CEH v13 Field Manual

Start here: build your practice lab

This expanded edition covers every tool in the preceding 20-module cheat sheet. It adds selected tools from the earlier tool list in an extra recognition section. Options are a practical starter set, not every switch in every release. GUI products use settings and menus rather than a universal command line. Commercial, legacy, wireless, AD, and cloud tools have additional prerequisites, identified in their sections.

Authorization: Use only your own isolated lab, purpose-built training systems, or assets covered by explicit permission. Keep scans within the agreed IPs, accounts, and time window. Examples use synthetic credentials and files. Do not point them at public systems just because an address is reachable.

Validation: Commands were reviewed against the linked project/vendor documentation; they were not executed in your environment. Expected results are illustrative, not recorded test results. Release differences, package builds, permissions, and service configurations can change output. Read local help before running each exercise.

Lab profiles

Set up the network

Use your preferred hypervisor and an official Kali image. Suggested starter allocation: 2 virtual CPUs and 4 GB RAM for Kali, plus 2 CPUs and 2-4 GB RAM for Ubuntu, subject to available host memory. Larger scanners and Android emulators need more. Take clean snapshots before exercises.

For two VMs, put both on the same Internal Network, for example ceh-lab. A host-only network is also usable but includes the host. Avoid bridged networking for vulnerable targets. Temporarily use NAT for trusted downloads, then disconnect it before exercises. Disable shared folders for unknown-file analysis.

Configure Kali as 192.168.56.10/24 and Ubuntu as 192.168.56.20/24, with no gateway on the isolated adapter. These are example addresses: first verify that this subnet does not conflict with your existing networks. Set addresses through each VM's network settings. Run the following in each Linux VM to identify the interface and address:

ip -br addr
ip route

On Kali, create a workspace. All Linux commands below use Bash; do not paste them directly into Windows PowerShell. Each fresh terminal needs the variables again. Unless a section says otherwise, run commands from ~/ceh-lab, including after leaving the DVWA repository. Replace eth0 with the actual isolated interface name.

mkdir -p ~/ceh-lab/reports ~/ceh-lab/www
cd ~/ceh-lab
export TARGET=192.168.56.20
export IFACE=eth0

Stop foreground exercises with Ctrl+C. sudo grants local administrative privileges; it does not grant permission to test another computer. <NAME> denotes a placeholder and must be replaced, including the angle brackets. Quotation marks keep URLs and spaces together. > writes a file and replaces existing contents; >> appends. A trailing backslash continues a Bash command on the next line.

Install the first tools

On Kali, while the temporary update connection is available:

sudo apt update
sudo apt install nmap netcat-openbsd hping3 dnsutils whois
sudo apt install tcpdump curl python3 openssl gnupg

Install other packages as you reach their sections; package names and availability may change. Use apt show PACKAGE before installation. For standalone Windows, commercial, and cloud tools, use the linked official installer. Record the installed version and the help output in your notes.

A: a local HTTP target you can build in minutes

In Kali, create harmless content. Keep this server running in terminal 1. For network exercises, first create ~/ceh-lab on Ubuntu, then run the same commands there and bind to its isolated IP, replacing 127.0.0.1 with 192.168.56.20.

cd ~/ceh-lab
mkdir -p www/admin www/docs
printf 'CEH practice homepage\n' > www/index.html
printf 'Practice admin page\n' > www/admin/index.html
printf 'Practice documentation\n' > www/docs/index.html
printf 'admin\ndocs\nmissing\n' > paths.txt
python3 -m http.server 8000 --bind 127.0.0.1 --directory www

In terminal 2, curl http://127.0.0.1:8000/ should return your homepage. A connection refusal usually means the server stopped or is bound to a different address. This server provides HTTP, not HTTPS, SQL, authentication, or a real vulnerability lab. Use it for discovery and request inspection.

B: target services

On a disposable Ubuntu target, install the packages while NAT is temporarily available. Disconnect NAT afterward. Create a dedicated user and choose a password used nowhere else. Allow required ports only from Kali if a firewall is enabled.

sudo apt update
sudo apt install openssh-server samba snmpd dnsmasq
sudo adduser labuser
sudo systemctl enable --now ssh

SMB: Create /srv/ceh-share and a readme.txt in it. Make the directory readable by labuser. Add a Samba password with sudo smbpasswd -a labuser. Append the following share stanza to /etc/samba/smb.conf, validate with sudo testparm, then restart smbd. These steps are for the disposable target, not an existing server.

