Index
[!WARNING] Educational & authorized use only. Attack techniques are explained for understanding and defense — every offensive topic is paired with countermeasures. Performing them against systems you do not own or are not explicitly authorized in writing to test is illegal. Read Legal & ethics first, and keep every hands-on exercise inside the self-hosted lab.
[!NOTE] Unofficial & no fabrication. Not affiliated with or endorsed by EC-Council. Facts are tied to EC-Council and reputable sources (NIST, MITRE ATT&CK, OWASP, RFCs); unknowns are marked “not specified in sources.” Practice questions are original, never dumps. This hub is substantially AI-assisted and structurally validated, not line-by-line expert-reviewed — read Known limitations and verify exam specifics at eccouncil.org.
🧭 Two layers, one hub¶
This folder merges two study repos that grew side by side:
| Layer | Where | Best for |
|---|---|---|
| Concept pages — one page per module, Mermaid flows, tools by phase, countermeasures | 00-overview/ · domains/ · tools/ · exam-prep/ · career/ · reference/ | A fast, source-grounded read of what each module covers |
| Full course — 20 module folders with facts, practice questions, flashcards and lab walkthroughs, plus a Kali course, a runnable lab, mock exams and a defender/PAM knowledge base | modules/ · kali/ · labs/ · practical/ · defender-pam/ · ot-security/ · cheatsheets/ | Active recall, hands-on reps, and the “which control stops this?” reflex |
Read the concept page for a module, then work its course folder: read → lab → map to the control → test → drill → track.
🔁 The 5 phases of ethical hacking¶
flowchart LR
R["1 · Reconnaissance<br/>footprinting / OSINT"] --> S["2 · Scanning<br/>& Enumeration"]
S --> G["3 · Gaining Access<br/>exploitation"]
G --> M["4 · Maintaining Access<br/>persistence"]
M --> C["5 · Clearing Tracks<br/>anti-forensics"]See five-phases-of-hacking.md for the phase → module mapping and the Cyber Kill Chain / MITRE ATT&CK alignment.
🛠️ Prepare for the exam — the procedure¶
This hub is a preparation guide, not a reading list. Work it in this order; the method behind it is the repo-wide how to prepare a certification.
flowchart LR
A["1 · Commit<br/>date · eligibility<br/>blueprint PDF"] --> B["2 · Set up<br/>lab · Kali basics<br/>self-assess"]
B --> C["3 · 12 weeks<br/>2 modules a week<br/>read · lab · map · test"]
C --> D["4 · Readiness gate<br/>80% per module<br/>85% full mock"]
D --> E["5 · Exam week<br/>strategy · logistics"]
E --> F["6 · Optional<br/>CEH Practical<br/>→ CEH Master"]- Commit — pick a target date; choose your eligibility route (official training or the experience-based application) and fill the verify fields in EXAM-LOGISTICS.md; download the official blueprint PDF and record its weights there. Read exam & eligibility and legal & ethics.
- Set up — stand up the lab; if you are new to Linux, do the Kali course chapters 00–05; score yourself on the competency matrix; open PROGRESS.md.
- Follow the 12-week study plan — two modules a week, each through the loop below: concept page → module guide → lab → Defender & PAM mapping → practice questions → flashcards → tracker. Run the capstone chain from Week 3. The practice kit lists what to practise with each week: the repo's lab, drills and mocks, then the external platforms that add what the lab cannot.
- Pass the readiness gate — every module ≥ 80% on its practice set, the 50-question and 125-question timed mocks ≥ 85%, the rapid-fire bank and cheat sheet automatic. The gate is spelled out at the end of the plan.
- Exam week — EXAM-STRATEGY.md: the study system, the test-day tactics, the trap pairs and the day-of checklist.
- CEH Practical (optional) — the practical/ skills checklist, playbooks and timed drills for the 6-hour range; pass both exams for CEH Master.
Entry points by profile (the procedure is the same; the starting emphasis differs):
- 🌱 New to Linux / hacking — Kali course first, then the plan from Week 1. The beginner → master roadmap sequences the whole journey with checkpoints.
- ⏱️ Know the tech, need the cert — skim each module guide, drill
facts.md,practice-questions.mdandflashcards.csv, and go straight to the mocks; BLUEPRINT-COVERAGE.md confirms nothing is missing. - 🛡️ Sysadmin / PAM engineer — start with defender-pam/ and identity attack paths, run the capstone to see attack → control end-to-end, then work the plan; for industrial estates add ot-security/.
- 🤖 v13's AI focus — AI in ethical hacking, AI-IN-ETHICAL-HACKING.md and the drill prompts in AI-STUDY-WORKFLOW.md.
📋 Exam at a glance¶
| Track | Format | Pass | Notes |
|---|---|---|---|
| CEH (knowledge) | 125 multiple-choice questions · 4 hours · code 312-50v13 |
60–85% (scaled cut-score per form) | Pearson VUE or ECC Exam Center |
| CEH Practical | 20 real-world challenges · 6 hours · iLabs Cyber Range | 60–85% | Hands-on, optional |
| CEH Master | — | — | Awarded for passing both above |
Full details: exam & eligibility and EXAM-LOGISTICS.md. EC-Council publishes per-domain blueprint weights inconsistently across public sources, so this hub does not print made-up weights — download the official blueprint PDF and record the real ones yourself.
