CEH v13 — The 12-Week Study Plan¶

The single week-by-week plan for the CEH v13 knowledge exam (312-50v13), with an optional two-week extension for the CEH Practical. It sequences both layers of this hub — the concept page and the course folder of each module — plus the lab, the drills and a weekly milestone you can check. The method behind it is the repo-wide how to prepare a certification; the exam mechanics are in EXAM-LOGISTICS.md and exam & eligibility.

Time estimates are suggestions, not requirements. The cadence assumes a working sysadmin at roughly 8–10 hours a week. Stretch or compress it to your exam date; EC-Council does not mandate a study duration. Halve the pace rather than skip the labs.

Before Week 1 — set-up (Week 0)¶

[ ] Commit. Write why CEH now (one sentence tied to the skill path) and pick a target exam date.
[ ] Eligibility. Choose your route — official training, or the experience-based application — and fill the verify fields in EXAM-LOGISTICS.md from EC-Council's site.
[ ] Blueprint. Download the official CEH v13 blueprint PDF and record its domain weights in EXAM-LOGISTICS.md; this hub deliberately does not print them. Confirm coverage with BLUEPRINT-COVERAGE.md.
[ ] Self-assess with the competency matrix; your 🟥 rows get extra time.
[ ] Lab. Stand up the self-hosted lab (docker compose up, then vagrant up for the Windows/AD layer). Nothing below works without it.
[ ] New to Linux or Kali? Work the Kali course chapters 00–05 first; every module assumes the terminal.
[ ] Tracking. Open PROGRESS.md and keep its weak-area log from day one.

Ground rules¶

Do the lab, don't just read it. CEH questions are heavily tool- and command-oriented; muscle memory beats recognition.
Use your PAM / sysadmin lens. For every attack ask "which control that I already run would have stopped this?" — every module's Defender & PAM section answers it. That mapping is your fastest path to retention and to the "best defence" questions.
Ports and protocols from day one. Start cheatsheets/ports-and-protocols.md in Week 1 and review it every week.
Recall, not re-reading. Each module ships facts.md, original practice-questions.md and an Anki-ready flashcards.csv; the drill prompts are in AI-STUDY-WORKFLOW.md. Read EXAM-STRATEGY.md once in Week 1.
Legal lab only. Practise solely on systems you own or are authorised in writing to test — see legal & ethics.

The weekly loop (repeat for every module)¶

flowchart LR
    S1["1. READ<br/>concept page +<br/>module README"]
    S2["2. TOOLS<br/>run each key command<br/>once in the lab"]
    S3["3. LAB<br/>lab-walkthrough.md;<br/>fill the lab log"]
    S4["4. DEFEND<br/>Defender & PAM section;<br/>note the control"]
    S5["5. RECALL<br/>practice-questions.md<br/>then flashcards.csv"]
    S6["6. TRACK<br/>PROGRESS.md +<br/>weak-area log"]
    S1 --> S2 --> S3 --> S4 --> S5 --> S6

Move on when the module's practice set scores ≥ 80%; otherwise log the misses and re-test them first next session. Ten minutes of flashcards on the other days keeps the spacing going (python3 scripts/quiz.py --module NN, or import the CSV into Anki — see scripts/).

The schedule¶

Each row names the concept page (fast, source-grounded what) and the course folder (guide, facts, questions, flashcards, lab walkthrough). The milestone is the thing you must be able to do before the week ends.