[labshare]
   path = /srv/ceh-share
   read only = yes
   valid users = labuser

SNMP: Back up /etc/snmp/snmpd.conf. For the lab, configure an agent listening on the isolated target address and a read-only community restricted to Kali. Remove conflicting agentAddress entries, then restart snmpd. SNMPv2c is deliberately used here to demonstrate its cleartext community string; production deployments should use appropriate SNMPv3 protection.

agentAddress udp:192.168.56.20:161
rocommunity labpublic 192.168.56.10
sysLocation CEH-Lab

DNS: Create /etc/dnsmasq.d/ceh-lab.conf with the settings below. Restart dnsmasq. If port 53 is occupied, identify the listener before changing anything. This is a small lab resolver, not an authoritative zone-transfer server.

listen-address=192.168.56.20
bind-interfaces
no-resolv
address=/web.lab.test/192.168.56.20
mx-host=lab.test,mail.lab.test,10
address=/mail.lab.test/192.168.56.20

Verify from Kali using the enumeration commands in modules 2 and 4. LDAP requires a separately configured LDAP directory or training AD domain; simply installing a client does not create a directory server.

C: the web application lab

Install Docker Engine and the Compose plugin using Docker's instructions. On Kali, clone the official DVWA repository, review its Compose file, and start it. Preserve its localhost-only published address. Current repository defaults use 127.0.0.1:4280; check the file if your version differs.

cd ~/ceh-lab
git clone https://github.com/digininja/DVWA.git
cd DVWA
docker compose up -d
docker compose ps

Open http://127.0.0.1:4280 in the Kali browser. Follow Setup to create/reset the database, sign in with the documented training credentials, and select Low security for the exercises. Set a unique training password if supported. Stop with docker compose down in that repository. Database reset destroys lab data; export anything you want to keep first.

Ready check: You should have a working HTTP page, one known IP per VM, a snapshot, and an output folder. Start modules 3, 8, 13, and 20 with profile A. Move to profile B or C only when its prerequisites work.

Sources: Kali virtualization, Python HTTP server, DVWA setup, Docker CLI and installation navigation.

1. Introduction to Ethical Hacking

The original five-phase model is reconnaissance, scanning, gaining access, maintaining access, and covering tracks. For a professional assessment, maintain evidence and document cleanup rather than hiding your work. A tool finding is an observation to validate, not automatic proof of compromise.

MITRE ATT&CK

Purpose / exam clue: A knowledge base of adversary behavior: tactics explain why; techniques describe how. It is not a scanner and has no scan switches.

Try it: Open the Enterprise matrix. Find Network Service Discovery, read its technique page, and map your Nmap service-discovery exercise to that behavior. Then identify a detection data source. Record the technique ID, your observation, and one defensive control.

Controls: Matrix/domain selection, technique search, sub-techniques, platform filters, and ATT&CK Navigator layers. A technique mapping describes behavior; it does not establish the actor's identity.

Expected / troubleshoot: You can explain the activity without relying on the name of a specific tool. If a technique is absent, check the matrix and spelling. MITRE ATT&CK.

CVE, CVSS, and NVD

Purpose: CVE identifies a disclosed vulnerability; CVSS describes technical severity through a versioned score/vector; NVD provides vulnerability records and enrichment. None is an exploitation command.

Try it: Select one CVE from a lab scanner report. Look up the vendor advisory and NVD record. Compare affected versions with the actual installed package, then read the CVSS vector. Record the scoring version and distinguish technical severity from your asset's business risk.

Controls: CVE ID search; product/version filters; CVSS calculator metrics such as attack vector, privileges required, and user interaction. Do not mix metrics from different CVSS versions. Missing enrichment does not mean a vulnerability is harmless; a high score does not prove your installation is affected.

Success: A short evidence statement containing installed version, applicable advisory, score/vector version, and a proposed fix. CVSS specifications, NVD search.

Cyber Kill Chain (Lockheed Martin model, 7 stages)

Purpose / exam clue: Source: CEH v13 practice exam bank, Module 01 references. Exam questions frequently distinguish this 7-stage model from the 5-phase CEH methodology above (reconnaissance, scanning, gaining access, maintaining access, covering tracks) — they describe the same overall attack lifecycle at different granularity and are not interchangeable term-for-term on the exam.

2. Footprinting & Reconnaissance

Separate passive records research from active queries to your target. Public-data services may require Internet access, accounts, API keys, or payment; they will not discover a private lab.test domain on the public Internet.

WHOIS

Purpose / clue: Registration information, registrar, dates, and name servers. Install Kali package whois.

whois --help
whois example.com

Options: -h SERVER selects a WHOIS server; -p PORT selects its port. This exercise queries a public registry service, not the isolated target. Inspect the registrar and name-server fields; privacy redaction and referrals are normal. Modern registration services may use RDAP, and some WHOIS endpoints no longer answer. A missing registrant name is not a tool failure. Kali WHOIS reference.

nslookup and dig

Purpose / clue: DNS queries. Use profile B's DNS server, or query a public example domain during the online research portion. Install dnsutils on Kali.

nslookup web.lab.test 192.168.56.20
nslookup -type=mx lab.test 192.168.56.20
dig @192.168.56.20 web.lab.test A
dig @192.168.56.20 lab.test MX +short
dig @192.168.56.20 web.lab.test A +tcp

Expected / challenge: web.lab.test resolves to the target; the MX answer names mail.lab.test. Compare normal and +short output. NXDOMAIN means the server reports no such name; SERVFAIL means resolution failed; timeout means no usable response. /etc/hosts entries do not create DNS records for dig. BIND command references.

theHarvester

Purpose / clue: Domain-related emails, hosts, and other OSINT. Install theharvester.

theHarvester -h
theHarvester -d YOUR_OWN_PUBLIC_DOMAIN -b SOURCE -l 20

Replace both uppercase placeholders. Choose a backend listed by your installed help; the earlier -b bing example is version-dependent and may no longer work. -d is the domain, -b the source, -l the result limit; -f BASENAME saves supported report formats.

