CEH cheat sheet

The CIA triad - confidentiality, integrity, availability - is the standard model for security objectives; authentication, authorization, accountability, and non-repudiation are usually added alongside it.

Hacker classes by intent: white hat (authorized), black hat (malicious), gray hat (unauthorized but non-malicious). By skill/motive: script kiddie, hacktivist, state-sponsored, cyberterrorist, suicide hacker.

Penetration testing lifecycle: pre-engagement scoping and legal authorization, information gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting, and remediation retest.

Testing approaches: black-box (zero knowledge), white-box (full knowledge including source code), gray-box (partial knowledge); each may be announced or unannounced to staff.

SLE = Asset Value x Exposure Factor; ALE = SLE x ARO (annualized rate of occurrence). Risk is often framed as Threat x Vulnerability x Impact.

Controls are preventive (reduce likelihood), detective (discover events), corrective (reduce impact), or compensating; defense in depth layers people, process, and technology.

Key US statutes: CFAA (1986) criminalizes unauthorized access, DMCA section 1201 covers circumvention, and HIPAA/SOX/GLBA/FERPA/GDPR regulate data. PCI DSS is a contractual standard, not a law.

Least privilege, separation of duties, and mandatory vacation/rotation are core administrative controls that limit the blast radius of a single compromised account.

Passive footprinting collects data without touching the target (search engines, WHOIS registries, social media, job postings); active footprinting sends traffic to the target (DNS queries, traceroute, banner grabbing).

DNS record types: A (IPv4), AAAA (IPv6), MX (mail), NS (name server), CNAME (alias), TXT (SPF/DKIM/site verification), SOA (zone authority), PTR (reverse lookup).

A zone transfer (AXFR) runs over TCP port 53; dig axfr @ns target.com dumps every record when the server permits transfers from arbitrary hosts.

RIR hierarchy: ARIN (North America), RIPE NCC (Europe/Middle East), APNIC (Asia-Pacific), LACNIC (Latin America), AFRINIC (Africa); IANA allocates address blocks to the RIRs.

Google dorks chain operators such as site:, inurl:, intitle:, filetype:, intext:, and cache: to surface exposed files, login portals, and error pages.

Traceroute maps the path using TTL expiry; Unix defaults to UDP/ICMP probes, Windows tracert uses ICMP echo, and TCP-based variants pass through ICMP-filtering firewalls.

Internet-wide scan engines (Shodan, Censys, ZoomEye) index banners and TLS certificates of exposed hosts without the tester directly probing the target.

Email footprinting reads header fields (Received, X-Originating-IP, Message-ID) and mail gateway banners to infer internal hosts and mail infrastructure.

OSINT tooling: theHarvester (emails and hosts), Recon-ng (modular framework), Maltego (link analysis), FOCA (document metadata), Wayback Machine (historical pages and removed files).

TCP flag bits are URG, ACK, PSH, RST, SYN, FIN plus ECE and CWR; a closed port answers with RST while an open port answers SYN with SYN/ACK.

TCP connect scan (-sT) completes the full three-way handshake and is logged by the target; SYN scan (-sS) is half-open and requires raw-socket privileges.

NULL, FIN, and XMAS scans rely on RFC 793 behaviour (closed ports reply RST, open ports stay silent); results are unreliable against Windows stacks that ignore them.

Nmap essentials: -sn host discovery, -sU UDP scan, -sV version detection, -O OS fingerprinting, -p port selection, -sA ACK scan to map stateful firewall rules, --script for NSE.

Enumeration ports: NetBIOS 137-139, SMB 445, SNMP 161/162 UDP, LDAP 389/636, NTP 123, SMTP 25 for user discovery via VRFY, EXPN, and RCPT TO.

SNMP default community strings are public (read) and private (read-write); snmpwalk and snmp-check dump interfaces, ARP caches, and running processes from MIB objects.

NetBIOS enumeration exposes computer names, workgroups, and shares through nbtstat -A or nbtscan; SMB null sessions can list users and shares via enum4linux.

Banner grabbing with netcat, telnet, or curl reveals service versions, which drive selection of version-specific exploits.

An idle/zombie scan (-sI) uses a third-party host's IP ID sequence to probe the target without exposing the attacker's own address.

CVE identifies a specific vulnerability, CWE classifies the underlying weakness type, NVD enriches CVEs with CVSS scores and references, and CPE names affected products.

CVSS v3.x base score range 0.0-10.0: None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0; the vector string encodes AV, AC, PR, UI, S, C, I, A.

