template is generally consistent with a standard Penetration Testing report, although some sections and grading expectations are specific to HTB.
I strongly recommend completing the Documentation & Reporting module from the CPTS path before starting CAPE. Even if you already write reports professionally, the module helps you understand the structure, level of evidence, and style HTB expects.
Document as you go. For every confirmed issue or attack step, save:
- The affected host, user, or domain.
- The exact command or action performed.
- The relevant output not several pages of unnecessary terminal text.
- A clear screenshot showing the evidence.
- The security impact and root cause.
- Practical remediation guidance.
- Any cleanup action required after testing.
Good notes reduce the final report to an editing and organization task. Poor notes force you to repeat attacks, rebuild tunnels, and search through terminal history while the submission deadline is getting closer.
Who Should Take CAPE?
CAPE is not a beginner level certification. If Active Directory fundamentals, network penetration testing, Windows authentication, and basic pivoting are still unfamiliar, I would not recommend starting here.
For someone with little professional experience or perhaps one or two years in penetration testing I would suggest completing CPTS or building equivalent skills first. I have not taken the CPTS exam myself, so I cannot review that exam directly. However, I am currently using the remaining time on my Academy subscription to work through other paths, including CPTS material, and I can see how much foundation it provides.
Even with many years of experience, I continue to find topics that I can learn more deeply or concepts that I previously understood only at a surface level. That is one of the reasons I value hands on training: experience does not eliminate knowledge gaps; it simply helps you recognize them faster.
Price and Value
I do not have a universal answer about whether CAPE is affordable because the value of training depends heavily on a person’s location, income, employer support, and goals.
For me, it was expensive. I purchased an annual Academy subscription and then added two months of Pro Labs before the exam. I still chose to do it because I viewed the cost as an investment in myself rather than only a fee for a certificate.
From a learning perspective, I believe the investment was worthwhile. HTB currently offers one of the most comprehensive collections of practical Active Directory attack material in a single structured path. It covers concepts, technical background, attack logic, step by step labs, and the process of chaining weaknesses across realistic environments.
The certificate is useful, but the real value comes from the hours spent troubleshooting, repeating labs, improving methodology, and learning to explain the risk in a professional report.
Final Thoughts
CAPE was challenging, enjoyable, and valuable. I captured all ten flags, but the most important result was not the score. The exam exposed weaknesses in my reconnaissance process, forced me to improve my reporting discipline, and reminded me that understanding an attack is far more important than remembering the command that executes it.
If you are preparing for CAPE, my final recommendations are:
- Complete every module and understand the reason each attack works.
- Build searchable notes in your own words.
- Practice full attack chains in Pro Labs or equivalent environments.
- Test every important tool, payload, and tunnel before the exam.
- Treat enumeration as a continuous activity.
- Re enumerate whenever your access changes.
- Study DACL abuse and Kerberos deeply.
- Read the Documentation & Reporting module before starting.
- Capture evidence and write the report as you progress.
- Take breaks. Ten days is enough time if you manage your energy and avoid panic.
The official training path can prepare you to pass, but only if you treat it as a learning program rather than a checklist. Read the theory, complete the labs, break your tools during practice, fix them, and understand the logic behind every step.
That process not the badge is what makes CAPE worth pursuing.
Disclaimer
This article reflects my personal experience with the HTB CAPE training path and exam. Exam formats and platform details may change over time. I intentionally excluded exam specific targets, credentials, flag locations, attack paths, and solutions in accordance with exam integrity requirements.