Lab: Research a public domain you control, choose one supported source, then classify each result as relevant or unrelated. No results can mean no indexed data, an unavailable backend, or a missing API key. A search result is not permission to test the host. Kali theHarvester.

Maltego

Purpose / clue: Graphical relationship analysis. Install the official desktop client and use the available account tier.

Workflow: Create a graph; add a Domain entity for a domain you control; select one DNS-oriented transform; inspect its provider and input; run it; open an output entity's properties. Label inferred relationships separately from confirmed facts.

Controls: Entity properties, transform selection, transform inputs, graph layouts, and export. Transforms may transmit the input to external providers, consume credits, or require keys. Practice first by manually linking two synthetic entities if no provider is configured.

Success: A small annotated graph with the provenance of each edge. Empty results often reflect account limits or missing transform credentials. Maltego documentation.

Recon-ng

Purpose / clue: A modular reconnaissance workspace. Install recon-ng; commands below run inside its console.

recon-ng
help
workspaces create ceh_lab
marketplace search domains

Workflow: Inspect a module with marketplace info MODULE_PATH; install that exact module only after reading its dependencies; use modules load MODULE_PATH, info, and options list. Set SOURCE only if that module defines it; use options set SOURCE YOUR_OWN_PUBLIC_DOMAIN, then run.

Options: Workspace separates datasets; module-specific options control input; keys list shows configured key names. Do not assume old module paths still exist. Empty results may reflect a missing dependency or provider key. Save a result with its source and collection date. Recon-ng reference.

Sublist3r

Purpose / clue: Source: CEH v13 practice exam bank, Module 02 references. A Python OSINT tool purpose-built to enumerate a domain’s subdomains — distinct from theHarvester’s email/host harvesting and Recon-ng’s general-purpose module workspace above. Install sublist3r on Kali.

sublist3r -d YOUR_OWN_PUBLIC_DOMAIN
sublist3r -d YOUR_OWN_PUBLIC_DOMAIN -o reports/subdomains.txt

Sources: queries multiple search engines (Google, Yahoo, Bing, Baidu, Ask) plus Netcraft, VirusTotal, ThreatCrowd, DNSdumpster, and reverse DNS; it also integrates Subbrute for wordlist-based brute-force subdomain discovery. Because it relies on passive, already-published data rather than sending probes to the target, it is a passive-reconnaissance technique.

-d selects the target domain; -o writes output to a file; -b (on supporting builds) enables the brute-force engine; -t sets brute-force thread count. Expected result: a list of discovered subdomains, which expands the attack surface picture before active scanning begins. A short list does not prove few subdomains exist — only that this tool’s sources did not surface more. Sublist3r project.

Shodan

Purpose / clue: Search previously indexed Internet-facing services. No local agent or private-network scanning is implied by a search.

Try it: In the web search field, use hostname:YOUR_OWN_PUBLIC_DOMAIN or net:YOUR_OWN_PUBLIC_CIDR. Add port:443 to narrow results. Replace placeholders with your authorized public assets. product: filters a detected product; country: narrows geography.

Read output: Inspect the banner, IP, port, and observation timestamp. Confirm whether the address still belongs to your asset. Private lab addresses will not produce meaningful public results; use a supplied sample record if you have no public assets. Indexed data can be stale. Shodan search syntax.

FOCA and ExifTool

FOCA purpose: Metadata analysis of documents, especially Office/PDF files. Use a supported Windows installation and the project's dependency instructions. Create a project, add a document you authored locally, extract metadata, then review authors, software names, and embedded paths. Controls are project scope, file types, metadata extraction, and results views. A scanned PDF may contain little useful metadata. FOCA project.

ExifTool purpose: Read and edit metadata. This exercise only reads. Install libimage-exiftool-perl on Kali; copy your own image to sample.jpg.

exiftool sample.jpg
exiftool -G1 -s sample.jpg
exiftool -json sample.jpg > reports/metadata.json

Options: -G1 shows metadata groups; -s uses tag names; -json produces JSON; -r recurses into a directory; -TAG requests one tag. Compare file-system timestamps with embedded image timestamps. Missing GPS or author data is normal; do not infer that metadata proves ownership. ExifTool reference.

3. Scanning Networks

Nmap: discover, identify, and save evidence

Purpose / clue: Hosts, ports, services, versions, and OS clues. A SYN scan is often called stealth or half-open, but modern monitoring can detect it. Install nmap.

