CPEH cheat sheet

Written authorization scope must name target ranges, testing windows, allowed techniques, and emergency contacts; anything outside that scope is unauthorized access regardless of intent.

Rules of engagement artifacts: penetration test agreement, statement of work, get-out-of-jail letter, and non-disclosure agreement serve distinct legal functions and do not substitute for one another.

Computer fraud and abuse statutes generally criminalize access exceeding authorization rather than mere access; authorization boundaries, not tool choice, define legality.

Data protection regimes impose breach notification clocks (for example 72 hours under GDPR for reportable incidents) and lawful-basis requirements that constrain what client data a tester may retain.

Payment card and health data standards (PCI DSS, HIPAA) flow down to testers handling cardholder or protected health information; minimize capture and define destruction timelines in the contract.

Vulnerability disclosure norms: coordinate privately with the vendor, agree a disclosure deadline, and avoid public release before remediation or the agreed date.

Evidence handling chain-of-custody requires timestamped, hashed copies of collected data and a documented transfer log to remain admissible and defensible.

Conflict-of-interest and competence rules: decline engagements outside demonstrated skill or where prior employment creates an independence problem, and document the recusal.

Passive reconnaissance touches no client-owned system: WHOIS, DNS history, certificate transparency logs, search engine caches, job postings, and social media.

Active footprinting sends traffic to client assets: ping sweeps, DNS zone transfer attempts, banner grabs, and port probes; it must be inside the authorized scope.

DNS record types to enumerate: A/AAAA for addresses, MX for mail, NS for authoritative servers, TXT for SPF/DMARC/verification strings, and CNAME for third-party dependencies.

Certificate transparency queries (crt.sh) reveal subdomains and internal hostnames leaked by TLS certificates without sending a single packet to the target.

Search operators narrow OSINT: site:, filetype:, inurl:, intitle:, and cached-page lookups expose documents and directory structures.

Autonomous system and netblock mapping uses WHOIS/RIR data plus BGP looking glasses to find all address space an organization announces, including acquired subsidiaries.

Email header analysis reveals sending infrastructure, relay hops, and SPF/DKIM results; mismatches indicate spoofing or misconfiguration.

Fingerprinting accuracy improves by correlating multiple signals (HTTP Server header, favicon hash, TLS certificate fields, error page wording) rather than trusting a single banner.

TCP connect scan completes the handshake and is logged by the target; SYN scan sends RST after SYN/ACK and is stealthier but needs raw socket privileges.

Nmap state meanings: open (service listening), closed (reachable, no listener), filtered (no response or ICMP unreachable), unfiltered (reachable but state indeterminate).

Host discovery options: -sn for ping-only sweeps, -Pn to skip discovery and treat hosts as up, and -PS/-PA/-PU for TCP SYN, ACK, and UDP probes.

Service and version detection (-sV) plus default scripts (-sC) converts port lists into service fingerprints; OS detection (-O) requires at least one open and one closed port.

UDP scanning is slow and unreliable because open ports often send no reply; closed ports return ICMP port unreachable, so absence of response is ambiguous.

Enumeration is active extraction: SMB null sessions and share listing, SNMP community string walks, LDAP anonymous binds, NFS exports, and DNS zone transfers.

Vulnerability assessment output must be triaged by exploitability and asset criticality; scanner severity scores alone overstate risk when the service is unreachable or compensating controls exist.

False positive reduction: confirm each finding with a manual request (banner, version string, crafted input) and record the evidence alongside the scanner reference.

Password attack classes: online guessing (rate-limited, account lockout risk), offline cracking of captured hashes, and credential stuffing using breached pairs.

Windows credential stores: SAM holds local NTLM hashes, LSASS memory holds plaintext or hashes of logged-on users, and NTDS.dit holds domain hashes on domain controllers.

Pass-the-hash reuses an NTLM hash without cracking it; pass-the-ticket reuses a Kerberos ticket; both bypass password knowledge entirely.

Linux privilege escalation checks: SUID/SGID binaries, sudo -l rights, world-writable cron jobs and service files, kernel version versus known local exploits, and capabilities.

Windows privilege escalation checks: unquoted service paths, weak service and folder ACLs, AlwaysInstallElevated registry setting, stored credentials, and token privileges such as SeImpersonate.

Kerberoasting requests service tickets for accounts with SPNs and cracks them offline; AS-REP roasting targets accounts with pre-authentication disabled.

Living-off-the-land binaries (certutil, bitsadmin, regsvr32, mshta) execute payloads using signed system utilities, reducing dropped-file artifacts.

Privilege escalation must be validated by demonstrating the new effective identity (whoami, id) and the exact command sequence, not by inference from a scanner finding.

Malware categories by propagation and payload: virus (infects files), worm (self-propagates over network), trojan (disguised), rootkit (hides), ransomware (encrypts for extortion), and infostealer (exfiltrates credentials).

Social engineering levers: authority, urgency, familiarity, reciprocity, and fear; pretexting builds a scenario, phishing is the delivery channel, and vishing/smishing are voice and SMS variants.

Client-side attack vectors: malicious macros in office documents, weaponized PDFs, browser and plugin exploits, and HTML smuggling that assembles payloads in the browser.

Payload staging separates a small stager from the full implant; common stagers are PowerShell one-liners, HTA files, and signed binary proxy execution.

Detection opportunities: parent-child process anomalies (Office spawning PowerShell), unsigned binaries in user directories, and outbound beaconing at regular intervals.

Phishing simulation metrics that matter: click rate, credential-submission rate, and report rate; report rate is the strongest predictor of resilience.