Base metrics are intrinsic to the flaw; temporal metrics adjust for exploit maturity and remediation level; environmental metrics adjust for the specific deployed environment.

Credentialed scans authenticate to hosts and detect missing patches and configuration errors; non-credentialed scans see only remotely observable exposure.

A false positive reports a vulnerability that is not present; a false negative misses one that is - scanner output must be validated before remediation or reporting.

Scanner classes: network (Nessus, OpenVAS, Qualys), web application (Burp Suite, Acunetix, Nikto), static source analysis (SAST), and runtime instrumentation (IAST/RASP).

Vulnerability assessment enumerates and ranks weaknesses; penetration testing additionally exploits them to demonstrate business impact.

SCAP bundles OVAL check definitions, CCE configuration identifiers, CPE platform names, and CVSS scoring to automate vulnerability and compliance verification.

Windows stores local account hashes in the SAM hive (NTLM, with LM as legacy); Linux keeps salted hashes in /etc/shadow while /etc/passwd holds world-readable account metadata.

Password attack types: dictionary, brute force, rule-based hybrid, rainbow table, credential stuffing, and pass-the-hash which needs no cracking at all.

Privilege escalation is vertical (user to admin/root) or horizontal (same level, different user); common causes are missing patches, misconfigured services, SUID binaries, and weak permissions.

Tools: Mimikatz (credentials and Kerberos tickets), John the Ripper and Hashcat (offline cracking), Hydra and Medusa (online guessing), Metasploit (exploitation framework).

Persistence mechanisms include backdoor accounts, scheduled tasks, services, SSH authorized_keys, and web shells; each leaves artifacts that defenders can monitor.

Covering tracks on Windows means clearing event logs, disabling audit policy with auditpol, and timestomping files; on Linux, editing /var/log and shell history files.

Steganography hides data inside images, audio, or documents (typically LSB insertion); steganalysis uses statistical analysis, entropy, and hash comparison to detect it.

Post-exploitation ordering: escalate privileges, move laterally, maintain persistence, exfiltrate data, then cover tracks.

Malware categories: virus (needs a host and user action), worm (self-propagating), trojan (disguised, user-executed), rootkit (stealth), ransomware, spyware, adware, logic bomb, and botnet agent.

Virus types: boot sector, file infector, macro, multipartite, polymorphic (mutates), metamorphic (rewrites itself), stealth, and companion.

A worm requires no user interaction: it exploits a remote service, replicates, and scans for new targets, as WannaCry did via EternalBlue over SMB.

Detection methods are signature-based, heuristic/behavioural, sandbox detonation, and file integrity monitoring; signatures cannot catch zero-days or polymorphic code.

Static malware analysis inspects strings, PE headers, imports, and packers without executing the sample; dynamic analysis detonates it in an isolated sandbox with Procmon and Wireshark.

Covert channels carry data in violation of security policy through timing or storage side channels and are frequently used for command and control.

Ransomware encrypts files and demands payment; effective mitigations are offline backups, patching, least privilege, and segmentation rather than paying the ransom.

Rootkits run in user mode or kernel mode; reliable detection uses offline or known-good boot media scanning and boot-time integrity verification.

Sniffing is passive on hubs and active on switches (ARP spoofing, MAC flooding, port mirroring, DHCP spoofing); promiscuous mode makes the NIC accept all frames it sees.

MAC flooding with macof overflows the switch CAM table so it falls back to hub-like flooding; port security with sticky MAC addresses defeats it.

ARP has no authentication: forged replies poison caches and redirect traffic; mitigation is Dynamic ARP Inspection plus static ARP entries for critical hosts.

Cleartext protocols exposing credentials to sniffers: Telnet, FTP, HTTP, SNMPv1/v2c, POP3, IMAP, and unencrypted LDAP - replaced by SSH, SFTP, HTTPS, SNMPv3, and TLS.

Tools: Wireshark (analysis), tcpdump (CLI capture), Ettercap and Bettercap (MITM, ARP/DNS spoofing), macof (CAM table overflow).

Social engineering categories: human-based (tailgating, shoulder surfing, impersonation), computer-based (phishing, pop-ups), and mobile-based (smishing, vishing, rogue apps).

Phishing variants: spear phishing (targeted), whaling (executives), vishing (voice), smishing (SMS), pharming (DNS redirection), watering hole (compromised trusted site).

Defenses: security awareness training, out-of-band verification callbacks, SPF/DKIM/DMARC email filtering, MFA, and least privilege.

DoS exhausts a resource from one source; DDoS uses many distributed hosts and is classified as volumetric, protocol/state-exhaustion, or application-layer.

