CEH Certified Ethical Hacker Foundations

The Certified Ethical Hacker (CEH) exam tests a structured, authorized approach to security testing. Ethical hacking is performed with permission to discover and fix weaknesses. A penetration test simulates attacks inside an approved scope, with rules of engagement that define targets, timing, and allowed actions. The standard workflow includes reconnaissance, scanning and enumeration, vulnerability analysis, exploitation, post-exploitation, and reporting. Red teams simulate attackers, while blue teams defend and respond. Risk is the combination of likelihood and impact, and a vulnerability is a weakness that an exploit can use. Understanding the phases helps testers stay legal, focused, and safe. Always obtain written authorization before testing, stay inside scope, and report findings with evidence and remediation advice.

Reconnaissance gathers information before any active attack. Footprinting collects public data about a target, and OSINT uses sources such as websites, social media, job posts, and registration records. Passive reconnaissance observes public information without touching the target, while active reconnaissance sends probes that may create logs. WHOIS reveals domain registration details, and DNS enumeration discovers subdomains and mail servers. Social engineering targets people instead of systems: phishing sends deceptive messages, pretexting builds a fake scenario, and other tricks convince users to reveal credentials. Search engines can expose documents and directories if they are indexed. Defenders should reduce public exposure, train users, and monitor for suspicious contact. Testers should always stay within scope and handle collected data responsibly.

Scanning turns reconnaissance into a map of live hosts and services. A ping sweep finds which hosts are up, and port scanning identifies open ports. Nmap is the most common scanner and supports techniques such as SYN scans. Service enumeration identifies the software and version behind each open port, and banner grabbing reads service banners for version details. OS fingerprinting analyzes responses to identify the operating system. Vulnerability scanning compares systems against databases of known weaknesses. Testers must understand how scanners work, interpret false positives, and avoid disrupting production systems. Defenders use the same tools to verify patching and reduce exposed services. In the CEH exam, know common ports, scan types, and when each technique is appropriate.

Exploitation uses a vulnerability to gain access. Frameworks such as Metasploit deliver payloads that run on the target. After access, testers escalate privileges, move laterally, maintain persistence, and collect evidence. A reverse shell makes the target connect back to the tester, while a bind shell listens on the target. Web applications are common targets. SQL injection alters queries to read or modify data, XSS runs scripts in a victim browser, and CSRF forces users to submit unwanted requests. IDOR exposes objects through direct references, and directory traversal reads files outside the web root. OWASP Top 10 lists the most common risks. Input validation, secure session handling, web application firewalls, and proper configuration reduce these attacks. Always test in an authorized environment and avoid damaging data.

Defense uses layers of controls to reduce risk. Cryptography protects confidentiality and integrity: encryption protects data at rest and in transit, while hashing verifies integrity and salts resist precomputed attacks. Wireless security uses protocols such as WPA2. Malware includes trojans, rootkits, and ransomware, so organizations need antivirus, endpoint detection, patch management, and user awareness. Honeypots attract attackers and reveal their methods. Defense in depth combines network, host, application, and human controls so one failure does not compromise everything. Tools are used by both sides: Nmap scans networks, Metasploit tests exploits, Wireshark analyzes packets, and Burp Suite tests web applications. A good security program monitors, patches, tests, and responds continuously. CEH candidates should know the purpose of each tool and how controls map to the phases of an attack.