SECURE IN SECURITY
— Certified Ethical Hacker (CEH) v13
Contact / About / Policy
Certified Ethical Hacker
CEH v13
CEH v13
EC-Council · Comprehensive Certification Reference
1. Introduction and Certification Overview
The Certified Ethical Hacker (CEH) is one of the most recognized and widely held cybersecurity certifications in the world. Developed and administered by EC-Council (the International Council of E-Commerce Consultants), the CEH certification validates a practitioner’s knowledge and practical skills in the methodologies, tools, and techniques used by malicious hackers — with the explicit purpose of enabling security professionals to think and act like an adversary in order to better defend organizational systems and networks.
Now in its thirteenth version, the CEH has evolved from a largely theoretical examination into a dual-component program that combines a comprehensive knowledge exam with a rigorous practical assessment. The certification is held by hundreds of thousands of security professionals across more than 140 countries and is recognized by the US Department of Defense (DoD), NATO, and numerous global enterprises as a benchmark qualification for security roles.
The core philosophy of ethical hacking — using the same knowledge, tools, and methodologies as malicious attackers, but with explicit authorization and the goal of improving security — distinguishes the CEH from purely defensive certifications. Ethical hackers occupy a unique position in the security ecosystem: they must understand offensive techniques deeply enough to replicate them, while operating within legal and ethical boundaries that govern authorized testing engagements.
Key Concept
The CEH certification is fundamentally about understanding the attacker mindset. EC-Council’s premise is that a security professional who cannot think like a hacker cannot effectively defend against one. The certification’s 20 domains map directly to the phases and techniques of a real-world attack lifecycle, ensuring that certified professionals understand not only what to defend against but how attacks are actually executed — and therefore where defensive controls have the greatest impact.
Certification at a Glance
| Item | Detail |
|---|---|
| Full Name | Certified Ethical Hacker (CEH) |
| Issuing Body | EC-Council — International Council of E-Commerce Consultants |
| Current Version | CEH v13 (released 2024, incorporating AI-integrated hacking modules) |
| Exam Code | 312-50 (Knowledge Exam) |
| Exam Format | 125 multiple-choice questions |
| Exam Duration | 4 hours |
| Passing Score | Approximately 60–85% (varies by exam form — EC-Council uses a cut-score methodology) |
| Practical Exam | CEH Practical — 6-hour hands-on lab exam, 20 real-world challenges on live targets |
| Validity Period | 3 years; renewal through continuing education credits (ECE) or retake |
| EC Credits Required | 120 EC-Council Continuing Education (ECE) credits over 3 years for renewal |
| Prerequisites | 2 years of information security work experience OR completion of EC-Council’s official CEH training |
| DoD Approval | Approved under DoD 8570 / 8140 for IAT Level II, IAM Level I, and IASAE Level I roles |
| Recognition | US DoD, NATO, Fortune 500 companies, government agencies across 140+ countries |
| Exam Delivery | Pearson VUE testing centers globally; EC-Council’s own ECC EXAM center |
| Cost (approx.) | USD $1,199 (exam voucher); CEH Master (Knowledge + Practical) available as combined program |
2. History and Evolution of the CEH Certification
The CEH was first introduced by EC-Council in 2003 in response to growing industry demand for standardized ethical hacking knowledge. At its inception, the certification provided a structured framework for the ad hoc skill sets that penetration testers and security consultants had accumulated through self-study and experience. Over two decades, it has evolved through thirteen versions, each expanding scope to reflect changes in the threat landscape, technology environment, and professional practice standards.
| Version | Year | Key Additions / Changes |
|---|---|---|
| v1 – v3 | 2003–2008 | Initial certification framework; foundational ethical hacking modules; hacking methodologies, network scanning, system hacking, trojans, sniffers, social engineering, denial of service, session hijacking, web server hacking, web application attacks, SQL injection |
| v4 – v5 | 2009–2011 | Expanded cryptography module; wireless network hacking; evading IDS and firewalls; honeypots; buffer overflows; penetration testing methodology formalized |
| v6 | 2012 | Mobile platform hacking added; cloud computing security introduced; social engineering expanded; updated tool coverage to reflect current attacker toolsets |
| v7 | 2013 | Updated malware analysis; advanced persistent threats (APTs); post-exploitation techniques; introduction of hacking mobile platforms with dedicated module |
| v8 | 2014 | Internet of Things (IoT) hacking introduced; advanced SQL injection; updated web application attack content; packet crafting with Scapy |
| v9 | 2016 | Major restructuring to 18 modules; updated to reflect current threat intelligence; integration of current commercial and open-source tool coverage; updated legal and ethical framework |
| v10 | 2018 | 20-module structure established; complete overhaul of tool references; introduction of CEH Practical exam; enhanced cloud hacking; OT/SCADA threats added |
| v11 | 2020 | IoT attack vectors expanded; OT/ICS hacking deepened; updated malware analysis; fileless malware; supply chain attacks; COVID-era remote work threat landscape |
| v12 | 2022 | AI and machine learning in hacking added; updated cloud security attacks; enhanced container and Kubernetes security; improved hands-on lab integration with iLabs platform |
| v13 | 2024 | AI-integrated hacking as a primary theme throughout all modules; generative AI for attack automation; deepfake social engineering; AI-powered malware; updated tools across all domains; enhanced CEH Practical with AI-based scenarios |
3. Eligibility, Prerequisites, and Application Process
EC-Council applies a formal eligibility verification process to CEH candidates to ensure that the certification is held by professionals with appropriate foundational knowledge and legitimate security career intent. Eligibility can be established through one of two pathways — work experience or official training — each with distinct documentation requirements.
Eligibility Pathways
| Item | Detail |
|---|---|
| Pathway 1: Work Experience | Candidates with a minimum of 2 years of information security work experience may apply directly to sit the exam without completing official EC-Council training. Application requires submission of a completed eligibility application form with verification of work experience, payment of a non-refundable USD $100 eligibility application fee, and written acceptance of the Non-Disclosure Agreement (NDA). EC-Council reserves the right to request additional verification of work experience claims. |
| Pathway 2: Official Training | Candidates who complete an EC-Council Accredited Training Center (ATC) course, an EC-Council iLearn (online self-study) program, or an accredited university partner course in CEH are eligible to sit the exam without the work experience requirement. Training completion must be verified by EC-Council at the time of exam registration. This pathway is the recommended route for candidates entering information security or transitioning from adjacent technical fields. |
| Military / Government Pathway | Active and veteran US military personnel and US government employees are eligible for special pricing and streamlined eligibility through EC-Council’s partnership with the Department of Defense. DoD 8570 compliance requirements make the CEH a commonly funded certification for military cybersecurity roles. |
Recommended Foundation Knowledge
While EC-Council does not prescribe specific prerequisite certifications, candidates without extensive information security experience are strongly advised to establish foundational knowledge in the following areas before pursuing the CEH:
- Networking FundamentalsTCP/IP protocol stack, OSI model, subnetting, routing protocols, DNS, DHCP, HTTP/S, FTP, SMTP. Understanding how networks operate is a prerequisite for understanding how they are attacked. CompTIA Network+ or equivalent knowledge is recommended.
- Operating System ProficiencyWindows and Linux administration, file system navigation, user and permission management, process management, registry, and command-line proficiency. The practical exam and many real-world scenarios require hands-on command-line operation on both platforms.
- Security FundamentalsCIA Triad, encryption concepts, authentication mechanisms, firewalls, IDS/IPS, VPNs, and access control models. CompTIA Security+ or equivalent is widely recommended as a foundation before pursuing CEH.