🔁 The study loop (every module)¶
flowchart LR
R["1. READ<br/>concept page + module guide"] --> L["2. LAB<br/>lab-walkthrough.md"]
L --> M["3. MAP<br/>Defender & PAM section"]
M --> T["4. TEST<br/>practice-questions.md"]
T --> D["5. DRILL<br/>flashcards.csv → Anki"]
D --> K["6. TRACK<br/>PROGRESS.md"]
K -.->|"spaced repetition"| F["facts.md<br/>final-week cram"]
F -.-> RMove on at ≥ 80% on the module's practice set; log every miss in the weak-area log and
re-test it first next session. Drill flashcards with python3 scripts/quiz.py --module 06
or import them into Anki (scripts/). Keep GLOSSARY.md,
the glossary and acronyms open for lookups.
📚 The 20 modules (official CEH v13 order)¶
Each row links the concept page and the course folder (guide + facts.md ·
practice-questions.md · flashcards.csv · lab-walkthrough.md).
| # | Module | Concept page | Course folder |
|---|---|---|---|
| 01 | Introduction to Ethical Hacking | read | → |
| 02 | Footprinting and Reconnaissance | read | → |
| 03 | Scanning Networks | read | → |
| 04 | Enumeration | read | → |
| 05 | Vulnerability Analysis | read | → |
| 06 | System Hacking | read | → |
| 07 | Malware Threats | read | → |
| 08 | Sniffing | read | → |
| 09 | Social Engineering | read | → |
| 10 | Denial-of-Service | read | → |
| 11 | Session Hijacking | read | → |
| 12 | Evading IDS, Firewalls, and Honeypots | read | → |
| 13 | Hacking Web Servers | read | → |
| 14 | Hacking Web Applications | read | → |
| 15 | SQL Injection | read | → |
| 16 | Hacking Wireless Networks | read | → |
| 17 | Hacking Mobile Platforms | read | → |
| 18 | IoT and OT Hacking | read | → |
| 19 | Cloud Computing | read | → |
| 20 | Cryptography | read | → |
🛡️ The Defender / PAM lens¶
Because so many CEH answers are “what's the best control”, the defender knowledge base doubles as a fast filter: prefer the option that reduces standing privilege, brokers / records access, rotates the secret, or segments the tier. It is the same lens the rest of this repo uses for the sysadmin → PAM architect path — see the attack → defense matrix and foundations/.
| Doc | What it gives you |
|---|---|
| attack-to-control-matrix.md | Master table: attack → detection → control, grouped by module |
| pam-playbook.md | The PAM control set (vault, JIT, tiering, gMSA, LAPS, session brokering) and what each defeats |
| pam-architecture.md | A PAM reference architecture (illustrated with CyberArk's component model) + a Zero-Standing-Privilege maturity model |
| identity-attack-paths.md | Kerberoasting, delegation abuse, DCSync, ADCS ESC1–8, golden/silver tickets, Entra token theft |
| detection-engineering.md | Windows event IDs, Sigma rules, KQL/Splunk queries, PAM threat-analytics signals |
| cyberark-attack-mapping.md | Worked example: PAM component ↔ CEH attack it defeats (both lookup directions) |
The vendor named in the architecture pages is a worked example of a PAM stack, not a certification track — this repo does not cover vendor PAM certifications.
🧪 Labs & tools¶
| Resource | What it is |
|---|---|
| labs/README.md | Runnable range: Docker web targets, OT/ICS simulators, Vagrant Kali + Metasploitable2, an Ansible AD/ADCS lab with a tiered-admin (PAM) model, a chained capstone and a blue-team detection lab |
| labs/building-a-ceh-lab.md · practice kit | Lab design principles and the public practice ranges (TryHackMe, HTB, PortSwigger…) |
| kali/ · KALI-TUTORIAL.md | A 17-chapter beginner → mastery Kali course, and a one-page tool reference |
| tools/tools-by-phase.md · cheatsheets/ | Tools mapped to phases; quick-reference sheets (nmap, Metasploit, hashcat, AD, web/SQLi, Wireshark…) |
| scripts/ | Terminal flashcard quiz, Anki deck builder, and the hub's own integrity validator |
Run the course's validator from this folder: python3 scripts/validate.py (also run in CI).
📦 Everything here (clickable index)¶
Orient: Roadmap (beginner → master) · What is CEH · Exam & eligibility · Legal & ethics · Engagement methodology & reporting · Known limitations
Study the theory: Concept pages 01–20 · Course modules 01–20 · The 12-week study plan · Exam strategy · Glossary · Blueprint coverage · Progress tracker · Exam logistics
Learn the tools & do labs: Practice kit · Kali course · Kali reference · Lab environment · Capstone chain · Cheatsheets · Tools by phase
Pass the exams: Practice questions (concept track) · Cheat sheet · Mock exam — 50 Q · Full mock — 125 Q · Rapid-fire bank — 200 Q · CEH Practical prep · Challenge generator · Drill packs · Simulated exams
Go deeper: Defender / PAM · OT / ICS security · Identity attack paths · Detection engineering · AI-driven hacking · AI study workflow · Career & adjacent certs · Resources · Deep references
🔗 Official EC-Council references¶
- CEH program home — https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/
- CEH v13 brochure / syllabus PDF — https://www.eccouncil.org/cehv13-brochure/
- CEH learning framework — https://www.eccouncil.org/cybersecurity-exchange/ethical-hacking/ceh-learning-framework/
- EC-Council Continuing Education (ECE) policy — https://cert.eccouncil.org/ece-policy.html
- Exam via Pearson VUE — https://home.pearsonvue.com/eccouncil
Anything about weights, eligibility, cost, or policy that you cannot confirm on the links above should be treated as unverified. CEH, C|EH and EC-Council are trademarks of EC-Council, used here for identification and educational purposes only.