Starter exercise: Run the profile A HTTP server. In another Kali terminal, compare a known open port with a likely closed one. Then use profile B for service and OS exercises.

nmap -sT -p 8000,8001 --reason 127.0.0.1
nmap -sV -p 8000 -oN reports/local-web.txt 127.0.0.1
sudo nmap -sn 192.168.56.10 192.168.56.20
sudo nmap -sS -p 22,445,8000 --reason "$TARGET"
sudo nmap -sU -p 53,161 "$TARGET"
sudo nmap -O -p 22,445 "$TARGET"

Read output: Open means a listener responded; closed means no listener was indicated; filtered means Nmap cannot determine openness because traffic is filtered or unanswered. open|filtered is uncertainty, commonly seen with UDP. Service labels can be port-based guesses unless probes identify them. OS detection is an estimate.

NSE lab: Read http-title help, then run it against the web server. The Python page may have no HTML title; that is a valid result. Default scripts are selected by category, not guaranteed harmless for every service.

nmap --script-help http-title
nmap -sV -p 8000 --script http-title "$TARGET"

Challenge: Stop the HTTP server and repeat the first scan. Explain the state change using packets, not just color or labels. If the host appears down, verify the address and route before trying -Pn; that option does not bypass a firewall. Raw scans need suitable local privileges. Options, scan interpretation, host discovery.

Nmap: host discovery (ping scan types)

Purpose / clue: Source: Document 1 (Module 3, Scanning Networks). -sn alone (already covered above) disables port scanning and falls back to Nmap’s default discovery probes. These -P* switches choose which probe type Nmap uses instead, which matters when ICMP is filtered but another protocol is not. All of these disable the port scan unless combined with a full scan type.

nmap -sn -PE "$TARGET"
nmap -sn -PP "$TARGET"
nmap -sn -PM "$TARGET"
nmap -sn -PS22,80 "$TARGET"
nmap -sn -PA80 "$TARGET"
nmap -sn -PU "$TARGET"
nmap -sn -PO "$TARGET"
nmap -sn -PR "$TARGET"

When to use: Start with plain -sn (ARP ping on the local segment). If a routed target shows as down, retry with a specific -P* type, since a firewall may block one probe type while allowing another. On the isolated lab network, -PR (ARP) is the most reliable and matches the default behavior already used in the main Nmap entry above.

Important notes: Host discovery is not port scanning; combine with -sS/-sV etc. or drop -sn to probe ports on the hosts found. A firewall that answers one probe type but not another is common and does not by itself indicate a misconfiguration. Nmap host discovery reference.

Nmap: TCP/UDP/SCTP scan types, IPv6, and list scan

Purpose / clue: Source: Document 1 (Module 3, Scanning Networks). Beyond -sS/-sT/-sU (covered above), Nmap has several less common scan types. Each sends a different combination of TCP flags (or protocol) and reads the response to infer port state; a stateful firewall and an IDS can behave differently for each.

nmap -sF -v "$TARGET"
nmap -sN -v "$TARGET"
nmap -sX -v "$TARGET"
nmap -sM -v "$TARGET"
nmap -sA -v "$TARGET"
nmap -sW -v "$TARGET"
nmap -sY -v "$TARGET"
nmap -sZ -v "$TARGET"
nmap -sL -v "$TARGET"
nmap -6 scanme.nmap.org

Idle (IPID) scan — exam concept: -sI needs a third host (the "zombie") whose IP ID header field increments predictably and is currently idle. The attacker probes the zombie’s current IP ID, sends a SYN to the target spoofed as coming from the zombie, then re-probes the zombie’s IP ID: an increase of 2 means the target responded to the zombie (port open); an increase of 1 means it did not (closed or filtered). Treat this as a recognition topic for the exam; it needs a genuinely idle, globally incrementing zombie host and is not part of the two-VM starter lab.

Important notes: FIN/NULL/Xmas/Maimon scans only work cleanly against RFC-793-compliant stacks and are commonly misread against Windows targets, which return RST for both open and closed ports. SCTP scanning needs a target that actually speaks SCTP. Version/OS detection (-sV/-O) still has to be layered on top of any of these to name the service. Nmap port scanning techniques reference.

Nmap: firewall/IDS evasion and spoofing options

Purpose / clue: Source: Document 1 (Module 3, Scanning Networks). These options change how a scan looks on the wire; they reduce certain kinds of detection risk but do not guarantee invisibility against a modern, properly tuned firewall or IDS — the same caution the existing Nmap entry above already gives for -f and --source-port.

nmap -sS -f "$TARGET"
nmap -D RND:5 "$TARGET"
nmap -D decoy1,decoy2,ME,decoy3 "$TARGET"
nmap --spoof-mac 0 -sT -Pn "$TARGET"
nmap --spoof-mac Apple -sT -Pn "$TARGET"
nmap --randomize-hosts -iL scan.txt
nmap --badsum "$TARGET"

Source routing (exam concept): The IP options field can carry a loose- or strict-source-route list that lets the sender dictate part of a packet’s path, historically used to slip past a router ACL that only inspects the destination. Most modern routers drop source-routed packets by default, so this is a recognition topic rather than a working technique against current infrastructure.