- Scripting and Programming BasicsPython, Bash, or PowerShell scripting fundamentals enable candidates to understand and evaluate tools, write simple exploitation scripts, and comprehend code-level attack techniques covered in the exam. Deep programming expertise is not required, but scripting literacy is advantageous.
Tip
EC-Council provides the CEH iLearn self-paced online training program which includes 125+ hours of video instruction, lab exercises, and practice questions. For candidates without the required work experience, or who prefer structured preparation, this is the most direct path to exam eligibility. The program also provides access to EC-Council’s iLabs virtual lab environment — particularly important for hands-on practice before the practical exam.
4. Exam Structure and Format
Knowledge Exam (312-50)
The CEH knowledge exam (exam code 312-50) is a 125-question multiple-choice examination with a 4-hour time limit, delivered through Pearson VUE testing centers or EC-Council’s own ECC EXAM platform. The exam tests theoretical knowledge and applied understanding across all 20 exam domains, with questions that range from straightforward factual recall to scenario-based analysis requiring candidates to apply concepts to realistic attack and defense situations.
| Item | Detail |
|---|---|
| Question Format | Multiple-choice (single correct answer); some scenario-based questions with exhibit graphics showing network diagrams, tool outputs, or code snippets that candidates must analyze |
| Number of Questions | 125 questions |
| Time Allowed | 4 hours (240 minutes) |
| Passing Score | EC-Council uses a scaled score methodology; the passing threshold varies per exam form but is typically in the range of 60–85%. Candidates should prepare to score 75%+ to ensure a comfortable margin. |
| Exam Delivery | Pearson VUE testing centers (in-person) or EC-Council ECC EXAM (online proctored) |
| Question Language | English; some languages available at specific testing centers |
| Score Reporting | Immediate pass/fail result at test center; detailed score report by domain available after exam |
| Retake Policy | If failed: 14-day wait before first retake; 14-day wait before second retake; 14-day wait with EC-Council retake form required for third and subsequent retakes |
| NDA Requirement | Candidates must agree to the EC-Council NDA before and during the exam; violation results in immediate disqualification and potential credential revocation |
CEH Practical Exam
The CEH Practical is a 6-hour hands-on examination conducted entirely in a live virtual environment. Unlike the knowledge exam, the practical exam does not present multiple-choice questions — it presents 20 real-world challenge scenarios on live targets where candidates must demonstrate the ability to actually perform the techniques, not merely identify them. The practical exam is widely regarded as significantly more challenging than the knowledge exam and is highly valued by employers because it demonstrates operational, not just theoretical, competency.
| Item | Detail |
|---|---|
| Format | Fully hands-on; 20 scenario-based challenges on live virtual machine targets |
| Duration | 6 hours (360 minutes) |
| Environment | Live virtual lab with Windows and Linux targets, network infrastructure, web applications, and databases |
| Tools Available | Full toolkit available: Nmap, Metasploit, Wireshark, Burp Suite, Hydra, John the Ripper, OpenStego, and many others |
| Passing Score | 70% (14 of 20 challenges completed correctly) |
| Delivery | Online only through EC-Council’s iLabs platform; remote proctored |
| Topics Covered | Network scanning, enumeration, vulnerability analysis, system hacking, web application attacks, SQL injection, cryptography, sniffing, social engineering, malware analysis, steganography, session hijacking |
| Retake Policy | Available after a 14-day waiting period; each attempt requires a separate exam voucher |
| CEH Master Designation | Candidates who pass both the knowledge exam AND the practical exam earn the CEH Master designation — the highest tier of the CEH certification program |
Key Concept
The CEH Practical is increasingly the differentiating factor for hiring decisions. Many employers — particularly those seeking penetration testers, red team members, and security analysts — specifically look for CEH Master candidates or candidates who have passed the practical exam, as it provides evidence of hands-on capability that the knowledge exam alone cannot demonstrate. Candidates serious about operational security roles should plan to complete both exam components.
5. The 20 CEH Exam Domains — Complete Reference
The CEH v13 examination is organized across 20 domains that collectively map the complete attack lifecycle — from pre-attack reconnaissance through active exploitation to post-exploitation activities. Each domain represents a distinct phase or specialization within the ethical hacking discipline. The approximate weighting of each domain in the exam is not publicly disclosed by EC-Council, but all domains appear in the examination and in the official courseware.
The domains are presented in the sequence of the ethical hacking methodology — beginning with information gathering and footprinting, progressing through scanning and enumeration, moving into exploitation phases, and concluding with post-exploitation and report writing. Understanding this sequential logic helps candidates see how domains connect to each other in a real engagement, not just as isolated exam topics.
| Domain | Focus, Techniques & Key Tools |
|---|---|
| 01 Introduction to Ethical Hacking | Covers the foundational concepts underpinning the entire certification: information security terminology, cyber kill chain, hacking concepts and attacker classifications (white hat, gray hat, black hat), ethical hacking phases, security controls, information assurance (IA), risk management, and the legal and regulatory framework governing authorized penetration testing. Introduces the MITRE ATT&CK framework and threat intelligence concepts. Establishes the ethical and legal boundaries within which all subsequent domains operate. |
| 02 Footprinting and Reconnaissance | The first active phase of ethical hacking: gathering maximum information about a target organization using passive and active techniques. Passive reconnaissance uses publicly available sources: WHOIS, DNS records, Google dorking, Shodan, LinkedIn, job postings, company websites, and social media. Active reconnaissance involves direct interaction: DNS interrogation (zone transfers, reverse lookups), email header analysis, competitive intelligence, and website mirroring. AI-enhanced OSINT techniques added in v13. Key tools: Maltego, Recon-ng, theHarvester, Shodan, Metagoofil, FOCA. |
| 03 Scanning Networks | Systematic discovery of live hosts, open ports, running services, and operating systems on target networks. Covers TCP/IP fundamentals relevant to scanning, ICMP scanning, TCP connect scanning, SYN (half-open) scanning, UDP scanning, stealth scanning techniques (FIN, Xmas, NULL scans), banner grabbing, OS fingerprinting, and network topology mapping. Firewall and IDS evasion techniques for scanning: fragmentation, decoy scanning, source port manipulation, idle scanning. Key tools: Nmap (comprehensive coverage), Hping3, Zenmap, Angry IP Scanner. |
| 04 Enumeration | Extracting detailed information from identified systems: usernames, group names, network shares, services, banners, audit and service settings, and routing tables. Covers NetBIOS enumeration, SNMP enumeration, LDAP enumeration, NTP enumeration, SMTP enumeration, DNS enumeration, IPsec enumeration, VoIP enumeration, and RPC enumeration. Enumerating Windows and Linux systems specifically. Understanding what information enumeration provides to an attacker and what defensive measures limit exposure. Key tools: Enum4Linux, SNMPwalk, NBTScan, DIG, Nmap NSE scripts. |