Defensive controls mapped to delivery: email authentication (SPF, DKIM, DMARC), attachment sandboxing, macro blocking, and application allowlisting.

Malware analysis triage order: static strings and imports, then sandboxed dynamic run with network capture, then memory inspection for unpacked code.

ARP spoofing poisons the gateway-to-host mapping to enable man-in-the-middle; dynamic ARP inspection and static ARP entries are the countermeasures.

VLAN hopping via switch spoofing (DTP negotiation) or double tagging; disable unused ports, set access mode explicitly, and avoid native VLAN 1.

WPA2-PSK four-way handshake capture enables offline dictionary attack; WPA3-SAE replaces the PSK exchange with a simultaneous authentication of equals resistant to offline capture.

WPA2 Enterprise (802.1X) attacks include rogue RADIUS servers to harvest credentials and evil twin access points presenting a trusted SSID.

Evil twin and captive portal attacks rely on client auto-connection behavior; management frame protection and client supplicant strictness mitigate them.

Bluetooth and RFID attack surfaces: pairing weaknesses, Bluesnarfing, and cloning of low-frequency access badges lacking cryptographic challenge-response.

Network segmentation failures turn a single compromised host into lateral movement; test by attempting to reach management VLANs and database subnets from a user segment.

DNS attacks: cache poisoning, tunneling for exfiltration, and rogue DHCP/DNS servers handing out attacker-controlled resolvers.

SQL injection classes: in-band (union, error-based), blind (boolean, time-based), and out-of-band; parameterized queries eliminate the class at the root.

Cross-site scripting types: reflected, stored, and DOM-based; output encoding by context plus a Content-Security-Policy are the primary defenses.

Insecure direct object reference and broken function-level authorization are access-control failures; test by changing identifiers and roles, not by fuzzing input.

Server-side request forgery lets the server fetch internal resources; block link-local metadata addresses and allowlist outbound destinations.

File inclusion: local file inclusion reads server files, remote file inclusion executes remote code; both stem from unsanitized path input.

Deserialization and template injection lead to remote code execution; identify by injecting arithmetic or language-specific syntax into template expressions.

Database enumeration order after injection: fingerprint the DBMS, list databases, list tables, list columns, then extract rows; limit extraction to proof-of-concept scope.

Authentication flaws to test: default credentials, credential stuffing exposure, weak session token entropy, missing logout invalidation, and absent multi-factor on privileged accounts.

Symmetric ciphers (AES) are fast and used for bulk data; asymmetric ciphers (RSA, ECC) solve key distribution and enable signatures; hybrid schemes combine both.

Hash functions provide integrity, not confidentiality; MD5 and SHA-1 are collision-broken and unsuitable for signatures or certificates.

TLS handshake establishes a shared session key via key exchange (ECDHE), authenticates the server with a certificate, and provides forward secrecy when ephemeral keys are used.

Certificate validation failures to test: expired certificates, hostname mismatch, self-signed issuers, weak signature algorithms, and incomplete chains.

Password storage must use a salted, memory-hard KDF (bcrypt, scrypt, Argon2); fast hashes like SHA-256 permit high-rate offline cracking.

Weak randomness (predictable PRNG seeds, reused nonces) breaks encryption and signatures; nonce reuse in stream modes leaks plaintext via XOR.

Downgrade and configuration weaknesses: SSLv3 POODLE, TLS 1.0/1.1 deprecation, RC4 and 3DES cipher suites, and missing HSTS.

Key management failures (hardcoded keys in source, keys in world-readable files, shared keys across environments) are as damaging as weak algorithms.

Post-exploitation goals in order: confirm access, escalate, establish persistence, harvest credentials and data, then move laterally while staying within scope.

Persistence mechanisms: scheduled tasks, services, registry Run keys, cron jobs, SSH authorized_keys, and web shells; each leaves distinct forensic artifacts.

Lateral movement techniques: pass-the-hash, remote service creation, WMI execution, PsExec-style admin share execution, and SSH key reuse.

Data exfiltration channels include DNS tunneling, HTTPS to attacker infrastructure, and cloud storage APIs; volume and timing limits define what is detectable.

Anti-forensics actions (log clearing, timestomping, secure deletion) are evidence-destruction risks; in authorized tests, document rather than actually destroy client logs.

Windows event IDs of interest: 4624 logon, 4625 failed logon, 4672 special privileges, 4688 process creation, and 7045 service installation.

Linux artifacts: auth.log entries, ~/.bash_history, cron file mtimes, and unusual SUID binaries; baseline before testing to separate your activity from real incidents.

Scope discipline during post-exploitation: stop at the agreed proof threshold (for example, a single file read) rather than exfiltrating production data.

Report structure: executive summary with business risk, methodology and scope, findings ranked by risk, evidence per finding, and remediation guidance with owners and dates.

Risk rating combines likelihood and impact; CVSS base score alone ignores asset criticality and existing controls, so contextualize every rating.

Each finding needs reproducible steps, affected asset, evidence (request/response, screenshot, log), and a specific fix, not generic advice.

Remediation prioritization: internet-facing and authentication-bypass issues first, then privilege escalation, then informational hygiene items.

Retest verifies fixes against the original evidence; a finding is closed only when the exploit path no longer works, not when a patch ticket is closed.

Defensive countermeasures to recommend: patching cadence, least privilege, segmentation, MFA, centralized logging with alerting, and application allowlisting.

Deliverable handling: encrypt reports containing credentials or sensitive data, agree distribution lists, and define retention and destruction per contract.

Metrics for program improvement: mean time to remediate by severity, repeat-finding rate, and coverage of assets tested versus assets known.