Volumetric floods (UDP, ICMP, DNS amplification) saturate bandwidth; protocol attacks (SYN flood, ACK flood) exhaust connection state tables; application attacks (HTTP flood, Slowloris) exhaust worker threads.

A SYN flood leaves half-open connections queued in the backlog; SYN cookies and backlog tuning mitigate it without allocating state per request.

Smurf sends ICMP echo requests to a broadcast address with the victim's spoofed source so every host amplifies replies; fraggle does the same using UDP chargen/echo.

Reflection-amplification abuses open resolvers: DNS (53), NTP monlist (123), memcached (11211), and SSDP (1900) return responses far larger than the spoofed request.

Legacy attacks handled by modern stacks: ping of death (oversized ICMP), teardrop (overlapping fragments), and land (identical source and destination).

Mitigations: rate limiting, BCP38 ingress/egress filtering, scrubbing centers, CDN/anycast absorption, aggressive connection timeouts, and CAPTCHAs.

Tools: hping3 (crafted floods), LOIC/HOIC (volumetric), Slowloris and GoldenEye (application layer), and commercial booter/stresser services.

Session hijacking steals or predicts a valid session identifier: cookie theft via XSS or sniffing, session fixation, TCP sequence prediction, or sidejacking.

TCP session hijacking requires guessing the next sequence and acknowledgement numbers; TLS or SSH prevents useful payload injection though the connection can still be desynchronized.

Mitigations: TLS everywhere, HttpOnly and Secure cookie flags, SameSite attributes, session ID regeneration at login, short idle timeouts, and binding sessions to client attributes.

IDS types are NIDS (network sensor) and HIDS (host agent); detection methods are signature, anomaly, and stateful protocol analysis.

An IDS is passive and alerts; an IPS is inline and blocks. Evasion techniques include fragmentation, encoding, polymorphism, tunneling, and session splicing.

Firewall generations: packet filter, circuit-level gateway, application-level proxy, stateful inspection, and next-generation firewall with application awareness and TLS inspection.

Firewall/IDS evasion: source routing, tiny and overlapping fragments, IP and MAC spoofing, protocol tunneling over HTTP/DNS/ICMP, and encrypted covert channels.

Honeypots are low- or high-interaction decoys that log attacker behaviour; a honeynet is a network of them, and attackers fingerprint them by their unexpected freedom and missing production traffic.

Web server attack categories: misconfiguration, directory traversal, default and sample files, unpatched services, DoS, DNS hijacking, and defacement.

Footprinting a web server uses the banner and Server header, HTTP response headers, robots.txt, sitemap files, error pages, and Nmap http-* NSE scripts.

Risky HTTP methods: PUT (file upload), DELETE, TRACE (cross-site tracing), and unrestricted OPTIONS disclosure; disable every method the application does not require.

Directory traversal inserts ../ sequences or encoded variants (%2e%2e%2f, ..%c0%af) to escape the document root; servers must canonicalize and validate paths.

IIS specifics include Unicode traversal, WebDAV, and legacy ISAPI extensions (.htr, .idc, .printer); Apache exposures include .htaccess, mod_status, and default cgi-bin.

Hardening: remove defaults and samples, run a least-privilege service account, patch continuously, deploy a WAF, enforce TLS, add security headers, and segregate the DMZ.

Log locations for investigation: Apache /var/log/apache2/access.log and error.log, nginx /var/log/nginx, and IIS logs under %SystemRoot%/System32/LogFiles.

Fingerprinting tools: WhatWeb, Nikto, Wappalyzer, and Nmap http-headers or http-title scripts.

OWASP Top 10 themes: broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity failures, logging failures, and SSRF.

SQL injection categories: in-band (error-based, UNION-based), inferential/blind (boolean and time-based), and out-of-band (DNS or HTTP exfiltration).

Injection defenses: parameterized queries and prepared statements, stored procedures without dynamic SQL, allow-list input validation, least-privilege database accounts, and a WAF as a backstop.

XSS types: reflected (immediate response), stored (persisted server-side), and DOM-based (client-side sink); defenses are contextual output encoding and Content Security Policy.

CSRF forges authenticated requests; defenses are anti-CSRF tokens, SameSite cookies, re-authentication for sensitive actions, and Origin/Referer validation.

Broken access control appears as IDOR (object IDs trusted from the client), forced browsing, missing function-level checks, and parameter tampering for privilege escalation.

File inclusion: LFI reads local files and can escalate via log poisoning; RFI loads remote code and requires allow_url_include - both fixed by never building paths from user input.