| 05 Vulnerability Analysis | Identifying and classifying security weaknesses in target systems and applications. Covers the vulnerability management lifecycle, CVE/CVSS scoring, vulnerability classification (misconfigurations, default credentials, unpatched software, design flaws), network and infrastructure vulnerability scanning, web application vulnerability scanning, and database vulnerability assessment. Introduces vulnerability research methodologies and sources: NVD, Exploit-DB, CVEdetails, vendor security advisories. Key tools: Nessus, OpenVAS, Nexpose, QualysGuard, Nikto. |
| 06 System Hacking | The central offensive domain: gaining access to target systems after reconnaissance and scanning phases. Covers the four-phase system hacking methodology: (1) Gaining Access — password cracking (dictionary, brute force, hybrid, rainbow table attacks), vulnerability exploitation, privilege escalation techniques; (2) Escalating Privileges — local privilege escalation on Windows and Linux, DLL hijacking, access token manipulation; (3) Maintaining Access — Trojan installation, rootkits, backdoors, steganography for covert communication; (4) Clearing Tracks — log manipulation, covering tracks, NTFS alternate data streams. Key tools: Metasploit, Mimikatz, John the Ripper, Hashcat, L0phtCrack, PowerSploit. |
| 07 Malware Threats | Understanding malware types, propagation mechanisms, and defensive countermeasures. Covers Trojan horses (command-and-control architecture, RAT installation), viruses (file infectors, macro viruses, boot sector viruses), worms (propagation mechanisms, network exploitation), ransomware (encryption mechanisms, deployment methods, negotiation avoidance), rootkits (kernel-level vs. user-level), spyware, adware, fileless malware, and APT malware. Malware analysis techniques: static analysis (file properties, strings, PE headers), dynamic analysis (sandbox execution, process monitoring, network traffic analysis), and code analysis. AI-powered malware generation covered in v13. Key tools: Process Monitor, Process Hacker, Cuckoo Sandbox, VirusTotal, Any.run, IDA Pro, Ghidra. |
| 08 Sniffing | Intercepting and analyzing network traffic to extract sensitive information. Covers active and passive sniffing, MAC flooding, DHCP attacks (starvation and rogue DHCP), ARP poisoning/ARP spoofing (man-in-the-middle attacks on local networks), DNS poisoning, VLAN hopping, STP attacks, and NTP attacks. Sniffing encrypted protocols and SSL/TLS interception. Analyzing captured traffic: identifying credentials, session tokens, and sensitive data in plaintext protocols. Countermeasures: dynamic ARP inspection, port security, VLAN segmentation, encryption. Key tools: Wireshark, tcpdump, Ettercap, BetterCAP, Scapy, MITMf. |
| 09 Social Engineering | Manipulating human psychology to obtain information, access, or actions that compromise security. Covers social engineering concepts: impersonation, pretexting, reciprocity, authority, urgency, social proof. Attack types: phishing, spear-phishing, whaling, vishing (voice phishing), smishing (SMS phishing), tailgating, baiting, quid pro quo. Insider threat facilitation through social engineering. AI-generated social engineering content and deepfake attacks covered extensively in v13. Social engineering detection and countermeasures: security awareness training, verification procedures, anti-phishing controls. Key tools: SET (Social Engineering Toolkit), Gophish, BeEF, email spoofing tools. |
| 10 Denial-of-Service | Disrupting service availability through resource exhaustion, network flooding, and application-layer attacks. Covers DoS vs. DDoS architecture, botnet-based attack infrastructure, volumetric attacks (UDP flood, ICMP flood, amplification attacks — DNS/NTP/SSDP/MEMCACHED amplification), protocol attacks (SYN flood, Ping of Death, Smurf attack, fragmentation attacks), and application-layer attacks (HTTP flood, Slowloris, slow POST, RUDY). DDoS mitigation techniques: anycast scrubbing, rate limiting, CAPTCHAs, CDN-based absorption, BGP blackholing. Key tools: LOIC, HOIC, hping3, Slowloris, Metasploit auxiliary modules. |
| 11 Session Hijacking | Taking control of an authenticated session by obtaining a valid session token. Covers TCP session hijacking (sequence number prediction, desynchronization), application-level session hijacking (cookie theft, session fixation, cross-site scripting-based token theft, man-in-the-browser attacks), cross-site request forgery (CSRF), network-level session hijacking using ARP poisoning and DNS spoofing, and SSL/TLS stripping attacks. Session hijacking countermeasures: HTTPS, secure and HttpOnly cookie flags, CSRF tokens, session token randomization, re-authentication for sensitive operations. Key tools: Hamster and Ferret, Burp Suite, Caido, ZAP. |
| 12 Evading IDS, Firewalls & Honeypots | Techniques for bypassing intrusion detection systems, firewalls, and honeypot traps to complete an attack without detection. Covers IDS evasion: packet fragmentation, TTL manipulation, overlapping fragments, protocol-level obfuscation, payload encryption and encoding, Unicode encoding, polymorphic shellcode. Firewall evasion: port knocking, tunneling through allowed protocols (HTTP tunneling, DNS tunneling, ICMP tunneling), source port spoofing. Honeypot detection: fingerprinting virtual environments, behavioral inconsistencies. Obfuscation and encoding for payload delivery. Key tools: Nmap evasion flags, Fragroute, Scapy, Covert_TCP, fragrouter. |
| 13 Hacking Web Servers | Attacking the server infrastructure that delivers web applications: the underlying web server software (Apache, Nginx, IIS), server operating systems, and server configurations. Covers web server attack methodology: information gathering (server fingerprinting, directory enumeration), vulnerability exploitation (unpatched CVEs in web server software), configuration attacks (default files, directory traversal, source code disclosure), password attacks on server management interfaces, DNS attacks, web cache poisoning, HTTP response splitting, and log tampering. Server hardening countermeasures. Key tools: Nikto, Metasploit web server modules, Gobuster, Dirb, WhatWeb, httprint. |
| 14 Hacking Web Applications | Attacking the application layer: exploiting vulnerabilities in web application code, logic, and configuration. Maps directly to the OWASP Top 10 and covers: SQL injection (in-band, blind, out-of-band, second-order injection), XSS (stored, reflected, DOM-based), broken access control (IDOR, path traversal, privilege escalation), authentication attacks (credential stuffing, brute force, session management flaws), CSRF, Server-Side Request Forgery (SSRF), XML external entity (XXE) injection, insecure deserialization, security misconfiguration, and API security testing. Web application hacking methodology: reconnaissance, authentication testing, input validation testing, logic testing. Key tools: Burp Suite Pro, OWASP ZAP, SQLmap, BeEF, ffuf, wfuzz. |
| 15 SQL Injection | Dedicated domain covering SQL injection in depth — beyond the web application module. Covers SQL injection attack classification: error-based, union-based, blind Boolean-based, blind time-based, out-of-band, and stored injection. Database-specific exploitation techniques for MySQL, MSSQL, Oracle, PostgreSQL, and NoSQL databases. Escalating from SQL injection to OS command execution (xp_cmdshell in MSSQL, INTO OUTFILE in MySQL). Extracting password hashes, reading and writing files, and establishing backdoors through SQL injection. Detection evasion: encoding, string concatenation, comment insertion. Countermeasures: parameterized queries, stored procedures, input validation, WAF rules, least-privilege database accounts. Key tools: SQLmap, Havij, BBQSQL, jSQL Injection. |
| 16 Hacking Wireless Networks | Attacking Wi-Fi infrastructure and wireless protocols. Covers wireless standards (802.11 a/b/g/n/ac/ax), wireless encryption protocols (WEP — comprehensively broken, WPA/WPA2 TKIP and CCMP, WPA3), wireless attack types: passive sniffing, active network discovery, WEP cracking (FMS, KoreK, PTW attacks), WPA/WPA2 dictionary and brute force attacks (4-way handshake capture and offline cracking), PMKID attack, WPA3 Dragonblood attacks, rogue access point and evil twin attacks, de-authentication attacks, wireless DoS, Bluetooth attacks (Bluejacking, Bluesnarfing, BlueSmack, KNOB attack), and wireless sensor network attacks. Key tools: Aircrack-ng suite, Kismet, Wireshark, Wifite, Hashcat, hcxtools, Bettercap. |
