Certified Ethical Hacker (CEH) Cert Guide
Your comprehensive guide to mastering ethical hacking and preparing for the CEH v15 exam.
Bestselling authors and security experts Michael Gregg and Omar Santos bring you the most up-to-date and practical preparation guide for the CEH v15 exam. Whether you’re preparing to become a Certified Ethical Hacker or looking to deepen your knowledge of cybersecurity threats and defenses, this all-in-one guide delivers the essential content and hands-on practice you need to succeed.
This newly updated edition reflects the latest EC-Council exam objectives and the evolving threat landscape, including cloud, IoT, AI-driven attacks, and modern hacking techniques.
Designed for both exam readiness and long-term career success, this guide features
- Chapter-opening objective lists to focus your study on what matters most
- Key Topic indicators that highlight exam-critical concepts, figures, and tables
- Exam Preparation Tasks that include real-world scenarios, review questions, key term definitions, and hands-on practice
- A complete glossary of ethical hacking terms to reinforce essential vocabulary
Master all CEH v15 topics, including
- Ethical hacking foundations and threat landscape updates
- Footprinting, reconnaissance, and scanning methodologies
- System hacking, enumeration, and privilege escalation
- Social engineering, phishing, and physical security
- Malware analysis and backdoor detection
- Sniffing, session hijacking, and advanced denial-of-service techniques
- Web application, server, and database attacks
- Wireless network vulnerabilities and mobile device security
- IDS/IPS systems, firewalls, and honeypots
- Cryptographic algorithms, attacks, and defenses
- Cloud-based security, IoT threats, and botnet analysis
Whether you’re pursuing CEH certification or building real-world skills, this guide will equip you with the up-to-date knowledge and practical insights to detect, prevent, and respond to modern cyber threats.
Table of Contents:
Introduction
Chapter 1 An Introduction to Ethical Hacking
“Do I Know This Already?” Quiz
Foundation Topics
Security Fundamentals
Goals of Security
Risk, Assets, Threats, and Vulnerabilities
Backing Up Data to Reduce Risk
Defining an Exploit
Risk Assessment
Security Testing
No-Knowledge Tests (Black Box)
Full-Knowledge Testing (White Box)
Partial-Knowledge Testing (Gray Box)
Types of Security Tests
Incident Response
Hacking Methodologies and Frameworks
Hacking Concepts: Hacker and Cracker Descriptions
Who Attackers Are
Ethical Hacking Concepts: Ethical Hackers
Required Skills of an Ethical Hacker
Modes of Ethical Hacking
Ethical Hacking Limitations
Test Plans[md]Keeping It Legal
Test Phases
Establishing Goals
Getting Approval
Ethical Hacking Report
Vulnerability Research and Bug Bounties[md]Keeping Up with Changes
Ethics and Legality
Overview of U.S. Federal Laws
Compliance Regulations
Payment Card Industry Data Security Standard (PCI-DSS)
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Exercises
1-1 Searching for Exposed Passwords
1-2 Examining Security Policies
Review Questions
Suggested Reading and Resources
Chapter 2 The Technical Foundations of Hacking
“Do I Know This Already?” Quiz
Foundation Topics
The Hacking Process
Performing Reconnaissance and Footprinting
Scanning and Enumeration
Gaining Access
Escalating Privilege
Maintaining Access
Covering Tracks and Planting Backdoors
The Ethical Hacker’s Process
NIST SP 800-115
Operationally Critical Threat, Asset, and Vulnerability Evaluation
Open Source Security Testing Methodology Manual
Information System Security Assessment Framework
Penetration Testing Execution Standard
MITRE ATT&CK Framework
Information Security Systems and the Stack
