Summary#

The CRTP (Certified Red Team Professional) by Altered Security is, in my opinion, one of the best gateways into the world of offensive Active Directory. It isn’t a certification centered on throwing exploits, but on truly understanding how a domain works and how to abuse configurations, trust relationships, credentials and, above all, Kerberos tickets to move laterally until you fully compromise it.

What is the CRTP?#

The CRTP is fully built around the Attacking and Defending Active Directory course, taught by Nikhil Mittal. Its lab simulates an entire company with a realistic Active Directory, where you’ll find everything from local privilege escalation vulnerabilities to abuse of cross-domain and cross-forest trusts. Some examples of what you practice:

• Domain enumeration with PowerView and other tools.
• Kerberoasting, AS-REP Roasting and delegation abuse.
• Lateral movement and local privilege escalation.
• Abuse of trust relationships between domains and forests.
• Persistence with Golden Ticket, Silver Ticket, Diamond Ticket and similar techniques.

What I liked most#

I loved the exam’s methodology: you start as an unprivileged user and have to work your way up to Domain Admin. Fully understanding what is happening inside the Active Directory makes every machine you compromise feel like real progress. On top of that, the exam rewards the student who understands the domain, not the one who fires off attacks blindly hoping something works.

What is most demanding#

For me, the most demanding part is the enumeration once you gain access to a machine. You need to know what permissions you have, what else you can do from that host and, with all of that clear, decide on the next attack that gets you into another machine in the domain.

Learning to enumerate an Active Directory thoroughly makes the exam much more manageable and keeps you from getting stuck.

Preparation and approach#

Honestly, my preparation was solely the material Altered Security gives you when you buy the course: the videos and the lab. It’s very complete content: if you study it carefully, work through the labs calmly and take notes on every step, understanding how to attack and defend an Active Directory becomes much easier.

As I mentioned before, the key is understanding the what, how, when and why of each attack, and being able to make it work in the specific context you’re in.

Real difficulty#

My overall sense was this:

• Technical difficulty: Basic - Intermediate
• Overall exam difficulty: Intermediate
• Time management: Comfortable

The exam gives you plenty of time to compromise the machines in the environment and then an additional window to submit the report. I didn’t feel it was an impossible exam; rather one that, if you prepared the lab well, rewards you for the work you put in.

My overall experience#

What I value most about the CRTP is that it left me with a solid and organized foundation for how to attack an Active Directory. Many of the techniques practiced here are the same ones that later reappear, under more pressure, in harder certifications. That’s why I see it as a perfect foundation before taking bigger leaps.

The focus on enumerating, understanding and chaining felt exactly like the kind of mindset you want to develop if you’re interested in internal red teaming. And working mostly with native tools makes you learn for real, without depending on “a tool doing the magic for you”.

The best of the CRTP#

• Excellent introduction to offensive Active Directory.
• Practical approach, with a lab you can repeat without limits.
• Great effort/learning ratio: you learn fundamentals you’ll use forever.

The worst of the CRTP#

• If you’re after web or binary exploitation, this isn’t your exam: it’s almost pure AD.
• The pace depends a lot on how much you squeeze the lab before sitting the exam.

Who would I recommend it to?#

I’d recommend it to:

• People who want to take their first serious steps into Active Directory and red teaming.
• Those who already have a pentesting base and want to close the AD gap.
• People who enjoy understanding the “why” behind each attack, not just running it.

I wouldn’t recommend it to:

• Those looking for a certification focused on web or binary exploitation.
• People who want something purely CTF-style with no methodological focus.

Final verdict#

For me, the CRTP is one of the certifications with the best ratio between what you invest and what you take away. It’s not the hardest one I’ve done, but it is one of the most useful as a foundation, because it leaves you with a clear methodology for attacking domains and prepares you mentally for bigger challenges.

If you’re interested in internal pentesting and Active Directory, it’s a certification I recommend without hesitation. I enjoyed it, learned a ton, and it left me eager to keep going deeper into the red team world.

Dedication#

This certification is dedicated to Ariana Cáceres, for her constant support and for always encouraging me to keep studying and to improve every day. Thank you for being there every step of the way. 💜