| 17 Hacking Mobile Platforms | Attack vectors and techniques specific to iOS and Android mobile platforms. Covers mobile platform attack surfaces: network attacks (MITM on mobile traffic, rogue Wi-Fi), application attacks (insecure data storage, insecure communication, improper platform usage, client-side injection), and device attacks (jailbreaking iOS, rooting Android and their security implications). Android-specific attacks: APK reverse engineering, ADB exploitation, intent sniffing, malicious app distribution. iOS-specific attacks: certificate pinning bypass, iCloud exploitation, MDM bypass techniques. Mobile device management (MDM) security controls. Mobile application vulnerability analysis and testing methodology. Key tools: MobSF, apktool, jadx, Frida, Drozer, objection, adb. |
| 18 IoT and OT Hacking | Attacking Internet of Things devices and Operational Technology (OT/ICS/SCADA) environments. IoT attack surface: network interfaces (Wi-Fi, Bluetooth, Zigbee, Z-Wave), insecure firmware, default credentials, unencrypted protocols, and cloud backend vulnerabilities. IoT attack methodology: information gathering, vulnerability scanning, exploitation (firmware extraction and analysis, default credential exploitation, command injection), persistence. OT/SCADA attacks: Modbus protocol exploitation, DNP3 attacks, replay attacks on industrial control systems, Stuxnet-style malware targeting PLCs. IoT security frameworks: OWASP IoT Top 10. Key tools: Shodan for IoT discovery, Firmwalker, Binwalk, Metasploit IoT modules, PLCscan. |
| 19 Cloud Computing | Security threats and attack techniques specific to cloud environments. Covers cloud computing fundamentals (IaaS, PaaS, SaaS, deployment models), cloud security responsibilities under the shared responsibility model, and cloud-specific attack techniques: cloud enumeration and misconfiguration discovery, S3 bucket enumeration and exploitation, IAM privilege escalation, metadata service SSRF (IMDSv1 exploitation), serverless function attacks, container escape attacks, Kubernetes RBAC exploitation, cloud credential theft (instance metadata, environment variables), and CloudGoat scenarios. Cloud security tools and defensive controls: CSPM, CIEM, cloud-native security services. Key tools: ScoutSuite, Pacu, CloudSploit, kube-hunter, Trivy. |
| 20 Cryptography | Understanding and attacking cryptographic implementations and protocols. Covers symmetric encryption (AES, DES, 3DES), asymmetric encryption (RSA, ECC, Diffie-Hellman), hashing algorithms (MD5, SHA-1, SHA-256, SHA-3 — and their weaknesses), digital signatures, PKI and certificate infrastructure, TLS/SSL protocol operation and weaknesses (POODLE, BEAST, CRIME, HEARTBLEED), disk encryption, email encryption (PGP/S-MIME), steganography and steganalysis, and cryptanalysis techniques. Identifying weak cryptographic implementations in real environments. Post-quantum cryptography introduction. Key tools: OpenSSL, Hashcat for hash cracking, CrypTool, OpenStego, Steghide. |
6. Key Tools and Technologies
The CEH examines a broad toolkit of commercial and open-source security tools. Candidates must understand not only how to use these tools but what information they provide, how to interpret their output, and what countermeasures detect or prevent their use. The following are the most heavily tested tool categories and specific tools across the exam domains.
Core Tool Categories
| Category | Tools |
|---|---|
| Reconnaissance & OSINT | Maltego (relationship mapping and OSINT visualization), Recon-ng (modular OSINT framework), theHarvester (email, hostname, and domain harvesting), Shodan (IoT and internet-facing service discovery), Metagoofil (metadata extraction from public documents), FOCA (metadata analysis), SpiderFoot (automated OSINT aggregation), WHOIS tools, DNS interrogation tools (DIG, DNSRecon, DNSenum) |
| Network Scanning & Enumeration | Nmap (the definitive network scanner — port scanning, service detection, OS fingerprinting, NSE scripting), Hping3 (packet crafting and custom scanning), Zenmap (Nmap GUI), Angry IP Scanner (fast host discovery), Enum4Linux (Windows/Samba enumeration), SNMPwalk (SNMP enumeration), NBTScan (NetBIOS enumeration), Nessus / OpenVAS (vulnerability scanning) |
| Exploitation Frameworks | Metasploit Framework (the most comprehensive exploitation framework — includes exploit modules for thousands of CVEs, post-exploitation modules, payload generation, and auxiliary modules), Armitage (Metasploit GUI), Cobalt Strike (commercial adversary simulation platform), PowerSploit (PowerShell post-exploitation), Empire (post-exploitation framework) |
| Password Attacks | John the Ripper (versatile offline hash cracker), Hashcat (GPU-accelerated hash cracking — fastest available), L0phtCrack (Windows password auditing), Hydra / THC-Hydra (online brute-force across many protocols), Medusa (parallel online brute-force), CeWL (custom wordlist generator from target websites), Crunch (wordlist generator), RainbowCrack (rainbow table attacks) |
| Web Application Testing | Burp Suite Professional (the industry-standard web application security testing platform — proxy, scanner, intruder, repeater, decoder), OWASP ZAP (free alternative with scanner and proxy), SQLmap (automated SQL injection discovery and exploitation), Nikto (web server vulnerability scanner), Gobuster / Dirb / ffuf (directory and file brute-forcing), BeEF (Browser Exploitation Framework), w3af (web application attack and audit framework) |
| Sniffing & MITM | Wireshark (the definitive network protocol analyzer), tcpdump (command-line packet capture), Ettercap (ARP poisoning and MITM), BetterCAP (modern network attack and MITM framework), Scapy (Python-based packet crafting), MITMf (MITM attack framework), Responder (NBT-NS/LLMNR poisoning for credential capture) |
| Wireless Hacking | Aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng, aircrack-ng — comprehensive Wi-Fi attack toolkit), Kismet (wireless network detection and sniffing), Wifite (automated Wi-Fi auditing), hcxtools / hcxdumptool (PMKID and handshake capture), Hashcat with wireless modes (WPA/WPA2 cracking), Bettercap (Wi-Fi MITM and deauthentication) |
| Steganography / Cryptography | OpenStego (image steganography tool — embedding and extraction), Steghide (audio and image steganography), SilentEye (steganography in images and audio), OpenSSL (cryptographic operations, certificate management), Hashcat (hash cracking across many algorithms), CrypTool (cryptographic algorithm visualization and learning) |
| Malware Analysis | Cuckoo Sandbox (automated dynamic malware analysis), Any.run (interactive online sandbox), VirusTotal (multi-engine file and URL scanning), Process Monitor / Process Hacker (runtime process and registry monitoring), IDA Pro / Ghidra (reverse engineering and disassembly), Strings (string extraction from binaries), PE Explorer (PE file structure analysis) |
| Post-Exploitation | Mimikatz (Windows credential extraction — LSASS dump, pass-the-hash, pass-the-ticket), BloodHound / SharpHound (Active Directory attack path visualization), PowerView (AD enumeration), BeRoot (privilege escalation enumeration), WinPEAS / LinPEAS (privilege escalation audit scripts), Incognito (Windows token impersonation), Netcat / Ncat (versatile network utility for reverse shells) |
7. CEH Compared with Comparable Certifications
The cybersecurity certification landscape offers several credentials targeting penetration testing and offensive security domains. Understanding how the CEH compares to these alternatives helps candidates select the right certification for their career stage, employer requirements, and professional development goals.