The OSI Model
Anatomy of TCP/IP Protocols
The Application Layer
The Transport Layer
Transmission Control Protocol
User Datagram Protocol
The Internet Layer
Traceroute
The Network Access Layer
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Exercises
2-1 Install a Sniffer and Perform Packet Captures
2-2 Using Traceroute for Network Troubleshooting
Review Questions
Suggested Reading and Resources
Chapter 3 Footprinting, Reconnaissance, Scanning, and Enumeration
“Do I Know This Already?” Quiz
Foundation Topics
Footprinting
Footprinting and Reconnaissance Methodology
Documentation
Footprinting Through Search Engines
Footprinting Through Social Networking Sites
Footprinting Through Web Services and Websites
Email Footprinting
Whois Footprinting
DNS Footprinting
Network Footprinting
Subnetting’s Role in Mapping Networks
Traceroute
Footprinting Through Social Engineering
Footprinting Countermeasures
Scanning
Host Discovery
Port and Service Discovery
Nmap
SuperScan
THC-Amap
Hping
Port Knocking
OS Discovery (Banner Grabbing/OS Fingerprinting) and Scanning Beyond IDS and Firewall
Active Fingerprinting Tools
Fingerprinting Services
Network Scanning Countermeasures
Network Scanning Countermeasure Techniques
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Exercises
3-1 Performing Passive Reconnaissance
3-2 Performing Active Reconnaissance
Review Questions
Suggested Reading and Resources
Chapter 4 Enumeration and System Hacking Attack Techniques
“Do I Know This Already?” Quiz
Foundation Topics
Enumeration
Windows Enumeration
Windows Security
NetBIOS and LDAP Enumeration
NetBIOS Enumeration Tools
SNMP Enumeration
Linux/UNIX Enumeration
NTP Enumeration
SMTP Enumeration
Other Enumeration Techniques
DNS Enumeration
Enumeration Countermeasures
System Hacking Phases and Attack Techniques
Password Cracking
Nontechnical Password Attacks
Technical Password Attacks
Password Guessing
Automated Password Guessing
Password Sniffing
Keylogging
Escalating Privilege and Exploiting Vulnerabilities
Exploiting an Application
Exploiting a Buffer Overflow
Owning the Box
Windows Authentication Types
Cracking Windows Passwords
Linux Authentication and Passwords
Cracking Linux Passwords
Hiding Files and Covering Tracks
Rootkits
File Hiding
Establishing Persistence
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Exercise
4-1 NTFS File Streaming
Review Questions
Suggested Reading and Resources
Chapter 5 Social Engineering, Malware Threats, and Vulnerability Analysis
“Do I Know This Already?” Quiz
Foundation Topics
Social Engineering
Phishing
Pharming
Malvertising
Spear Phishing
SMS Phishing
Voice Phishing
Whaling
Elicitation, Interrogation, and Impersonation (Pretexting)
Social Engineering Motivation Techniques
Shoulder Surfing and USB Baiting
Malware Threats
Viruses and Worms
Types and Transmission Methods of Viruses and Malware
Virus Payloads
History of Viruses
Well-Known Viruses and Worms
Virus Creation Tools
Trojans
Trojan Types
Trojan Ports and Communication Methods
Trojan Goals
Trojan Infection Mechanisms
Effects of Trojans
Trojan Tools
Distributing Trojans
Wrappers
Packers
Droppers
Crypters
Ransomware
Covert Communications
Tunneling via the Internet Layer
Tunneling via the Transport Layer
Tunneling via the Application Layer
Port Redirection
Keystroke Logging and Spyware
Hardware Keyloggers
Software Keyloggers
Spyware
Malware Countermeasures
Detecting Malware
Antivirus
Analyzing Malware
Static Analysis
Dynamic Analysis
Vulnerability Analysis
Passive vs. Active Assessments
External vs. Internal Assessments
Vulnerability Assessment Solutions
Tree-Based vs. Inference-Based Assessments
Vulnerability Scoring Systems
Vulnerability Scanning Tools
Use of Artificial Intelligence (AI)
