PECB Certified Lead Ethical Hacker cheat sheet

Passive reconnaissance (OSINT) sends no packets to the target: WHOIS, DNS records, certificate transparency logs (crt.sh), search engines, and public code repositories are queried through third parties.

Active reconnaissance contacts the target directly: DNS zone transfer attempts (dig AXFR), port scanning, banner grabbing, and service version detection; it is detectable and requires authorization scope.

DNS enumeration record types: A/AAAA map hostnames to IPv4/IPv6, MX lists mail exchangers, NS lists authoritative servers, TXT exposes SPF/DMARC/verification strings, CNAME reveals third-party hosting.

Certificate transparency search reveals subdomains because every issued TLS certificate is logged publicly; querying crt.sh by domain returns SAN entries for internal or staging hostnames.

Search engine operators narrow OSINT: site: restricts to a domain, filetype: targets document types, inurl:/intitle: match URL and title strings, and minus (-) excludes terms.

Nmap scan states: open (service listening), closed (reachable host, no listener), filtered (no response or ICMP unreachable, likely firewall), and unfiltered (reachable but state indeterminate).

TCP SYN scan (-sS) never completes the handshake, so it is faster and less likely to be logged by the application; TCP connect scan (-sT) completes the handshake and works without raw-socket privileges.

Google dorking and Shodan/Censys queries index exposed services and metadata; results are third-party cached data and must be validated before being reported as findings.

STRIDE maps threats to properties: Spoofing breaks authentication, Tampering breaks integrity, Repudiation breaks non-repudiation, Information disclosure breaks confidentiality, Denial of service breaks availability, Elevation of privilege breaks authorization.

DREAD scores Damage, Reproducibility, Exploitability, Affected users, and Discoverability; each is rated (commonly 1-10) and the average ranks risk, though it is subjective and largely deprecated in favor of CVSS.

CVSS v3.1 base score combines Exploitability (Attack Vector, Attack Complexity, Privileges Required, User Interaction) with Impact (Confidentiality, Integrity, Availability); 9.0-10.0 is Critical, 7.0-8.9 High.

Attack Vector values in CVSS v3.1 are Network, Adjacent, Local, and Physical; a Network vector with no privileges or user interaction yields the highest exploitability sub-score.

Threat modeling data-flow diagrams identify trust boundaries; every crossing of a trust boundary is a candidate for threat enumeration, and each threat should map to a mitigating control.

Vulnerability scanning (Nessus, OpenVAS, Qualys) compares banners and signatures to known CVEs; results are candidates, and false positives must be confirmed by manual validation or exploitation.

Authenticated (credentialed) scans inspect installed packages and registry keys and produce far fewer false positives than unauthenticated network scans, which rely on remote fingerprinting.

CVE identifies a specific vulnerability; CVSS scores its severity; CWE classifies the weakness type; CPE names the affected product and version. Each answers a different question.

Metasploit workflow: search module, use it, show options, set RHOSTS/LHOST/LPORT and payload, check (if supported), exploit; a reverse shell payload connects back to the attacker and bypasses inbound firewall rules.

Bind shells listen on the target and require inbound access; reverse shells originate from the target, so they traverse NAT and egress-permitting firewalls more reliably.

SQL injection types: in-band (UNION-based, error-based), blind (boolean-based, time-based), and out-of-band; UNION requires matching column count and compatible data types.

Cross-site scripting is stored, reflected, or DOM-based; the decisive control is context-aware output encoding plus a Content-Security-Policy, not input filtering alone.

Command injection succeeds when user input reaches a shell; blind confirmation uses time delays (e.g., sleep/ping) and out-of-band callbacks (DNS or HTTP) to prove execution.

Buffer overflow exploitation requires controlling the instruction pointer, locating the offset, and redirecting execution; modern mitigations are ASLR (randomized addresses), DEP/NX (non-executable stack), and stack canaries.

File upload bypasses include changing Content-Type, double extensions (.php.jpg), null bytes, and .htaccess reconfiguration; validation must occur server-side on content, not just the filename.