Comparison: CEH vs. Key Alternatives
| Certification | Issuing Body | Focus & Approach | Best Suited For |
|---|---|---|---|
| CEH v13 | EC-Council | Broad knowledge-based ethical hacking; dual knowledge + practical exam (CEH Master); 20-domain coverage of full attack lifecycle; DoD 8570 approved; AI-integrated in v13 | Security analysts, pen testers entering the field, DoD/government roles, professionals needing DoD 8570 compliance, those wanting a broad foundational offensive security credential |
| OSCP (Offensive Security Certified Professional) | Offensive Security | Entirely hands-on; 24-hour practical exam on a network of target machines; minimal theory — passes only candidates who can actually exploit systems; highly respected by technical hiring managers | Aspiring penetration testers who want the most technically rigorous hands-on certification; those with some prior security knowledge; professionals targeting technical pen test roles at security consultancies |
| CompTIA PenTest+ | CompTIA | Knowledge-based with performance-based questions; broader scope including governance, reporting, and management; DoD 8570 approved; less technically deep than OSCP or CEH | Entry-level to mid-level security professionals; those needing DoD 8570 compliance who prefer the CompTIA certification ecosystem; professionals needing to demonstrate pen testing knowledge alongside reporting and management skills |
| GPEN (GIAC Penetration Tester) | GIAC / SANS | Knowledge-based exam with hands-on component; based on SANS SEC560 course content; broad network penetration testing coverage; highly regarded in enterprise security environments | Professionals who have completed SANS SEC560 training; enterprise security professionals; those valuing the GIAC brand recognition in corporate environments |
| CPENT (Certified Penetration Testing Professional) | EC-Council | EC-Council’s advanced penetration testing certification beyond CEH; multi-layered practical exam on enterprise network ranges; IoT, OT, cloud, and advanced exploitation topics | Experienced penetration testers who have CEH and want to advance; professionals targeting senior pen test or red team roles; those wanting the most advanced EC-Council credential |
| eJPT (eLearnSecurity Junior Pen Tester) | INE / eLearnSecurity | Entry-level practical-only certification; 72-hour online practical exam; no prior experience required; very accessible starting point | Absolute beginners in security; those building foundational skills before pursuing CEH or OSCP; students seeking first security credential with a practical component |
CEH Within the EC-Council Certification Pathway
EC-Council has developed a structured certification pathway that positions the CEH as a foundational credential within a broader progression toward advanced specializations:
| Credential | Detail |
|---|---|
| C|CT (Certified Cybersecurity Technician) | Entry-level certification covering foundational cybersecurity concepts, network security, and security operations. Recommended starting point for candidates with no prior security experience before pursuing CEH. |
| CEH (Certified Ethical Hacker) | Intermediate-level certification covering the complete ethical hacking methodology across 20 domains. The primary entry point into the EC-Council offensive security pathway. |
| CEH Master | Achieved by passing both the CEH Knowledge Exam and the CEH Practical Exam. Represents demonstrated hands-on capability, not just theoretical knowledge. |
| CPENT (Certified Penetration Testing Professional) | Advanced practical certification with a 24-hour online practical exam on complex enterprise networks, including IoT/OT environments and advanced exploitation techniques. Recommended after CEH Master. |
| LPT (Licensed Penetration Tester) Master | EC-Council’s highest practical penetration testing credential; 18-hour practical exam on a 3-tier network. Targets senior penetration testing professionals. Awarded automatically to candidates who score 90%+ on the CPENT practical exam. |
| CEH Specialist | Domain-specific micro-certifications available for individual CEH domains (Network Defense, Cloud Security, Threat Intelligence, Application Security, SOC Operations). Allow professionals to demonstrate specialized depth. |
8. Study Strategy and Exam Preparation
Preparing effectively for the CEH requires a combination of conceptual study, tool familiarity, and hands-on lab practice. Candidates who study only from textbooks consistently underperform on both the knowledge exam (which includes scenario-based questions requiring applied understanding) and particularly on the practical exam (which tests actual operational capability). A balanced preparation approach that combines structured study with practical lab work produces the best outcomes.
Recommended Preparation Timeline
| Phase | Duration | Activities |
|---|---|---|
| Foundation Building | 2–4 weeks | Review networking fundamentals (TCP/IP, OSI, protocols), refresh Linux command line proficiency, review Windows administration concepts, establish comfort with Python/Bash basics. Complete any prerequisite knowledge gaps before beginning CEH-specific study. |
| Domain Study — Knowledge Exam | 6–10 weeks | Work through all 20 domains systematically using official EC-Council materials or a high-quality third-party study guide. Take domain-by-domain notes on tools, techniques, and countermeasures. Complete practice questions after each domain while the material is fresh. Allocate proportionally more time to high-complexity domains: System Hacking, Web Application Hacking, Network Scanning, and Malware Analysis. |
| Lab Practice | 4–8 weeks (parallel) | Use TryHackMe (CEH-relevant learning paths), Hack The Box (practice boxes), EC-Council iLabs (official lab environment), or a personal lab environment (VirtualBox/VMware with Kali Linux, Metasploitable, DVWA, VulnHub machines). Practice each major tool category hands-on. Complete at least 10–15 full attack scenario exercises before the exam. |
| Review & Practice Exams | 2–3 weeks | Complete full-length practice exams under timed conditions (4 hours, 125 questions). Review every incorrect answer and understand why the correct answer is correct. Focus additional study on domains with below-average practice scores. Re-read notes for tools and techniques — memorization of specific tool names, flags, and capabilities is tested. |
| Practical Exam Preparation | 4–6 weeks additional | For CEH Practical candidates: systematic practice on all practical exam topic areas in EC-Council iLabs or equivalent environments. Timed challenge exercises. Ensure fluency with: Nmap scanning and NSE scripts, Metasploit module selection and execution, Burp Suite manual testing, Wireshark traffic analysis, SQLmap usage, password cracking with Hashcat and John the Ripper, steganography tools. |
Recommended Study Resources
| Resource | Detail |
|---|---|
| Official EC-Council Courseware | The official CEH v13 course books (available through EC-Council iLearn or ATC training) are the authoritative source for exam content. All exam questions are derived from official courseware material. Prioritize official materials over third-party study guides for accuracy of tool names, techniques, and methodologies. |
| Matt Walker’s All-in-One CEH Guide | A widely used third-party study guide that provides comprehensive coverage of all exam domains with practice questions. Well-regarded for its clear explanations and exam-focused content. Editions must be current with the exam version — v13-aligned edition required for v13 exam. |
| EC-Council iLabs | Official virtual lab environment provided with EC-Council training. Provides guided lab exercises for each domain using real tools in controlled environments. Essential for candidates preparing for the practical exam. |
| TryHackMe (CEH Learning Path) | A beginner-to-intermediate hands-on platform with guided rooms covering topics aligned to CEH domains. Excellent for building practical skills without requiring local lab setup. Free and paid tiers available; the CEH-aligned learning path provides structured practical preparation. |
| Hack The Box | An intermediate-to-advanced hands-on practice platform with retired machines suitable for CEH practical preparation. Machines tagged with relevant techniques (web exploitation, privilege escalation, network attacks) provide realistic challenge scenarios. More challenging than TryHackMe — better suited to candidates with some existing hands-on experience. |
| Practice Exam Platforms | EC-Council’s official practice exam (available through their portal), Boson CEH Practice Exams, and ExamTopics community-sourced questions. Complete at least 300–500 unique practice questions, across multiple sittings under timed conditions, before sitting the knowledge exam. |
| VulnHub / DVWA / Metasploitable | Free, intentionally vulnerable virtual machine images that provide realistic exploitation practice. Metasploitable 2 and 3 are widely used for Metasploit practice; DVWA (Damn Vulnerable Web Application) provides web application attack practice; VulnHub provides hundreds of downloadable vulnerable machines. |
| Kali Linux Documentation | The official Kali Linux tool documentation and man pages are essential references for understanding exact tool syntax, flags, and usage patterns — particularly for Nmap, Metasploit msfconsole commands, Aircrack-ng, and Burp Suite configuration. |
Tip
The CEH knowledge exam tests specific tool names, command syntax, and technique names — not just conceptual understanding. Create a dedicated reference sheet for each domain covering: key tools and their primary function, important command flags and syntax patterns, attack names and their mechanisms, and countermeasure names. Many exam questions present a scenario and ask which tool is most appropriate or describe an output and ask what attack produced it — this requires specific tool knowledge, not general security concepts.
