CEH case studies
CEH · Put your knowledge to work in context.
The Certified Ethical Hacker (CEH) is EC-Council's flagship ethical hacking credential, currently delivered as CEH v13 with AI capabilities built into the curriculum. It is aimed at security analysts, administrators, auditors, SOC staff, consultants and aspiring penetration testers who need to understand how attackers reconnoiter, exploit and persist - so they can find and fix weaknesses first. The CEH case studies are 5 cases and about 4,225 words.
1The Subsidiary That Wasn't in the SOW
You are three days into a five-day external-to-internal penetration test for a mid-size logistics firm. The signed statement of work lists 10.0.0.0/24 and 172.16.8.0/24 (roughly 500 hosts) and explicitly excludes "any third-party or hosted infrastructure." While enumerating, you resolve a forgotten VPN portal to an address inside 172.16.8.0/24 that is registered to a managed service provider; the login page carries the client's logo and the TLS certificate is issued to the client.
845 words, about 4 min2Every Port Filtered, One Host Answers
An external assessment covers three public IPs. nmap -sS -p- against the first returns every port as filtered , no RSTs, and ICMP echo replies arrive with TTL 63.
866 words, about 4 min34,812 Findings and a 72-Hour Audit Window
A quarterly authenticated scan of 1,200 hosts produced 4,812 findings: 61 rated critical, 340 high, the rest medium and low. Credentialed scanning failed on about 40 percent of the Linux estate because the scan account has no sudo, so those hosts were assessed by banner only.
800 words, about 4 min4The Login Form That Answers in Two Seconds
During a two-hour window against a production e-commerce site (no staging available, rate limit of five requests per second agreed in the rules of engagement), you are testing a login form and a product page. A single quote in the username returns exactly the same generic "invalid credentials" page as a wrong password, byte-for-byte.
884 words, about 4 min5A Leaked Key, Ninety Days of Logs, and One Anomalous Region
A developer pushed an AWS access key to a public repository 11 days ago. GuardDuty has raised an anomaly: the key was used from an IP in a region the company has never operated in.
830 words, about 4 min