CEH Certified Ethical Hacker Practice

Ethical hacking is authorized security testing performed with permission to discover weaknesses. Unauthorized access, malware, and reading private email are illegal activities.

A penetration test simulates real attacks within an approved scope to find vulnerabilities. It is not a backup, update, or password reset.

Reconnaissance, or footprinting, gathers information about the target before scanning or exploitation. The later phases come after information is collected.

Scope defines which systems can be tested and what actions are allowed. It prevents accidental damage and keeps the engagement legal.

A vulnerability is a weakness in a system or process. Patches, firewalls, and passwords are controls that reduce risk.

An exploit is a way to use a vulnerability to gain access or cause harm. Scanners, backups, and VPNs are not exploits.

Risk is usually expressed as the likelihood of a threat times the impact. Open ports, password length, and speed are related factors, not the definition of risk.

A red team acts like an adversary to challenge security controls. Blue teams defend, and support and marketing are unrelated.

Blue teams monitor, defend, and respond to security events. Red teams attack, and database or sales teams have different roles.

Ethical hacking includes reconnaissance, scanning, exploitation, post-exploitation, and reporting. Ignoring scope is unethical and prohibited.

Footprinting is the process of collecting public and technical information about a target. It is not deletion, encryption, or firewall installation.

OSINT uses public information such as websites, social media, and registration records. It is not installation, firewalls, or indexes.

Passive reconnaissance observes public data and third-party sources without touching the target. Active techniques scan and interact with systems.

Active reconnaissance sends probes to the target and may generate logs. Public reading is passive.

Social engineering exploits human trust to obtain information or access. Port scanning, encryption, and router configuration are technical controls.

Phishing uses fraudulent emails or messages that look legitimate to trick users. It is not encryption, scanning, or backup.

WHOIS returns registrar, dates, and contact details for domains. It does not reveal passwords, temperatures, or firewall rules.

DNS enumeration finds subdomains, mail servers, and other records that reveal the attack surface. It is not deletion, encryption, or backup.

Pretexting uses a believable story to trick a person into revealing data. It is not scanning, hashing, or VPN setup.

Attackers use search operators to find exposed files and directories. It is not a cache, log, or DNS zone.

Port scanning identifies listening services and open ports. It is not encryption, updates, or password changes.

Nmap is a network scanner used to discover hosts and services. Wireshark captures packets, and Excel or Outlook are not scanners.

A SYN scan sends SYN packets and watches responses without completing the handshake. It is not a disk, virus, or backup scan.

An open port means a service accepts connections. A disabled adapter, blocked rule, or closed session is different.

Service enumeration identifies what software runs on open ports and its version. It is not deletion, restart, or printing.

Vulnerability scanners compare systems against databases of known issues. Manual review, backups, and policies are not scanners.

Banner grabbing connects to a service and reads its banner, which often reveals version details. It is not stealing images, blocking ads, or changing wallpaper.

A ping sweep sends ICMP requests to find live hosts. Password tests, backups, and encryption are separate tasks.

OS fingerprinting analyzes responses and open ports to identify the OS. It is not installation, deletion, or driver updates.

Service banners often include software names and versions, which help attackers and testers identify known vulnerabilities.

Exploitation turns a vulnerability into access or control. Backups, updates, and name changes are not exploits.

Metasploit provides exploits, payloads, and modules for authorized testing. Wireshark analyzes packets and Burp Suite is a web proxy.

A payload is the code that runs on a compromised system. Firewall rules, cables, and tapes are not payloads.

Privilege escalation moves from lower to higher privileges, such as from user to administrator. It is not lowering security, deleting accounts, or encryption.

Lateral movement spreads access across the network after an initial foothold. It is not scanning, restarting, or backups.

Persistence lets attackers keep access after reboots, credential changes, or reconnection. Log deletion, passwords, and encryption are different activities.

A backdoor is a hidden access method that bypasses normal authentication. Firewalls, VPNs, and password managers are defensive tools.

Post-exploitation includes privilege escalation, data collection, lateral movement, and persistence. It happens after initial access.

In a reverse shell, the compromised system initiates a connection back to the attacker, which often bypasses inbound firewall rules. A bind shell listens on the target.

Reverse shells make the target connect outward to the attacker, which can evade inbound restrictions. Bind shells work the opposite way.

SQL injection inserts attacker-controlled SQL into queries to read or modify data. Backups, encryption, and renaming are not attacks.

XSS injects scripts that run in a victim browser. It is not port scanning, hardware theft, or encryption.

CSRF tricks an authenticated user into performing actions they did not intend. It is not a firewall, backup, or DNS record.

The OWASP Top 10 describes the most critical web application risks. It is not a product, language, or database standard.

Input validation rejects unexpected or malicious values before they are processed. It is not deletion, encryption, or theming.

Session cookies keep users authenticated between requests. Themes, logs, and firewall rules are not session identifiers.

Directory traversal uses path manipulation to read files outside the web root. It is not normal navigation, scanning, or permission changes.

A WAF filters HTTP traffic to block attacks. It is not a backup, DNS, or load balancer.

IDOR lets users access objects by guessing or changing identifiers without authorization checks. The other expansions are not official.

Misconfigurations include default credentials, open debug pages, and overly permissive settings. Strong passwords, encryption, and patches reduce risk.

Cryptography uses algorithms and keys to protect confidentiality and integrity. It is not deletion, sorting, or backup.

Hashing produces a fixed-size digest that cannot be reversed, making it useful for integrity checks. Encryption is reversible, and hashing is not a backup or protocol.

Salts make identical passwords produce different hashes and resist rainbow tables. It is not a manager, rule, or partition.

WPA2 protects wireless networks with encryption and authentication. It is not a browser, database, or antivirus.

Malware includes viruses, trojans, ransomware, and spyware. Patches, backups, and firewall rules are defenses.

A trojan hides inside software that looks normal. Firewalls, cables, and indexes are not trojans.

Rootkits hide processes, files, and connections from normal tools. They are not password managers, VPNs, or resolvers.

A honeypot attracts attackers so defenders can observe techniques. It is not a backup, firewall, or domain.

Patch management keeps software updated to close known vulnerabilities. It is not scanning, log deletion, or layout changes.

Nmap scans ports, Metasploit is an exploitation framework, Wireshark analyzes packets, and Burp Suite tests web applications.