9. Ethical and Legal Framework for Ethical Hacking
The CEH certification carries an explicit professional and ethical responsibility that distinguishes it from certifications that test purely technical knowledge. EC-Council’s Code of Ethics, the signed Non-Disclosure Agreement required for exam participation, and the legal frameworks governing authorized security testing collectively define the boundaries within which CEH holders must operate. Violation of these boundaries — using CEH skills outside of authorized engagements — constitutes criminal conduct under computer fraud laws in virtually every jurisdiction.
Key Legal Frameworks Governing Ethical Hacking
| Framework | Detail |
|---|---|
| Computer Fraud and Abuse Act (CFAA) — United States | The primary US federal law governing computer crime. Unauthorized access to computer systems — including scanning, enumeration, or exploitation performed without explicit written authorization — is a federal criminal offense under the CFAA. The law applies regardless of whether harm is caused; access without authorization is the offense. Ethical hackers must obtain explicit written authorization before any testing activity and must ensure their scope of authorization clearly covers the specific systems and techniques they intend to use. |
| Computer Misuse Act 1990 — United Kingdom | The UK equivalent of the CFAA; criminalizes unauthorized access to computer systems, unauthorized access with intent to commit further offenses, and unauthorized modification of computer material. The Act applies to activities performed from the UK or targeting UK systems, regardless of where the attacker is located. Like the CFAA, authorization is the distinguishing factor between ethical hacking and criminal conduct. |
| GDPR — European Union | Data protection obligations apply to security testing when personal data is accessed or processed during testing activities. Penetration testers who encounter personal data during testing must handle it in accordance with GDPR requirements — data minimization, purpose limitation, and security obligations. Engagement scoping should explicitly address data protection obligations and include provisions for handling personal data encountered during testing. |
| Industry-Specific Regulations | Healthcare (HIPAA), finance (GLBA, PCI DSS), and government sectors impose sector-specific obligations on security testing: PCI DSS requires annual penetration testing by qualified assessors; HIPAA covered entities must ensure security testing does not disrupt PHI systems or expose PHI; defense contractors must comply with CMMC assessment requirements. Sector context always overlays general computer crime law. |
Rules of Engagement and Authorization
Every ethical hacking engagement must be formally authorized before any testing activity commences. The authorization documentation defines the legal boundary between ethical hacking and criminal conduct, and must be available to the tester at all times during the engagement.
| Document | Detail |
|---|---|
| Statement of Work (SoW) | The commercial document defining the scope, objectives, deliverables, timeline, and commercial terms of the engagement. The SoW establishes that the client has engaged and paid for security testing services and defines what those services are. |
| Rules of Engagement (RoE) | A technical document defining the specific parameters of the testing engagement: in-scope IP ranges and systems, out-of-scope systems and activities, testing hours (business hours only vs. 24/7), notification requirements (who to contact if a critical vulnerability is found), prohibited techniques (no destructive testing, no social engineering of employees without specific written consent), and escalation procedures. |
| Penetration Testing Agreement / Permission to Test | The legal document in which the system owner explicitly authorizes the penetration tester to perform defined testing activities. This document is the primary legal protection for the tester — it must be signed by an individual with legal authority to grant access to the systems being tested. |
| Non-Disclosure Agreement (NDA) | Protects the confidentiality of findings, methodology, and client information. Required in virtually all professional engagements. EC-Council also requires a signed NDA from exam candidates to protect examination content. |
EC-Council Code of Ethics
All CEH holders are bound by EC-Council’s Code of Ethics, which they agree to as a condition of certification. The Code establishes the professional conduct standards that define the ethical practitioner, including:
- Keep client information confidential; do not use information gained through engagements for personal gain or to harm the client
- Perform authorized security testing only; never access systems without explicit written permission
- Disclose all findings to the client; do not withhold vulnerabilities for personal use or future exploitation
- Do not engage in activities that harm people, systems, or organizations
- Maintain professional competence through continuing education
- Cooperate with law enforcement in the investigation of cybercrime
- Respect intellectual property rights; do not use pirated tools or unlicensed software during engagements
- Maintain the confidentiality of the certification examination; do not share exam questions, answers, or materials in violation of the NDA
10. Career Pathways and Industry Recognition
The CEH is one of the most widely recognized cybersecurity certifications in employment listings, government procurement requirements, and academic programs globally. It occupies a unique position in the certification landscape: it is accessible enough for professionals early in their security careers while being substantive enough to be valued by employers hiring for operational security roles.
Roles That Value or Require CEH
| Role | Detail |
|---|---|
| Penetration Tester / Ethical Hacker | The direct application of CEH skills: performing authorized security assessments against client networks, applications, and systems. Entry-level penetration testing roles frequently list CEH as a preferred or required certification. The CEH Practical or CEH Master designation is increasingly valued for these roles alongside OSCP. |
| Security Analyst (SOC Tier 2/3) | SOC analysts benefit from understanding attacker tools, techniques, and patterns — the CEH’s adversarial perspective directly improves threat detection and alert investigation quality. Mid-level SOC roles regularly list CEH alongside GCIA, CompTIA CySA+, or GCED. |
| Vulnerability Assessment Analyst | Professionals who conduct vulnerability scanning, manual verification of findings, and risk reporting. The CEH’s scanning, enumeration, and vulnerability analysis domains directly apply. Vulnerability assessment is often an early career role that leads into penetration testing. |
| Red Team Member | Offensive security team members who simulate advanced adversaries to test organizational defenses. CEH provides foundational knowledge; red team roles typically also expect OSCP, CRTO, or CRTE alongside CEH. More specialized red team certifications (CPENT, LPT) demonstrate advanced operational capability. |
| Security Consultant | Security consulting roles across firms like Big Four advisory practices, boutique security consultancies, and MSSP security teams. Consultants advise clients on security posture, conduct assessments, and develop remediation strategies. CEH is frequently listed as a preferred qualification for consultant-level roles. |
| Information Security Manager / CISO | Management and leadership roles benefit from the CEH’s comprehensive coverage of the threat landscape and attack techniques. Managers who understand offensive techniques make better investment decisions and communicate more effectively with technical teams. CEH + CISSP is a common combination for leadership roles. |
| DoD / Government Cybersecurity Roles | The US Department of Defense mandates DoD 8570 / 8140 compliance for civilian, military, and contractor personnel in cybersecurity roles. The CEH is approved for IAT Level II, IAM Level I, and IASAE Level I under DoD 8570. Many government cybersecurity positions list CEH as a required or preferred qualification. |
| Incident Responder | IR professionals benefit from CEH knowledge of attacker TTPs: understanding how attackers gain access, escalate privileges, establish persistence, and exfiltrate data directly informs effective incident investigation, containment, and eradication. CEH + GCIH or GCFE is a common combination for IR roles. |
Salary Impact and Market Value
The CEH consistently appears in cybersecurity salary surveys as associated with above-average compensation. The following salary ranges represent approximate figures for US-based professionals in roles where CEH is a primary qualification (2024–2025 data; significant variation by location, organization size, and experience level):
| Role | Experience Level | Approximate US Salary Range (Annual) |
|---|---|---|
| Penetration Tester | Entry (0–2 years with CEH) | $65,000 – $95,000 |
| Penetration Tester | Mid-level (3–6 years, CEH + OSCP) | $95,000 – $145,000 |
| Penetration Tester | Senior (7+ years, CEH Master/CPENT) | $130,000 – $185,000+ |
| Security Analyst (SOC) | Mid-level with CEH | $75,000 – $115,000 |
| Vulnerability Analyst | Mid-level with CEH | $75,000 – $110,000 |
| Security Consultant | 3–5 years, CEH | $90,000 – $140,000 |
| Red Team Member | 5+ years, CEH + OSCP/CRTO | $120,000 – $180,000+ |
| DoD / Government (cleared) | Various with DoD 8570 compliance | $90,000 – $160,000+ (clearance premium applies) |
11. Continuing Education, Renewal, and the CEH Master
Certification Renewal Requirements
The CEH certification is valid for 3 years from the date of certification. Renewal requires accumulation of 120 EC-Council Continuing Education (ECE) credits within the 3-year validity period. If ECE requirements are not met by the expiration date, recertification requires retaking the exam. ECE credits must be submitted through EC-Council’s Aspen certification management portal.