IP address spoofing with Hping3 (recognition, not a lab exercise): hping3 www.example.com -a 7.7.7.7 sends crafted packets with the source address rewritten to 7.7.7.7 (-a). Because the reply routes to the spoofed address rather than back to the attacker, this cannot complete a TCP three-way handshake and is used for Dos-style traffic generation or blind probing, not for establishing a session.

Important notes: Evasion options change what a defender sees, not whether the scan is authorized. Use them only within the explicit scope and authorization already required at the top of this document. Decoys and fragmentation can also slow a scan or get it dropped by intermediate middleboxes. Nmap firewall/IDS evasion reference.

Hping3

Purpose / clue: Construct packets and observe responses. Install hping3; use profile B with SSH listening.

sudo hping3 -S -p 22 -c 3 -i 1 "$TARGET"
sudo hping3 -1 -c 3 "$TARGET"

Options: -S sets SYN; -A sets ACK; -p selects destination port; -c limits packet count; -i sets interval in seconds; -1 selects ICMP; -2 selects UDP; -I selects interface; -n avoids name lookup.

Expected: A listening TCP service generally returns SYN/ACK, often shown as SA; a closed one may return reset. Capture the three probes in Wireshark. No response does not prove the host is absent. Keep exercises count-limited; do not use flood options for this lab. Hping3 options.

Netcat (nc)

Purpose / clue: Connections, listeners, and banner inspection: the networking Swiss Army knife. These examples target OpenBSD-style nc; other implementations differ. Check nc -h.

On Kali terminal 1, listen locally; on terminal 2, connect and type a message. Press Enter to send it and Ctrl+C to finish.

nc -l 127.0.0.1 4444

nc 127.0.0.1 4444

Options: -l listens; -v is verbose; -n avoids DNS; -z checks connectivity without application data; -w 3 limits connection/idle waiting where applicable; -u selects UDP; -N shuts down the write side after input ends on supporting builds.

nc -nvz -w 3 127.0.0.1 8000

Success: A typed line appears in the other terminal and the HTTP port accepts a connection. A plain connection to a web server may show nothing until an HTTP request is sent. -w is not a dependable listener timeout. OpenBSD nc manual.

TCP flags (quick reference)

General TCP/IP reference tying together the -sS/-sF/-sN/-sX/-sA/-sW scan types above: each Nmap scan type sends a specific combination of these flags and reads the response to infer port state. Individually-flag questions on the exam (e.g., "which flag tells the receiver to deliver buffered data immediately") test this table directly.

4. Enumeration

Use profile B's configured services. The account determines what you can see; access denied is meaningful evidence, not a reason to disable security globally.

enum4linux / enum4linux-ng

Purpose / clue: SMB users, groups, shares, and policy. Install enum4linux-ng. Legacy enum4linux has different switches; do not mix manuals.

enum4linux-ng -h
enum4linux-ng -S -U "$TARGET"

Options: -S shares, -U users, -G groups, -P password policy, -A broad enumeration, -u USER and -p PW authentication, -oJ BASE JSON output. Try unauthenticated enumeration first. If using credentials, use only the disposable lab password because a command-line password can appear in history/process listings.

Expected: Some anonymous queries may fail on the secure-by-default Samba target. Repeat only the permitted query with the training account and compare visibility. A standalone Samba host is not AD. enum4linux-ng help.

smbclient

Purpose: List shares and interact with an authorized share. Install smbclient; the password is prompted.

smbclient -L //192.168.56.20 -U labuser
smbclient //192.168.56.20/labshare -U labuser

At its prompt, use ls, get readme.txt, and quit. -L lists shares, -U chooses user, -N suppresses a password prompt for an intentionally anonymous share, -c 'ls' runs a command, and -p selects port.

Success: Read the harmless training file. A share listed by the server is not necessarily accessible. An SMB1 workgroup-browsing warning can occur even when modern SMB share access succeeds. Samba smbclient manual.

snmpwalk

Purpose / clue: Traverse an SNMP subtree. Install Kali package snmp and use profile B's read-only agent.

snmpwalk -v2c -c labpublic -t 2 -r 1 \
  "$TARGET" 1.3.6.1.2.1.1

Options: -v protocol version; -c community for v1/v2c; -t timeout; -r retries; -On numeric OIDs. The final OID selects the subtree. The original public example works only if the target uses that community; this lab uses labpublic.

