CEH study guide
CEH · Work through your exam, one topic at a time.
The Certified Ethical Hacker (CEH) is EC-Council's flagship ethical hacking credential, currently delivered as CEH v13 with AI capabilities built into the curriculum. It is aimed at security analysts, administrators, auditors, SOC staff, consultants and aspiring penetration testers who need to understand how attackers reconnoiter, exploit and persist - so they can find and fix weaknesses first. The CEH study guide has 10 sections and about 4,034 words.
01Introduction to Ethical Hacking
The objective of security is the CIA triad - confidentiality, integrity, availability - supported by authentication, authorization, accounting, non-repudiation, and defense in depth. Controls split into preventive, detective, corrective, deterrent, and compensating ; a question asking what "detects and records" wants a detective control (IDS, audit logs), not a preventive one.
340 words, about 2 min02Footprinting and Reconnaissance
Passive footprinting collects information from third parties - search engines, WHOIS databases, social media, job postings, certificate transparency logs, the Wayback Machine, Shodan - without packets reaching the target. Active footprinting touches the target directly: DNS lookups, zone transfer attempts, traceroute, banner grabbing, email bounce checks.
324 words, about 2 min03Scanning Networks and Enumeration
Scanning maps live hosts, open ports, services, and operating systems. Understand the TCP three-way handshake (SYN, SYN/ACK, ACK) and the flag combinations used by scan types.
331 words, about 2 min04Vulnerability Analysis
A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk is the combination of likelihood and impact. Distinguish a vulnerability assessment (identify, classify, prioritize) from a penetration test (exploit and prove impact) - a scanner finding is not proof of exploitability.
347 words, about 2 min05System Hacking
System hacking follows gaining access → escalating privileges → maintaining access → covering tracks . Gaining access uses password attacks, exploit delivery, or credential reuse.
330 words, about 2 min06Malware Threats, Sniffing, and Social Engineering
Viruses require a host file and user action to spread; worms self-propagate over networks without a host; trojans masquerade as legitimate software and do not self-replicate; rootkits hide themselves at user or kernel level; ransomware encrypts and extorts; spyware/adware/keyloggers collect data; botnets provide remote command infrastructure; logic bombs trigger on a condition; fileless malware lives in memory or the registry using PowerShell/WMI; and backdoors/RATs give persistent remote control. Know virus subtypes: boot sector, file infector, macro, multipartite, polymorphic (changes its decryptor on each infection), metamorphic (rewrites its whole body), stealth (intercepts system calls to hide), armored , cavity , and resident versus non-resident .
674 words, about 3 min07Denial-of-Service, Session Hijacking, and Evading IDS/Firewalls/Honeypots
DoS attacks exhaust a resource: bandwidth (volumetric), connection state (protocol), or application processing. Know the classics: SYN flood (half-open connections exhaust the backlog), ICMP smurf (spoofed source plus broadcast amplification), fraggle (UDP echo/chargen variant), ping of death , teardrop (overlapping fragments), UDP/HTTP floods , Slowloris (holds many partial HTTP connections open), and amplification/reflection using DNS or NTP with spoofed source addresses.
336 words, about 2 min08Hacking Web Servers, Web Applications, and SQL Injection
Server-focused attacks target configuration and patching: banner grabbing , default or weak credentials, unnecessary HTTP methods (PUT/DELETE/TRACE), directory traversal , misconfigured permissions, exposed admin panels, virtual host enumeration, and known IIS/Apache/Nginx vulnerabilities. Hardening means removing sample files, disabling directory listing and unused modules, least-privilege service accounts, TLS configuration, and patch management.
342 words, about 2 min09Hacking Wireless Networks, Mobile Platforms, IoT, and OT
802.11 networks operate in 2.4 GHz (channels 1–14; 1, 6, 11 are non-overlapping), 5 GHz , and 6 GHz . Encryption evolution: WEP (RC4 with a short IV and CRC32 integrity - broken, crackable in minutes from IV collection), WPA (TKIP, still RC4), WPA2 (CCMP/AES, robust but vulnerable to handshake capture and offline dictionary attack), and WPA3 (SAE/dragonfly handshake, GCMP, forward secrecy).
693 words, about 3 min10Cloud Computing and Cryptography
NIST defines the essential characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service), three service models - IaaS, PaaS, SaaS - and four deployment models: public, private, community, hybrid . The shared responsibility model is the most tested idea: the provider secures the cloud (physical, hypervisor, managed service internals), the customer secures in the cloud (identities, data, configuration).
317 words, about 2 min