| Item | Detail |
|---|---|
| Total ECE Required | 120 credits over the 3-year validity period |
| Annual Minimum | No strict annual minimum — all 120 credits can be earned in any distribution over the 3-year period, though EC-Council recommends annual activity |
| Credit Submission | EC-Council Aspen portal (https://aspen.eccouncil.org); activity evidence must be uploaded for each credit claim |
| Annual Membership Fee | USD $80 annual EC-Council membership fee is required to maintain certification status (required regardless of whether ECE credits are being accumulated) |
ECE Credit Activities
| Activity Category | ECE Credits | Notes |
|---|---|---|
| Attending EC-Council conferences / training | Varies (typically 1 per hour) | EC-Council events, Hacker Halted, CISO Summit |
| Completing EC-Council courses | Varies by course length | EC-Council iLearn courses, ATC courses, specialization courses |
| Industry conferences (e.g. DEF CON, Black Hat, RSA) | 1 credit per hour attended | Must provide evidence of attendance |
| Vendor training / certifications | Varies (up to 20 per new certification) | Completing other vendor certifications earns ECE credits |
| Security webinars | 1 credit per hour | EC-Council and approved third-party webinars |
| Publishing security research / articles | 10 credits | Published articles, blog posts on recognized security platforms |
| Teaching or instructing security courses | 3 credits per teaching hour | Must be in information security subject matter |
| Contributing to EC-Council Community | Varies | EC-Council TechSeries, forum contributions, event volunteering |
| Completing practice challenges (iLabs) | 1 credit per lab completed | EC-Council’s iLabs platform hands-on labs count toward ECE |
CEH Master Designation
The CEH Master is the highest tier of the CEH certification program, awarded to candidates who pass both the CEH Knowledge Exam (312-50) and the CEH Practical Exam within a defined validity period. The Master designation is increasingly significant in hiring decisions because it provides employers with evidence of both theoretical knowledge and demonstrated operational capability — addressing the most common criticism of knowledge-only certifications.
| Item | Detail |
|---|---|
| Requirements | Pass the CEH Knowledge Exam (312-50) AND the CEH Practical Exam; both must be passed within the certification validity period |
| CEH Practical Pass Rate | Published pass rates are not available; the exam is widely described by candidates as significantly more challenging than the knowledge exam — budgeting for multiple attempts is advisable |
| Designation Title | CEH Master; displayed as CEH (Master) on EC-Council certificate and digital badge |
| Additional Renewal Requirements | CEH Master has the same ECE renewal requirements as standard CEH (120 credits over 3 years) |
| Employer Perception | CEH Master is increasingly listed as preferred (not just CEH) in penetration testing and red team job postings, particularly at larger organizations and security consultancies |
12. Exam Tips and Common Pitfalls
Knowledge Exam Tips
| Tip | Detail |
|---|---|
| Read Every Word of the Question | CEH questions often hinge on specific qualifying words: ‘MOST likely’, ‘BEST describes’, ‘FIRST step’, ‘LEAST privilege’. Missing a qualifier leads to selecting the wrong answer even when you know the material. Read the complete question before looking at answers; then re-read after selecting. |
| Eliminate Clearly Wrong Answers First | Most questions have two plausible answers and two clearly incorrect ones. Eliminating the clearly incorrect answers first reduces the decision to a 50/50 choice, improving guessing accuracy when uncertain. Never leave a question unanswered — there is no penalty for incorrect answers. |
| Know EC-Council’s Terminology | EC-Council uses specific terminology for attack phases, tool categories, and technique names. Where multiple terms describe the same concept, know EC-Council’s preferred term: their methodology documents use specific phasing terms (‘footprinting’ not ‘passive reconnaissance’, ‘gaining access’ not ‘exploitation’) that appear in questions. |
| Memorize Tool-to-Function Mappings | A significant portion of questions present a scenario (‘A tester wants to perform ARP cache poisoning on the local subnet — which tool is BEST suited?’) and require selection from a list of tools. You must know which tool is canonical for each task. Create flashcards for the primary tools in each domain. |
| Understand the Sequential Methodology | Many questions are scenario-based and ask what step should be performed NEXT or FIRST. Understanding the sequential ethical hacking phases (Reconnaissance → Scanning → Enumeration → Vulnerability Analysis → Exploitation → Post-Exploitation → Reporting) and that each phase’s activities logically precede the next helps answer these questions correctly. |
| Countermeasures and Defenses | The exam tests defensive knowledge as thoroughly as offensive knowledge. Every attack technique is paired with countermeasures. Know not only how each attack works but what specific technical controls defend against it. |
| Manage Time Carefully | 125 questions in 240 minutes allows approximately 1 minute 55 seconds per question. Mark difficult questions for review rather than spending excessive time on them. Complete a first pass through all questions, answering those you know confidently, then return to marked questions. |
Practical Exam Tips
| Tip | Detail |
|---|---|
| Know Your Tools Before the Exam | The practical exam provides access to a full toolkit but does not teach you how to use it. Arrive knowing the fundamental command syntax for every major tool: Nmap scan types and output options, Metasploit msfconsole workflow, SQLmap basic and advanced usage, Hashcat hash type codes and attack modes, Burp Suite intercept and repeater workflow, Aircrack-ng suite command sequence. |
| Start with Enumeration | For any target system in the practical exam, the first step is always thorough enumeration before attempting exploitation. Scan all ports (not just common ones), identify service versions, identify operating systems. Missing a service because you only scanned common ports can leave challenge solutions inaccessible. |
| Document Everything | The practical exam requires submission of evidence for each completed challenge. Screenshot every step, save tool output to text files, and document your methodology. Some challenges require a specific answer (a flag value, a password, a user account) that must be submitted correctly — ensure you capture these before moving on. |
| Manage Time Across 20 Challenges | 6 hours for 20 challenges = 18 minutes average per challenge. Do not spend disproportionate time on a single difficult challenge when simpler ones remain. Solve the challenges you can solve confidently first; return to difficult challenges with remaining time. |
| Use the Available Reference Material | The practical exam is open-book for tool documentation — man pages, official documentation, and tool help output are accessible. Knowing how to find the information you need quickly is a skill in itself; practice looking up tool syntax and options efficiently during lab preparation. |
| Practice with Similar Platforms Before the Exam | TryHackMe machines, Hack The Box retired machines, VulnHub machines, and EC-Council iLabs all simulate the challenge format of the practical exam. Completing 15–20 full attack scenarios (enumeration through exploitation through post-exploitation) before the exam significantly improves practical exam performance. |
Warning
Do not rely solely on ‘exam dumps’ (leaked or recalled exam questions) for CEH preparation. EC-Council regularly updates exam questions and revises compromised question sets. Candidates who prepare primarily from dumps frequently have surface familiarity with specific question formats but lack the understanding to handle new questions on the same topics. More importantly, the practical exam cannot be ‘dumped’ — only genuine skill succeeds. Invest in understanding the material, not memorizing leaked answers.