Expected: System description, name, and your configured location. A timeout can reflect agent binding, UDP filtering, or a wrong community. Numeric OIDs avoid missing-MIB-name problems. Challenge: Find sysLocation and explain why a read-only community is still sensitive. Net-SNMP walk.

ldapsearch

Purpose / clue: LDAP directory queries. Install ldap-utils; requires a configured LDAP/AD training server, not just profile B's base services.

ldapsearch -x -H ldap://192.168.56.20 \
  -s base -b '' namingContexts

Options: -x simple authentication rather than SASL; -H server URI; -b search base; -s base|one|sub scope; -D bind identity; -W prompt for password; -ZZ require StartTLS; -LLL simplify output. The last arguments are filter and requested attributes.

Lab: Read RootDSE naming contexts. Use the returned base for a small authorized search. If authentication is needed, configure trusted TLS before sending credentials; do not disable certificate checking. A server may reject anonymous queries. Success: Explain the difference between a base DN, filter, and returned attribute. OpenLDAP ldapsearch.

dnsrecon and dnsenum

Purpose / clue: DNS enumeration. Install matching Kali packages. First confirm ordinary dig queries work.

dnsrecon -d lab.test -n 192.168.56.20 -t std
dnsenum --help

dnsrecon: -d domain, -n server, -t enumeration type, -D dictionary, -j JSON output. Standard enumeration can report absent record types in the minimal resolver lab.

dnsenum: --dnsserver chooses server, --noreverse skips reverse work, -f supplies a dictionary, -o writes XML. Its normal workflow may attempt zone transfers and other queries; use a separately owned authoritative training zone rather than expecting dnsmasq to support AXFR. For that zone, try dnsenum --dnsserver SERVER --noreverse ZONE after replacing both placeholders.

Success: Distinguish a missing record from a refused transfer. A refused AXFR is often the correct defensive configuration. dnsrecon, dnsenum.

NetBIOS enumeration: nbtstat and net view

Purpose / clue: Source: Document 1 (Module 4, Enumeration). Windows-native NetBIOS-over-TCP/IP queries; use on profile D or an authorized Windows training host, since the starter Linux lab does not run a Windows NetBIOS service.

nbtstat -A <Target IP>
nbtstat -a <Target Name>
nbtstat -c
net view \\<Target IP>
net view /domain

When to use: An early, low-privilege step to identify a host’s NetBIOS name, domain/workgroup, and whether it advertises the file/print-sharing service (suffix <20>) before moving to smbclient/enum4linux for share content. Expected result: name table entries such as <00> (workstation) or <20> (file server service); an empty or refused response can mean SMBv1/NetBIOS is disabled, which is the modern default. Microsoft nbtstat reference.

NFS enumeration: showmount and rpcinfo

Purpose / clue: Source: Document 1 (Module 4, Enumeration). showmount already appears as a one-line recognition card later in this document; this entry adds the paired rpcinfo command and a worked example, since the two are normally used together against an NFS/RPC service.

rpcinfo -p "$TARGET"
showmount -e "$TARGET"

Expected result: rpcinfo returns a program/port table if rpcbind answers; showmount -e returns export paths and the client/network each is exported to. A connection refused from either usually means NFS/rpcbind is not running, common on a pure NFSv4 or firewalled host. Neither command mounts or reads file content by itself. Important notes: needs a separately configured NFS server; the base profile B target does not enable it. Linux rpcinfo/showmount manuals.

NTP enumeration: ntpq and ntpdate

Purpose / clue: Source: Document 1 (Module 4, Enumeration). NTP servers can leak host lists, versions, and internal clients through unauthenticated control-mode queries.

ntpq -c readlist "$TARGET"
ntpq -c peers "$TARGET"
ntpdate -q "$TARGET"

Expected result: A responsive server returns peer/association data; a hardened server restricts control queries (restrict noquery in ntp.conf) and returns little or nothing. Important notes: NTP-amplification concerns lead many administrators to disable monlist/control-mode entirely, so a quiet result is not evidence of a missing service. NTP security reference.

SMTP enumeration: VRFY/EXPN and smtp-user-enum

Purpose / clue: Source: Document 1 (Module 4, Enumeration). Confirms valid mailbox/user names on an SMTP service that still answers the legacy VRFY or EXPN commands.

nc -nv "$TARGET" 25
VRFY root
EXPN admin
smtp-user-enum -M VRFY -U users.txt -t "$TARGET"

Expected result: A confirmed/denied response per username. Important notes: most current mail servers disable VRFY and EXPN by default precisely to prevent this enumeration; a server that refuses both is the modern, secure default, not a failed exercise. smtp-user-enum documentation.

5. Vulnerability Analysis

Nessus

Purpose / clue: Known-vulnerability assessment. Install the official edition available to you; activation, feeds, and target limits depend on the license.

Workflow: Create a basic network scan; set Targets to the single lab IP; leave destructive/DoS checks disabled; select a small port range; run and open one finding. Record its plugin ID, port, evidence, CVE, and remediation. Add lab credentials only for a deliberate comparison between authenticated and unauthenticated coverage.

Settings: Targets/exclusions, discovery, ports, safe checks, credentials, schedule, report export. Start with one host and low concurrency. Feed initialization can take time; a completed scan with no credentials is not a complete patch audit.