Tooling: Burp Suite (intercept, repeater, intruder), OWASP ZAP, sqlmap (automated SQLi), Nikto, and Gobuster or ffuf for content discovery.

Bands and standards: 2.4 GHz (802.11b/g/n), 5 GHz (802.11a/n/ac), and 6 GHz (802.11ax / Wi-Fi 6E); 802.11i defines WPA2/RSN.

Encryption progression: WEP (RC4 with 24-bit IV, broken), WPA (TKIP with per-packet key mixing), WPA2 (AES-CCMP), WPA3 (SAE, replacing the PSK handshake).

WEP cracking collects IVs until collisions reveal the key with aircrack-ng, or applies chopchop, fragmentation, and PTW attacks using far fewer packets.

WPA2 attack path: capture the four-way handshake or a PMKID, then crack offline with Hashcat or aircrack-ng against a wordlist; a deauth frame forces reconnection.

Wireless attacks: evil twin, rogue access point, deauthentication/disassociation flood, MITM, KRACK key reinstallation, WPS PIN brute force, and Pixie Dust.

Tools: airmon-ng, airodump-ng, aireplay-ng, aircrack-ng, Kismet, Wifite, Reaver (WPS), and Hashcat (handshake cracking).

Enterprise WLANs use 802.1X with EAP variants and a RADIUS server so each user holds unique credentials instead of a shared PSK.

Bluetooth attacks: bluejacking (unsolicited messages), bluesnarfing (data theft), and bluebugging (device control); 802.11w protected management frames counter deauth floods.

Android apps ship as APK and run inside a Dalvik/ART sandbox under a per-app UID; iOS apps ship as IPA with mandatory code signing and app sandboxing; rooting or jailbreaking removes these restrictions.

OWASP Mobile Top 10 themes: improper credential usage, insecure data storage, insecure communication, insecure authentication, insufficient cryptography, insecure authorization, code quality, code tampering, reverse engineering, and extraneous functionality.

Mobile attack vectors: malicious apps, repackaged APKs, overlay/phishing screens, hostile Wi-Fi, messaging exploits, and MDM policy bypass.

IoT characteristics: constrained CPU and memory, long service lifetimes, default credentials, weak update mechanisms, and a large internet-exposed attack surface.

IoT protocols: MQTT (1883 plaintext, 8883 TLS), CoAP (UDP 5683), AMQP, Zigbee, Z-Wave, BLE, and LoRaWAN - many with weak or optional authentication.

The Mirai botnet scanned the internet for IoT devices with default Telnet credentials and assembled them into a record-breaking DDoS platform.

IT prioritizes confidentiality first, while OT/ICS prioritizes availability and safety first (AIC) - the reversed order changes every security trade-off.

OT components: PLC, RTU, HMI, historian, and SCADA; protocols include Modbus (502), DNP3, PROFINET, and EtherNet/IP, usually without authentication or encryption.

The Purdue model layers OT from the physical process (level 0) to enterprise (levels 4-5), and the IT/OT DMZ is the control point for segmentation.

Service models: IaaS (customer manages OS and above), PaaS (customer manages apps and data), SaaS (customer manages identity and data only); deployment models are public, private, hybrid, and community.

The shared responsibility model splits duties by service model: the provider secures facilities, hardware, and hypervisor; the customer secures identity, data, and configuration.

Common cloud attack paths: exposed storage buckets, metadata service SSRF at 169.254.169.254, leaked API keys, over-permissive IAM roles, and insecure APIs.

Cloud controls: CSPM for posture management, CASB for visibility, IAM with least privilege and MFA, encryption at rest and in transit, and audit logging via CloudTrail or Activity Log.

Cryptography classes: symmetric (AES, DES, 3DES, Blowfish, RC4) uses one shared key; asymmetric (RSA, ECC, Diffie-Hellman) uses key pairs and solves key distribution.

Hashing (MD5, SHA-1, SHA-2, SHA-3) is one-way and produces a fixed-length digest for integrity; MD5 and SHA-1 are broken for collision resistance.

A digital signature is the message hash encrypted with the sender's private key; verification with the public key gives integrity, authentication, and non-repudiation but not confidentiality.

PKI: a certificate authority issues X.509 certificates binding an identity to a public key; TLS combines these with ephemeral key exchange to provide confidentiality and forward secrecy.

AES is a block cipher used in modes such as CBC, CTR, and GCM; stream ciphers (RC4, ChaCha20) encrypt bit by bit - an IV or nonce must never be reused with the same key.