13. CEH v13: AI-Integrated Hacking
The release of CEH v13 in 2024 represents the most significant single-version update in the certification’s history, driven by the transformative impact of generative AI on both offensive and defensive security capabilities. EC-Council has integrated AI and machine learning content throughout all 20 domains — not as a standalone addition but as a thread woven through every topic, reflecting the reality that AI is now a tool in both the attacker’s and defender’s arsenal.
AI-Integrated Content Areas in CEH v13
| Area | Detail |
|---|---|
| AI-Powered Reconnaissance | Using large language models (LLMs) and AI-powered OSINT tools to automate target profiling: generating personalized phishing pretexts from LinkedIn data, using AI to analyze and correlate open-source data across multiple sources simultaneously, and AI-driven social network analysis to identify high-value targets within an organization. V13 covers specific AI-powered OSINT tools and their capabilities. |
| AI-Generated Phishing and Social Engineering | LLMs (including jailbroken models and purpose-built tools like WormGPT and FraudGPT) generating grammatically perfect, contextually appropriate phishing content at scale. Deepfake voice synthesis for vishing attacks. Deepfake video for executive impersonation fraud. AI-generated spear-phishing that incorporates personal details scraped from public sources. Detection and countermeasures for AI-generated social engineering content. |
| AI-Powered Malware Development | LLM-assisted malware code generation for adversaries without advanced coding expertise. AI-driven malware evasion: using ML to generate variants that evade specific detection systems. Polymorphic and metamorphic malware generation at scale using AI. Automated exploit development using AI-guided fuzzing and vulnerability pattern recognition. V13 covers both the offensive capabilities and the defensive AI detection responses. |
| AI in Vulnerability Discovery | AI-powered automated vulnerability scanners that go beyond signature matching. ML-based fuzz testing for web application and protocol vulnerabilities. AI-driven attack path analysis (combining multiple low-severity vulnerabilities into high-impact attack chains). Using AI to accelerate the time from CVE disclosure to working exploit. |
| AI-Enhanced Penetration Testing Tools | Integration of AI assistants into standard pen testing tools: AI-guided Metasploit module selection based on target profile, AI-assisted Burp Suite scanning that intelligently adapts payload generation, AI-powered network traffic analysis for pattern detection. V13 candidates are expected to understand how AI augments the traditional toolset. |
| Defensive AI Concepts | Understanding how AI-powered defensive tools work — UEBA, AI-driven SIEM, behavioral analytics, AI-powered endpoint detection — enables CEH holders to understand what defenders can see and how to evade AI-based detection systems. V13 integrates defensive AI awareness throughout the evading IDS/firewalls domain and the countermeasures sections of each attack domain. |
| AI Ethics and Responsible Use | V13 includes explicit coverage of the ethical implications of AI-powered offensive tools: the lowered skill barrier for AI-assisted attacks, the dual-use nature of AI security tools, the responsibility of certified professionals not to use AI-powered attack capabilities outside of authorized engagements, and the emerging regulatory frameworks governing offensive AI use. |
14. Conclusion
The Certified Ethical Hacker (CEH) certification represents a comprehensive, structured, and globally recognized framework for validating ethical hacking knowledge and skill. Over more than two decades of continuous evolution, it has grown from a foundational knowledge-based examination into a dual-component program that demands both theoretical breadth and demonstrated practical capability through the CEH Practical exam and the CEH Master designation.
The certification’s 20-domain structure traces the complete attack lifecycle — from pre-engagement footprinting and reconnaissance through scanning, enumeration, and exploitation to post-exploitation activities, evasion, and specialized attack surfaces including web applications, wireless networks, mobile platforms, IoT, cloud environments, and cryptography. This breadth ensures that CEH holders have a comprehensive understanding of the threat landscape that informs effective defensive decision-making as well as proficient offensive testing capability.
The v13 update’s integration of artificial intelligence across all domains acknowledges the most significant shift in the cybersecurity threat landscape since the certification’s inception. AI is reshaping both offensive techniques — lowering barriers to sophisticated attacks, enabling deepfake social engineering, automating malware development and evasion — and defensive capabilities — through AI-powered detection, behavioral analytics, and automated response. CEH holders who understand both sides of the AI security equation are better equipped to contribute meaningfully in a rapidly evolving professional environment.
For security professionals considering the CEH, the investment in preparation, examination, and continuing education yields returns that extend well beyond the credential itself: the systematic study of adversarial techniques, tools, and methodologies fundamentally changes how a security professional approaches their work — from reactive defense to proactive adversarial thinking that anticipates attack patterns, evaluates control effectiveness from an attacker’s perspective, and designs defenses calibrated to real-world attack techniques rather than theoretical best practices.
Final Note
The CEH is not a certification earned and filed — it is a knowledge framework that should be continuously practiced, updated, and applied. The cybersecurity landscape changes faster than any certification cycle can capture; the methodology of continuous learning, hands-on practice, and engagement with current threat intelligence that successful CEH candidates develop during preparation is as valuable as the credential itself. Pair the CEH with ongoing lab practice, threat intelligence reading, and community engagement to maximize its career value and genuine security impact.
Quick Reference: CEH Glossary
| Term | Definition |
|---|---|
| ATC | EC-Council Accredited Training Center — an approved training organization authorized to deliver official EC-Council courses. |
| CEH Master | The highest CEH designation; awarded to candidates who pass both the knowledge exam and the CEH Practical exam. |
| CPENT | Certified Penetration Testing Professional — EC-Council’s advanced practical penetration testing certification beyond CEH. |
| CVE | Common Vulnerabilities and Exposures — the standard identifier system for publicly known security vulnerabilities. |
| CVSS | Common Vulnerability Scoring System — the standardized 0–10 scale for rating vulnerability severity. |
| DoD 8570 | US Department of Defense Information Assurance Workforce Improvement Program — defines certification requirements for DoD cybersecurity roles; now transitioning to DoD 8140. |
| ECE | EC-Council Continuing Education credits — required for CEH renewal (120 over 3 years). |
| Ethical Hacking | Authorized penetration testing performed with explicit written permission to identify and report security vulnerabilities in systems, networks, or applications. |
| Footprinting | The first phase of the ethical hacking methodology; gathering maximum information about the target using passive and active techniques. |
| iLabs | EC-Council’s virtual hands-on lab platform providing guided lab exercises for CEH exam preparation. |
| LPT | Licensed Penetration Tester — EC-Council’s highest practical penetration testing credential; awarded automatically for CPENT scores above 90%. |
| OWASP Top 10 | Open Web Application Security Project’s annually updated list of the most critical web application security risks; directly mapped in CEH Domain 14. |
| Penetration Testing | Authorized simulated attack on a system to identify exploitable vulnerabilities; the practical application of ethical hacking skills. |
| Rules of Engagement | The documented parameters of an ethical hacking engagement: in-scope systems, prohibited techniques, testing hours, and notification requirements. |
| Social Engineering Toolkit (SET) | An open-source penetration testing framework specifically for social engineering attacks; widely used in CEH Domain 9 practical scenarios. |
| White Hat / Gray Hat / Black Hat | Classifications of hackers by intent and authorization: white hat = authorized ethical hacker; gray hat = unauthorized but typically non-malicious; black hat = malicious criminal hacker. |
Core Principle of Ethical Hacking
“A security professional who cannot think like a hacker cannot effectively defend against one — and the best defenders understand exactly what attackers are looking for.”