Challenge: Fix one configuration issue, rescan the same policy, and compare evidence. Nmap primarily inventories services; Nessus assesses vulnerabilities. Create a Nessus scan.

Greenbone / OpenVAS

Purpose / clue: Vulnerability-scanning ecosystem. Use Greenbone's supported community installation instructions; OpenVAS is the scanner component, not the whole management interface.

Workflow: Wait for feed synchronization; define a target and port list; create a task with a conservative scan configuration; start it; inspect results and export a report. Start with one lab host. For comparison, fix the same issue tested in Nessus.

Settings: Alive test, port list, scan configuration, credentials, severity filters, and quality-of-detection indicators. An empty scan can result from an unsuitable alive test, missing feeds, or unreachable services. Do not label a host secure from one empty report. Greenbone community setup.

Qualys and Retina

Qualys purpose: Cloud-managed vulnerability assessment; private hosts need an appropriate scanner or agent and subscription. Add the lab asset to an authorized test scope, choose an option profile and scanner, scan, then inspect the QID evidence and remediation. Settings include asset scope, ports, authentication, scan intensity, and reporting. An external scanner cannot reach an isolated private VM without a supported architecture. Qualys VMDR documentation.

Retina: Recognize the historical vulnerability-scanner name from the source list. Availability and licensing are product/version-dependent. If a course supplies a licensed training instance, practice defining one lab target, selecting an audit policy, running it, and reviewing evidence. Do not install an arbitrary old binary from a mirror. Use the provided product manual rather than borrowing Nessus switches.

Module check: For each finding write: observed evidence, affected asset/version, confidence, likely impact, fix, and retest. Scanner severity is a prioritization input, not proof of exploitability.

6. System Hacking

Metasploit Framework and msfconsole

Purpose / clue: A framework containing auxiliary scanners, exploit modules, payloads, and post-exploitation modules. Install metasploit-framework. Begin with an auxiliary version check against your SSH service.

msfconsole -q
search type:auxiliary name:ssh_version
use auxiliary/scanner/ssh/ssh_version
info
show options
set RHOSTS 192.168.56.20
set RPORT 22
set THREADS 1
run
back
exit

Options: -q suppresses the startup banner. Inside the console, search locates modules, use selects one, info explains behavior, show options lists required settings, set assigns values, unset clears them, and run executes. Options belong to the selected module; they are not universal.

Success: Record the SSH version banner. A version scanner does not create a session or prove a vulnerability. Avoid treating a search match as an exploit recommendation. Metasploit module options.

Meterpreter

Purpose / clue: A payload/session environment used by Metasploit, not the msfconsole prompt. This exercise requires an already provisioned session in a purpose-built course VM; the starter lab does not create one.

Try it in that session: Run help, sysinfo, getuid, and pwd. Use background to return to msfconsole; there, sessions lists sessions and sessions -i ID selects one. Use the ID actually shown. Record OS, session user, and current directory, then close the course session according to its instructions.

Read output: The session's account context determines access. A session is not automatically an administrator. help and supported commands differ by payload/platform. This introduction uses inspection only. Metasploit documentation.

John the Ripper

Purpose / clue: Offline password/hash auditing. Install john with Jumbo formats, as provided by common Kali builds. Create a synthetic hash and tiny wordlist; never use a real account hash for this exercise.

cd ~/ceh-lab
printf 'LabPass123!' | sha256sum | cut -d ' ' -f 1 > hashes.txt
printf 'wrong\nLabPass123!\n' > wordlist.txt
john --format=Raw-SHA256 --wordlist=wordlist.txt hashes.txt
john --show --format=Raw-SHA256 hashes.txt

Options: --format selects hash type; --wordlist supplies candidates; --show shows recovered entries; --session=NAME names a session; --restore=NAME resumes it; --list=formats lists supported formats on Jumbo.

Expected: Recover the training string. A missing format indicates a different build; a no-hashes-loaded message can mean malformed input or an incorrect format. Previously recovered entries may already be in John's pot file. John reference.

Hashcat

Purpose / clue: High-performance offline recovery, often GPU-accelerated. Install hashcat and a supported compute runtime. Reuse the synthetic files above.

hashcat -I
hashcat -m 1400 -a 0 hashes.txt wordlist.txt
hashcat -m 1400 hashes.txt --show

Options: -m 1400 selects raw SHA-256; -a 0 uses dictionary candidates; -I lists compute backends; --show displays stored recoveries; --session NAME labels a run; --restore resumes; --status displays progress. Hash mode numbers identify formats, not strength.

Expected: The same training password is recovered. If no usable compute device appears, use John for the exercise or follow supported runtime setup; do not suppress errors with --force. Exhausted means the candidates did not match; it does not prove a strong password. Hashcat usage.

L0phtCrack and Cain & Abel (legacy Windows password tools)

Purpose / clue: Source: CEH v13 practice exam bank, Module 06 references. Named alongside John/Hashcat above as classic Windows-targeted password auditing tools; both are GUI Windows applications, not something you drive from a Kali shell the way John/Hashcat are.