Password attacks: online guessing is rate-limited and lockout-prone; offline cracking of captured hashes (Hashcat, John) is limited only by hash algorithm, hardware, and wordlist quality.

Linux enumeration priorities: kernel version and missing patches, SUID/SGID binaries, sudo -l rights, cron jobs writable by the current user, world-writable files, and credentials in config or history files.

GTFOBins catalogs Unix binaries that can escape restricted shells or elevate privileges when granted sudo rights or SUID bits (e.g., find, vim, awk, less).

SUID abuse: a root-owned binary with the SUID bit runs as root; if it can spawn a shell or read arbitrary files, the effective user becomes root without any password.

sudo misconfigurations include NOPASSWD entries, wildcard arguments that allow injection, and environment variable retention (LD_PRELOAD, LD_LIBRARY_PATH) that loads attacker libraries into a root process.

Windows escalation checks: whoami /priv for token privileges (SeImpersonatePrivilege, SeDebugPrivilege), unquoted service paths, weak service and folder permissions, and AlwaysInstallElevated registry keys.

SeImpersonatePrivilege enables token theft and impersonation attacks (e.g., Potato-family exploits); SeDebugPrivilege allows attaching to and reading memory of higher-privileged processes.

Unquoted service paths containing spaces let an attacker place a malicious executable earlier in the search order (e.g., C:\Program.exe) that the service then runs as SYSTEM.

Credential access on Windows: LSASS memory dumping (Mimikatz), SAM/SYSTEM hive extraction for offline hash cracking, and cached domain credentials; detection depends on protected process light and EDR.

Pivoting routes traffic through a compromised host to reach otherwise unreachable internal networks; common methods are SSH dynamic forwarding (-D, SOCKS proxy), Metasploit route/autoroute, and proxy chains.

SSH local forward (-L) sends a local port to a remote destination; remote forward (-R) exposes an attacker service to the target network; dynamic forward (-D) creates a SOCKS proxy for arbitrary destinations.

Metasploit autoroute adds a route through an existing session; the module requires a session ID and subnet, after which modules can target the internal range directly.

Proxychains wraps TCP client tools through a SOCKS or HTTP proxy chain; DNS resolution must be handled deliberately (proxy_dns) because DNS leaks can reveal the real client.

File transfer over HTTP: python3 -m http.server on the attacker, then wget or curl on the target; PowerShell uses Invoke-WebRequest, and certutil -urlcache -f downloads files on Windows.

Netcat transfers: nc -lvnp 4444 > file on the receiver and nc 4444 < file on the sender; the connection is unencrypted, so integrity and confidentiality are not protected.

Egress filtering blocks outbound ports; fallback channels include DNS tunneling, ICMP tunneling, and HTTPS on 443, which is commonly allowed through perimeter firewalls.

Data exfiltration controls: hash files before and after transfer (sha256sum, Get-FileHash), encode binaries (base64) to avoid corruption, and keep transferred artifacts inside the authorized scope.

A finding entry contains title, affected asset and version, severity with CVSS vector string, description, reproduction steps, evidence (redacted), business impact, and remediation with references.

Executive summaries state business risk and overall posture in non-technical language; technical detail belongs in the findings body or appendix, not the summary.

CVSS vector strings make severity reproducible: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is a 9.8 Critical remote unauthenticated compromise.

Evidence handling: capture timestamps, commands, and outputs, redact credentials and personal data, and store artifacts with integrity hashes under a documented chain of custody.

Risk rating should combine technical severity with business context (asset criticality, data sensitivity, exposure); a High CVSS on an isolated test host may rank below a Medium on a payment system.

Remediation guidance should be specific and prioritized: patch version, configuration change, compensating control, and owner; vague advice such as "improve security" is not actionable.

Retesting verifies that fixes actually close the finding; the report notes the retest date, method, and result, and unresolved items remain open with an agreed risk acceptance.

Report structure commonly follows: scope and rules of engagement, methodology, summary of findings by severity, detailed findings, and appendices (tool output, scope list, glossary).