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Command Reference to Check Your Memory
Exercises
5-1 Finding Malicious Programs
5-2 Using Process Explorer
Review Questions
Suggested Reading and Resources
Chapter 6 Sniffers, Session Hijacking, and Denial of Service
“Do I Know This Already?” Quiz
Foundation Topics
Sniffers
Passive Sniffing
Active Sniffing
Address Resolution Protocol
ARP Poisoning and MAC Flooding
Tools for Sniffing and Packet Capturing
Wireshark
Other Sniffing Tools
Sniffing and Spoofing Countermeasures
Session Hijacking
Transport Layer Hijacking
Application Layer Hijacking
Session Hijacking Tools
Preventing Session Hijacking
Denial of Service (DoS) and Distributed Denial of Service (DDos)
DoS/DDoS Attack Techniques
Volumetric Attacks
SYN Flood Attacks
ICMP Attacks
Peer-to-Peer Attacks
Application-Level Attacks
Permanent DoS Attacks
Distributed Denial of Service
DDoS Tools
DoS and DDoS Countermeasures
DoS/DDoS Protection Tools
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Exercises
6-1 Scanning for DDoS Programs
6-2 Spoofing Your MAC Address in Linux
6-3 Using the KnowBe4 SMAC to Spoof Your MAC Address
Review Questions
Suggested Reading and Resources
Chapter 7 Web Server Hacking, Web Applications, and Database Attacks
“Do I Know This Already?” Quiz
Foundation Topics
Web Server Hacking
The HTTP Protocol
Scanning Web Servers
Banner Grabbing and Enumeration
Web Server Vulnerability Identification
Web Server Attack Methodology
DoS/DDoS Attacks
DNS Server Hijacking and DNS Amplification Attacks
Directory Traversal
On-Path Attacks
Website Defacement
Web Server Misconfiguration
HTTP Response Splitting
Understanding Cookie Manipulation Attacks
Web Server Password Cracking
Web Server[nd]Specific Vulnerabilities
Comments in Source Code
Lack of Error Handling and Overly Verbose Error Handling
Hard-Coded Credentials
Race Conditions
Unprotected APIs
Hidden Elements
Lack of Code Signing
Automated Exploit Tools
Web Server Attack Countermeasures
Web Application Hacking
Unvalidated Input
Parameter/Form Tampering
Injection Flaws
Cross-Site Scripting (XSS) Vulnerabilities
Reflected XSS Attacks
Stored XSS Attacks
DOM-Based XSS Attacks
XSS Evasion Techniques
XSS Mitigations
Understanding Cross-Site Request Forgery Vulnerabilities and Related Attacks
Understanding Clickjacking
Other Web Application Attacks
Exploiting Web-Based Cryptographic Vulnerabilities and Insecure Configurations
Web-Based Password Cracking and Authentication Attacks
Understanding What Cookies Are and Their Use
URL Obfuscation
Intercepting Web Traffic
Securing Web Applications
Lack of Code Signing
Database Hacking
A Brief Introduction to SQL and SQL Injection
SQL Injection Hacking Tools
Summary
Exam Preparation Tasks
Review All Key Topics
Exercise
7-1 Complete the Exercises in WebGoat
Review Questions
Suggested Reading and Resources
Chapter 8 Wireless Technologies, Mobile Security, and Attacks
“Do I Know This Already?” Quiz
Foundation Topics
Wireless and Mobile Device Technologies
Mobile Device Concerns
Mobile Device Platforms
Android
iOS
Windows Mobile Operating System
BlackBerry
Mobile Device Management and Protection
Bluetooth
Radio Frequency Identification (RFID) Attacks
Wi-Fi
Wireless LAN Basics
Wireless LAN Frequencies and Signaling
Wireless LAN Security
Attacking the Preferred Network Lists
Jamming Wireless Signals and Causing Interference
War Driving
Wireless Networks Configured with Open Authentication
Additional Wireless Hacking Tools
Performing GPS Mapping
Wireless Traffic Analysis
Launch Wireless Attacks
Crack and Compromise the Wi-Fi Network
Wireless Attack Countermeasures
Site Survey
Misuse Detection
Signs of Router or Wi-Fi Hacking
Preventing Wi-Fi Hacking
The Wi-Fi Is Hacked[md]What To Do?
