CEH study plan
CEH · Give each week a clear focus.
8 weeks · About 7 hours per week
Introduction to Ethical Hacking & Footprinting and Reconnaissance
Define each phase of the ethical hacking lifecycle and state the written authorization required before any active testing
Build an isolated virtual lab with at least one attacker VM and two target VMs, and verify network isolation from the host
Perform passive footprinting (WHOIS, DNS records, search-engine and certificate-transparency lookups) against a domain you own
Complete active footprinting (zone transfer attempt, email header review, social-media OSINT) and record what each technique reveals
Your checkpoint
A lab-build document with a network diagram plus a footprinting report listing 15 or more findings, each tagged passive or active with its data source
Scanning Networks and Enumeration
Execute host-discovery sweeps with at least two different techniques and compare which hosts each method finds
Run full TCP connect and SYN scans plus a UDP scan, and interpret open, closed, and filtered states from the output
Enable service and OS version detection and match results against banner-grabbed evidence
Enumerate SMB, DNS, SNMP, LDAP, and NTP on the lab targets and extract at least one usable account or share name
Write a scan-evasion comparison showing how timing templates and decoys change the results
Your checkpoint
A scan matrix spreadsheet mapping each scan or enumeration type to the exact command, its raw output, and a one-line interpretation, covering 10 or more techniques
Vulnerability Analysis & System Hacking
Run a credentialed and an uncredentialed vulnerability scan and explain the difference in findings
Score 10 findings with CVSS and rank them into a remediation order with justification
Crack password hashes from the lab with two different attack modes and document the time and wordlist used
Escalate privileges on a lab VM from a low-privilege account to administrator or root
Capture and analyze the artifacts a compromise leaves behind on the target system
Your checkpoint
A vulnerability assessment report with CVSS-scored findings, plus a step-by-step exploitation and privilege-escalation writeup for one lab VM
Hacking Web Servers, Web Applications, and SQL Injection
Fingerprint web servers and enumerate directories, virtual hosts, and exposed administrative interfaces on the lab targets
Demonstrate at least four web application weaknesses from authentication, session, access-control, and file-inclusion categories
Execute union-based and blind SQL injection against a deliberately vulnerable app and extract data from at least two tables
Explain and test the difference between error-based, boolean-based, and time-based injection payloads
Draft the remediation advice you would give a client for each weakness you demonstrated
Your checkpoint
A web assessment report with captured request/response evidence for each of the four or more weaknesses and a SQL injection section listing payloads, extracted data, and fixes
Malware Threats, Sniffing, and Social Engineering
Perform static analysis on a lab malware sample (strings, hashes, PE header review) and record indicators of compromise
Perform dynamic analysis in an isolated VM with process, file-system, and registry/network monitoring, then summarize behavior
Capture traffic on the lab segment and extract credentials sent over an unencrypted protocol
Design a pretexting or phishing campaign against your own organization with the indicators that would reveal it
Compare at least three types of malware and the detection signatures that expose each
Your checkpoint
A malware analysis lab report containing hashes, static and dynamic findings, a behavior timeline, and an indicator-of-compromise list, plus a one-page social-engineering awareness brief
Denial-of-Service, Session Hijacking, and Evading IDS/Firewalls/Honeypots
Launch volumetric and application-layer denial-of-service tests against a lab target and measure impact versus a baseline
Demonstrate session hijacking by capturing and replaying a session token on the lab network
Configure firewall rules and an IDS, then run scans and attacks that trigger alerts, documenting each signature
Attempt evasion techniques (fragmentation, tunneling, obfuscation) and record which ones bypassed the controls
Identify a honeypot in the lab by its behavior and list the clues that gave it away
Your checkpoint
An evasion lab log pairing each attack attempt with the control it faced, the alert or block that fired, and a verdict of detected or evaded
Hacking Wireless Networks, Mobile Platforms, IoT, and OT & Cloud Computing and Cryptography
Capture a WPA2 handshake from a lab access point and crack it with a dictionary attack, documenting the countermeasures
Enumerate Bluetooth and IoT devices on the lab bench and identify default credentials or exposed services
Explain OT protocol weaknesses and where a perimeter or segmentation control belongs in an ICS environment
Analyze a mobile app package for insecure storage and excessive permissions
Compare cloud deployment models for shared-responsibility gaps and identify misconfigured storage in a sandbox account
Distinguish symmetric, asymmetric, and hashing use cases and identify weak or misapplied cryptography in sample configurations
Your checkpoint
Two short reports (wireless/mobile/IoT and cloud/cryptography) each with five findings, the tool or evidence behind each, and a recommended control
Introduction to Ethical Hacking & Footprinting and Reconnaissance & Scanning Networks and Enumeration & Vulnerability Analysis & System Hacking & Malware Threats, Sniffing, and Social Engineering & Denial-of-Service, Session Hijacking, and Evading IDS/Firewalls/Honeypots & Hacking Web Servers, Web Applications, and SQL Injection & Hacking Wireless Networks, Mobile Platforms, IoT, and OT & Cloud Computing and Cryptography
Re-sit every domain quiz and re-study only the domains scoring below 75 percent
Rebuild the weakest three lab exercises from memory without notes
Take two full-length timed practice exams and review every missed item to its underlying concept
Memorize the tool-to-task mapping and the legal and ethical constraints tested across domains
Your checkpoint
A final review sheet with per-domain practice scores, the specific weak concepts from each missed question, and a one-page tool-to-task cheat sheet
Milestones
Week 2: Lab is isolated and reproducible; you can explain the output of a SYN scan, a UDP scan, and one enumeration tool without notes
Week 4: Score 70 percent or higher on a 60-question practice set covering domains 1 through 5 and 8
Week 6: Every attack you launched in the lab has a matching detection or control documented in your evasion log
Week 8: Score 85 percent or higher on two consecutive full-length timed practice exams, with no domain below 75 percent