CPEH study plan
CPEH · Give each week a clear focus.
8 weeks · About 6 hours per week
Scanning, Enumeration, and Vulnerability Assessment & System Hacking and Privilege Escalation
Configure a virtual lab with at least two target machines (e.g., Metasploitable, DVWA) and one attacker VM, and verify network connectivity.
Execute a full TCP/UDP port scan using Nmap with service and version detection, and document the open ports and services for each target.
Perform enumeration on at least three services (e.g., SMB, SSH, HTTP) using appropriate tools (e.g., enum4linux, Nikto, gobuster) and record findings.
Exploit a known vulnerability on a target to gain an initial shell, and document the exact steps and commands used.
Escalate privileges on the compromised target using at least one technique (e.g., sudo misconfiguration, SUID binary) and capture proof (screenshot or flag).
Your checkpoint
A lab report (PDF) containing scan results, enumeration outputs, exploitation steps, and privilege escalation evidence for two different targets.
Network and Wireless Exploitation & Web Application and Database Exploitation
Set up a wireless lab (e.g., using a compatible adapter and a virtual or physical access point) and capture a WPA2 handshake.
Crack the captured WPA2 handshake using a wordlist attack (e.g., aircrack-ng) and document the process.
Identify and exploit at least two web application vulnerabilities (e.g., SQL injection, XSS) on a deliberately vulnerable web app (e.g., DVWA, bWAPP).
Use SQLMap to automate the exploitation of a SQL injection vulnerability and extract data from the database.
Perform a database enumeration and privilege escalation attack (e.g., via MySQL UDF) in the lab environment.
Your checkpoint
A video walkthrough (5–10 minutes) demonstrating the wireless attack and web/database exploitation, with a written summary of the vulnerabilities and fixes.
Reconnaissance and Footprinting & Malware, Social Engineering, and Client-Side Attacks
Conduct passive reconnaissance on a target domain (e.g., using whois, DNS enumeration, and OSINT tools) and compile a footprinting report.
Perform active reconnaissance (e.g., ping sweeps, banner grabbing) on the lab network and compare with passive results.
Craft a phishing email and a malicious payload (e.g., using Social-Engineer Toolkit) and test it in a controlled environment.
Analyze malware behavior using a sandbox (e.g., Cuckoo, Any.Run) and document indicators of compromise (IOCs).
Deliver a social engineering awareness briefing to a non-technical audience (record a 3-minute video).
Your checkpoint
A footprinting and social engineering report (PDF) including the reconnaissance data, phishing email sample, malware analysis summary, and awareness video link.
Cryptography and Secure Communications & Post-Exploitation, Persistence, and Covering Tracks
Implement and test a VPN (e.g., OpenVPN) and analyze its encryption and handshake process.
Exploit a weak SSL/TLS configuration (e.g., using testssl.sh or sslyze) and document the findings.
Establish persistence on a compromised lab machine using at least two methods (e.g., scheduled task, registry run key) and verify survival after reboot.
Cover tracks by clearing event logs and manipulating timestamps, and then detect those changes using forensic tools.
Perform a man-in-the-middle attack (e.g., ARP spoofing) and capture encrypted traffic to demonstrate the importance of proper crypto.
Your checkpoint
A technical memo (2 pages) detailing the crypto weaknesses found, persistence mechanisms used, and a detection guide for defenders.
Ethics, Legal Frameworks, and Compliance & Reporting, Remediation, and Defensive Countermeasures
Review the laws and regulations relevant to penetration testing (e.g., CFAA, GDPR, PCI DSS) and summarize key compliance requirements.
Draft a rules of engagement (RoE) document and a penetration testing agreement for a hypothetical client.
Write an executive summary and a technical report for a previous lab exercise, following a standard template.
Develop a remediation plan for the vulnerabilities discovered in weeks 1–4, prioritizing by risk.
Create a defensive countermeasures checklist (e.g., hardening guides, monitoring recommendations) for the lab environment.
Your checkpoint
A complete penetration test report (PDF) including executive summary, technical findings, risk ratings, and remediation recommendations, plus a signed RoE template.
Scanning, Enumeration, and Vulnerability Assessment & System Hacking and Privilege Escalation
Perform an automated vulnerability scan (e.g., OpenVAS, Nessus) on the lab network and analyze the results.
Exploit a vulnerability identified by the scanner and document the process.
Use advanced privilege escalation techniques (e.g., kernel exploits, token impersonation) on a Windows target and capture proof.
Conduct a full attack chain from reconnaissance to domain admin in a Windows AD lab (e.g., using BloodHound, Mimikatz).
Document all steps and create a timeline of the attack.
Your checkpoint
A red team simulation report (PDF) with the attack narrative, timeline, and evidence of domain admin compromise.
Network and Wireless Exploitation & Web Application and Database Exploitation
Exploit a network service vulnerability (e.g., SMB relay, ARP poisoning) and capture credentials.
Perform a web application attack chain (e.g., from XSS to session hijacking) and document the impact.
Exploit a database vulnerability to achieve remote code execution (e.g., via MSSQL xp_cmdshell) and document the steps.
Conduct a wireless attack beyond WPA2 (e.g., evil twin, captive portal) and evaluate its effectiveness.
Create a cheat sheet of commands and tools for network and web exploitation.
Your checkpoint
A practical cheat sheet (PDF) and a video demonstration of at least two advanced exploitation techniques.
Ethics, Legal Frameworks, and Compliance & Reconnaissance and Footprinting & Malware, Social Engineering, and Client-Side Attacks & Cryptography and Secure Communications & Post-Exploitation, Persistence, and Covering Tracks & Reporting, Remediation, and Defensive Countermeasures
Review all domains using practice questions and identify weak areas.
Take a full-length practice exam under timed conditions and score at least 80%.
Revisit and reinforce ethical and legal concepts, especially those related to reporting and compliance.
Simulate a client debrief: present findings and recommendations from a previous report to a mock stakeholder.
Finalize a personal study summary and resource list for future reference.
Your checkpoint
A practice exam score report with a personalized remediation plan for any weak domains, plus a recorded 5-minute client debrief presentation.
Milestones
Week 2: Successfully exploit at least one network service and one web application vulnerability, with evidence captured in a report.
Week 4: Demonstrate persistence and covering tracks on a target, and produce a detection guide that identifies those techniques.
Week 6: Achieve domain admin on the Windows AD lab and submit a red team report with a complete attack timeline.
Week 8: Score 80% or higher on the practice exam and deliver a client-ready debrief presentation.