CEH Study Guide — How to Pass Certified Ethical Hacker

Weeks 1–3

Reconnaissance and Scanning: footprinting, passive/active recon, network scanning, enumeration

Tip: The CEH exam tests tools by name and phase. Know: Maltego and theHarvester (passive OSINT), Nmap (active scanning — know key flags: -sS SYN scan, -sV version detection, -O OS fingerprinting, -A all detection, -p port range), Nessus (vulnerability scanning), and Metasploit (exploitation framework).

Weeks 4–6

System Hacking and Malware: access, privilege escalation, persistence, malware types

Tip: System hacking phases on CEH: gaining access → escalating privileges → maintaining access → clearing logs. Know the techniques at each phase: password cracking (rainbow tables, brute force, dictionary attacks), privilege escalation (kernel exploits, SUID abuse), backdoors (netcat listeners, Meterpreter), and log clearing (Metasploit clearev, manual log deletion).

Weeks 7–9

Network Attacks: sniffing, DoS/DDoS, session hijacking, social engineering, web attacks

Tip: Web application attacks are tested in depth: SQL injection (know UNION-based, blind, and time-based blind SQLi), XSS (reflected, stored, DOM-based), CSRF, file inclusion (LFI, RFI), command injection, and IDOR. Know what OWASP is and that the OWASP Top 10 is the CEH web attack reference.

Weeks 10–14

Advanced Topics: wireless attacks, IoT hacking, cloud hacking, cryptography, mobile

Tip: Wireless attack techniques: WPA2 handshake capture (deauthenticate a client, capture 4-way handshake, crack offline with aircrack-ng), evil twin AP (rogue AP with same SSID as legitimate network), and WPS PIN attack (reaver). Know the attack type and the tool used for each.