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Review Questions
Suggested Reading and Resources
Chapter 9 Evading IDS, Firewalls, and Honeypots
“Do I Know This Already?” Quiz
Foundation Topics
Intrusion Detection and Prevention Systems
IDS Types and Components
Pattern Matching
Protocol Analysis
Heuristic-Based Analysis
Anomaly-Based Analysis
Global Threat Correlation Capabilities
Snort
IDS Evasion Techniques
IDS Evasion Tools
Firewalls
Firewall Types
Network Address Translation
Packet Filters
Application and Circuit-Level Gateways
Stateful Inspection
Identifying Firewalls
Bypassing Firewalls
Evading NAC and Endpont Security
Mitigation for NAC Evasion
IDS and Firewall Evasion Countermeasures
Honeypots
Types of Honeypots
Detecting Honeypots
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Review Questions
Suggested Reading and Resources
Chapter 10 Cryptographic Attacks and Countermeasures
“Do I Know This Already?” Quiz
Foundation Topics
Cryptography History and Concepts
Encryption Algorithms
Symmetric Encryption
Data Encryption Standard (DES)
Advanced Encryption Standard (AES)
Rivest Cipher
Asymmetric Encryption (Public Key Encryption)
RSA
Diffie-Hellman
ElGamal
Elliptic-Curve Cryptography (ECC)
Digital Certificates
Public Key Infrastructure
Trust Models
Single-Authority Trust
Hierarchical Trust
Web of Trust
Email and Disk Encryption
Cryptoanalysis Tools and Attacks
Weak Encryption
Encryption-Cracking Tools
Security Protocols and Countermeasures
Steganography
Digital Watermark
Hashing
Digital Signature
Quantum Cryptography
Cryptographic Attack Countermeasures
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Exercises
10-1 Examining an SSL Certificate
10-2 Using PGP
10-3 Using a Steganographic Tool to Hide a Message
Review Questions
Suggested Reading and Resources
Chapter 11 Cloud Computing, IoT, and Botnets
“Do I Know This Already?” Quiz
Foundation Topics
Cloud Computing
Cloud Computing Issues and Concerns
Cloud Computing Attacks
Cloud Computing Security
DevOps, Continuous Integration (CI), Continuous Delivery (CD), and DevSecOps
CI/CD Pipelines
Serverless Computing
Containers and Container Orchestration
Cloud Computing Security Issues
How to Scan Containers to Find Security Vulnerabilities
Cloud Security
IoT
IoT Protocols
IoT Implementation Hacking
Botnets
Botnet Countermeasures
Summary
Exam Preparation Tasks
Review All Key Topics
Define Key Terms
Review Questions
Suggested Reading and Resources
Chapter 12 Final Preparation
Hands-on Activities
Suggested Plan for Final Review and Study
Summary
Glossary of Key Terms
Appendix A Answers to the “Do I Know This Already?” Quizzes and Review Questions
About the Author :
Michael Gregg (CISSP, SSCP, CISA, MCSE, MCT, CTT+, A+, N+, Security+, CCNA, CASP, CISA, CISM, CEH, CHFI, and GSEC) directs the cybersecurity operations for a multinational organization that operates facilities worldwide. As the CISO, Michael is responsible for securing the organization’s assets on a global scale. Michael is responsible for developing cost-effective and innovative technology solutions for security issues and for evaluating emerging technologies.
He has more than 20 years of experience in the IT field and holds two associate’s degrees, a bachelor’s degree, and a master’s degree. In addition to coauthoring the first, second, and third editions of Security Administrator Street Smarts, Michael has written or coauthored more than 20 other books.
Michael has testified before a U.S. congressional committee, has been quoted in newspapers such as the New York Times, and was featured on various television and radio shows, including NPR, ABC, CBS, Fox News, and others, discussing cybersecurity and ethical hacking. He has created more than a dozen IT security training classes. He has created and performed video instruction on many security topics, such as cybersecurity, CISSP, CISA, Security+, and others.
When not working, speaking at security events, or writing, Michael enjoys 1960s muscle cars and has a slot in his garage for a new project car.
Omar Santos is an active member of the cybersecurity community. His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants that are dedicated to increasing the security of their critical infrastructure. Omar is the lead of the DEF CON Red Team Village, the chair of the OASIS Common Security Advisory Framework (CSAF), and has been the leader of several working groups in the Industry Consortium for Advancement of Security on the Internet (ICASI) and the Forum of Incident Response and Security Teams (FIRST).
Omar is the author of more than 20 books and video courses and numerous white papers, articles, and security configuration guidelines and best practices. Omar is a principal engineer of the Cisco Product Security Incident Response Team (PSIRT), where he mentors and leads engineers and incident managers during the investigation and resolution of security vulnerabilities. Omar has been quoted by numerous media outlets, such as The Register, Wired, ZDNet, ThreatPost, CyberScoop, TechCrunch, Fortune, Ars Technica, and more. Additional information about Omar can be obtained from h4cker.org and omarsantos.io. You can follow Omar on Twitter at @santosomar.
