PECB Certified Lead Ethical Hacker study plan
PECB Certified Lead Ethical Hacker · Give each week a clear focus.
8 weeks · About 6 hours per week
Information gathering tools and techniques
Distinguish passive versus active reconnaissance and select the appropriate mode for a given engagement scope statement
Configure and run DNS, WHOIS, certificate-transparency, and subdomain enumeration queries against a lab target you own
Capture OSINT findings on a fictional target organization using only public sources and document the source of each fact
Map each gathered data point to the type of attack surface it reveals (people, infrastructure, application, physical)
Your checkpoint
A reconnaissance log for a self-owned lab domain listing at least 25 findings, each with the tool used, the command or query, and the attack-surface category it maps to
Information gathering tools and techniques
Perform service and version discovery with at least two scanning tools and reconcile differences between their outputs
Analyze scan results to identify exposed services, weak configurations, and unexpected open ports
Apply rate limiting and timing options to reduce scan footprint and explain when stealth matters versus when it does not
Document scanning activity in a form that would satisfy an engagement's rules-of-engagement logging requirement
Your checkpoint
A scan analysis report of one lab host that lists every discovered service, flags at least five configuration weaknesses, and records the exact commands and timestamps used
Threat modeling and vulnerability identification
Build a data-flow diagram for a small three-tier lab application that shows trust boundaries and entry points
Apply a structured threat modeling method to enumerate threats against each trust boundary
Rate identified threats using a consistent scoring approach and justify each rating
Prioritize the threat list and select the top items to carry into exploitation testing
Your checkpoint
A threat model document for the lab application containing the diagram, at least 15 enumerated threats with ratings, and a ranked shortlist of five threats to test
Threat modeling and vulnerability identification
Correlate scanner output with manual verification to eliminate false positives
Classify vulnerabilities by root cause rather than by tool signature
Trace each confirmed vulnerability back to the threat it enables in your week 3 model
Draft remediation guidance for each confirmed finding that names the specific control to change
Your checkpoint
A validated vulnerability register of at least 10 confirmed issues, each linked to a threat-model entry, with a false-positive rate calculated against raw scanner output
Exploitation techniques
Execute exploitation against your own lab targets for at least three distinct vulnerability classes
Select payloads and delivery methods appropriate to the target's operating system and network position
Record every attempt, including failures, with the exact command, timestamp, and observed result
Apply the minimum action needed to demonstrate impact and stop before causing unnecessary change
Your checkpoint
An exploitation log covering three vulnerability classes with reproducible command sequences and a one-paragraph impact statement for each successful compromise
Privilege escalation
Enumerate local misconfigurations on a compromised lab host that could yield higher privileges
Escalate from a low-privilege account to administrative or root access on at least one Linux and one Windows lab host
Explain the specific misconfiguration behind each successful escalation and the control that would have prevented it
Document a remediation step for each escalation path you demonstrated
Your checkpoint
A privilege escalation dossier with two worked paths (one per platform), each including the enumeration evidence, the escalation command, and the preventive control
Pivoting and file transfers
Set up a tunnel through a lab pivot host and reach a target that is not directly routable from your attack machine
Transfer files between hosts using at least three different methods and note which ones evade common egress controls
Compare tunneling options on reliability, detectability, and setup cost for a given scenario
Record network diagrams and commands so another tester could reproduce the pivot
Your checkpoint
A pivoting and transfer guide containing a network diagram of the pivot chain, working commands for three transfer methods, and a comparison table of tunneling options
Exploitation techniques & Reporting
Consolidate all prior artifacts into a single engagement report with executive summary, technical findings, and evidence appendix
Write findings so that both a non-technical executive and a system administrator can act on them
Rate findings by risk and pair each with concrete, testable remediation advice
Review the report against a peer checklist for missing evidence, unsupported claims, and unclear language
Your checkpoint
A complete mock penetration test report of 10 to 15 pages covering all six domains, reviewed against a self-built quality checklist with at least 10 checkpoints
Milestones
Week 2: You can run a full reconnaissance and scanning pass on a lab target and explain what each result means for attack surface, without consulting notes
Week 4: You have a threat model and a validated vulnerability register where every confirmed issue traces back to a modeled threat
Week 6: You have demonstrated both initial exploitation and privilege escalation on your own lab hosts, with reproducible evidence for each step
Week 8: You have a finished mock report that an independent reader could use to reproduce your findings and prioritize fixes