Week	Modules	Concept pages	Course folders	Lab targets	Milestone — you can…
1	01 Intro · 02 Footprinting	what is CEH · 5 phases · legal & ethics · 01 · 02	01 · 02	External recon of the lab; WHOIS / DNS	recite the 5 phases in order, state the exam format, and distinguish passive from active recon naming 5 footprinting sources
2	03 Scanning · 04 Enumeration	03 · 04	03 · 04	Metasploitable, the DVWA host	explain the TCP handshake and why a SYN scan is "stealthy"; enumerate SMB, SNMP and LDAP and say what enumeration adds beyond scanning
3	05 Vuln Analysis · 06 System Hacking	05 · 06	05 · 06	Metasploitable; the Windows / AD lab	read a CVSS band; classify password-attack types; name 3 privilege-escalation and 3 persistence techniques
4	07 Malware · 08 Sniffing	07 · 08	07 · 08	Lab-segment traffic	tell virus / worm / Trojan / rootkit apart; explain ARP poisoning vs MAC flooding and the switch-side control for each
5	09 Social Engineering · 10 DoS	09 · 10	09 · 10	SET and load tests, lab only	classify volumetric / protocol / application-layer DoS; match each human attack to a control
6	11 Session Hijacking · 12 Evasion	11 · 12	11 · 12	Web targets; Snort / Suricata	explain application- vs network-level hijacking and signature vs anomaly detection; match every attack from Weeks 4–6 to a defensive control
7	13 Web Servers · 14 Web Apps	13 · 14	13 · 14	DVWA, Juice Shop, WebGoat	name the OWASP Top 10 categories and exploit one XSS and one traversal in the lab
8	15 SQL Injection	15	15	DVWA, bWAPP, sqlmap	tell in-band, blind and out-of-band SQLi apart and state parameterised queries as the fix
9	16 Wireless · 17 Mobile	16 · 17	16 · 17	Your own AP; an Android emulator	contrast WEP / WPA2 / WPA3 and explain evil-twin and deauth; outline the Android and iOS threat models
10	18 IoT/OT · 19 Cloud	18 · 19	18 · 19	Docker; a cloud free tier you own	name the shared-responsibility boundary; explain Modbus / SCADA exposure and default-credential risk
11	20 Cryptography · AI (v13)	20 · AI in ethical hacking	20 · AI-IN-ETHICAL-HACKING.md	hashcat / john in the lab	distinguish symmetric vs asymmetric and encrypt vs sign; describe prompt injection and adversarial ML in one sentence each
12	Review + mocks	cheat sheet · cheatsheets/	every `facts.md`	Mixed	pass the readiness gate below

Capstone (from Week 3, once the AD lab is up): run the capstone chain — recon → Kerberoast → delegation → ADCS → DCSync — then re-run it with the fixes applied and detect your own attack in the logs. Do it at least twice before Week 12.

Weeks 12 and beyond — the readiness gate¶

Book the knowledge exam when all of these hold:

[ ] Every module row in PROGRESS.md has all four columns ticked.
[ ] Every module's practice-questions.md scores ≥ 80% on a second, spaced attempt.
[ ] The 50-question checkpoint (MOCK-EXAM.md) and the 125-question timed full mock (MOCK-EXAM-FULL.md) both score ≥ 85%, at the real pace of about 1.9 minutes per question.
[ ] The rapid-fire bank and the cheat sheet are automatic: well-known ports, Nmap flags and scan types, the Metasploit workflow, hash and crypto algorithm properties, tool → purpose pairs, CVSS bands.
[ ] The trap pairs are cold.
[ ] No open row in the weak-area log is older than a week.

Then follow EXAM-STRATEGY.md for exam week and exam day.

Weeks 13–14 (optional) — CEH Practical¶

Only if you are going for CEH Master (knowledge exam + Practical):

Work the practical/ skills checklist, challenge playbooks and timed drills; the challenge lab covers stego, pcap, crypto and hashes.
Rebuild the key labs from scratch without notes: discovery, enumeration, password cracking, web exploitation and basic post-exploitation, inside a self-imposed time box.
Practise note-taking and screenshot discipline; the Practical is scored on results you demonstrate.
Milestone: a full lab chain end-to-end, under time, before you book the 6-hour range.

Study tips for a sysadmin¶

Relabel, don't relearn. You know TCP/IP, DNS, AD, SMB and services; CEH asks you to see them from the attacker's side.
Master ports and scan types cold. High-frequency, low-effort points; the cheat-sheet port table is the best return on study time.
Learn tools by category. The exam tests "which tool for which job" (scanner vs sniffer vs cracker). One representative tool per category beats memorising hundreds.
Watch the qualifier words. passive / active / stealth / BEST / FIRST / MOST likely / NOT / EXCEPT decide most items. Read every option.
Space the reviews. Short daily sessions plus a weekly mixed recall beat one long cram.

External study references (verify current editions)¶

CEH v13 official brochure / syllabus — https://www.eccouncil.org/cehv13-brochure/
EC-Council CEH program page — https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/
MITRE ATT&CK (technique reference that maps well to the modules) — https://attack.mitre.org/
OWASP Top 10 (web modules) — https://owasp.org/www-project-top-ten/
NIST SP 800-115 (technical assessment methodology) — https://csrc.nist.gov/pubs/sp/800/115/final