L0phtCrack: a Windows password-auditing/recovery tool. Loading a dictionary file into it is the classic example of a dictionary attack; combining that with brute-force character variation is what the exam calls a hybrid attack. Conceptually interchangeable with John the Ripper in exam questions about dictionary/brute-force/hybrid attack definitions.

Cain & Abel: a Windows-only password recovery tool (it does not run on Linux — a common wrong-answer trap on the exam) historically also used for network sniffing and ARP poisoning. Attackers target the Windows SAM file (commonly at C:\Windows\System32\config\SAM) to extract password hashes, then use a tool such as L0phtCrack or Cain & Abel for offline cracking — the same offline-cracking role John/Hashcat fill in the hands-on exercises above, referenced here because the exam names these two specifically.

Hydra

Purpose / clue: Online login testing; unlike John/Hashcat, it sends authentication attempts to a service. Install hydra. Use only profile B's disposable SSH user, with a two-line list containing the password you assigned.

hydra -l labuser -P passwords.txt -t 1 -W 2 -f \
  ssh://192.168.56.20

Options: -l one username; -L user file; -p one password; -P password file; -t concurrency; -W delay between connections per thread; -s non-default port; -f stop on success; -U ssh module help.

Expected: One known valid login, then stop. Authentication can fail because SSH permits keys only or has lockout/rate limits. Keep the target policy intact and inspect logs; do not expand guessing to other users. Remove the disposable password list when finished. Hydra reference.

CrackMapExec / NetExec

Purpose / clue: Source: Document 1 (Module 6, System Hacking). A Swiss-army-knife tool for testing and enumerating Windows/Active Directory networks over SMB — credential validation across many hosts, share and session enumeration, and command execution once valid credentials are known. The project was renamed NetExec (nxc) after CrackMapExec’s original repository was archived; the commands below apply to either, using whichever binary name your installed build provides.

crackmapexec smb 192.168.56.0/24
crackmapexec smb "$TARGET" -u labuser -p 'PASSWORD'
crackmapexec smb "$TARGET" -u labuser -p 'PASSWORD' --shares

When to use: After collecting one or more credentials (from Hydra, a phishing exercise, or elsewhere), to see how far they reach across a network rather than testing hosts one at a time. Important notes: against a disposable training domain only; a sweep across many accounts/hosts is exactly the noisy, lockout-triggering behavior the Hydra entry above warns against, at domain scale. CrackMapExec/NetExec wiki.

Responder

Purpose / clue: Source: Document 1 (Module 6, System Hacking). An LLMNR, NBT-NS, and mDNS poisoner: it answers name-resolution broadcasts that a misconfigured or unpatched Windows host sends when normal DNS resolution fails, tricking the host into authenticating to the attacker’s machine and handing over an NTLM challenge/response hash.

sudo responder -I eth0
sudo responder -I eth0 -A

Expected result: Captured NTLMv2 hashes logged to Responder’s log directory, crackable offline with Hashcat/John using the hash formats documented above. Important notes: this actively manipulates name resolution on the network segment it runs on; run only on an isolated lab adapter with no other traffic, never on shared or production infrastructure, and only against hosts you are authorized to test. Responder project documentation.

Mimikatz

Purpose / clue: Windows credential-security research; associated with LSASS and credential material. Use only a dedicated course Windows VM containing synthetic accounts. Security software may block it; do not disable protections on your everyday system.

Introductory lab: Open the supplied lab copy, use version, help, and exit. Inspect the list of modules and document which require elevated access. module::command is its command syntax; it is not a Bash flag style. Compare tool recognition with Windows controls such as credential isolation and protected processes.

Expected: Understand the interface and access requirements. Credential extraction is not required for this beginner exercise. If blocked, record the prevention result instead of weakening the host. Mimikatz project.

BloodHound

Purpose / clue: Graph relationships and privilege paths in Active Directory. Deploy Community Edition following its quickstart and import compatible synthetic/sample data or a collection explicitly authorized for a training domain.

Workflow: Verify the import completed; search for a lab user; inspect group memberships; choose a path query to an administrative group; open each edge and explain its permission. Then propose removing one unnecessary permission and compare the changed path.

Controls: Data import, node search, path queries, node details, and edge descriptions. Collectors and schemas vary by version; the GUI is not itself the collector. Missing nodes may indicate failed collection/import, not an absence of permissions. Do not upload a real organization's directory data to an unrelated instance. BloodHound CE quickstart.

Rubeus (Kerberos ticket abuse)

Purpose / clue: Source: Document 1 (Module 6 and Module 11). A C# toolset for interacting with Kerberos in an Active Directory environment — requesting, harvesting, and reusing tickets. Used together with BloodHound’s path analysis above: BloodHound finds an abusable relationship, Rubeus is one of the tools used to act on a Kerberos-based one. Requires a dedicated training AD domain with synthetic accounts.

Rubeus.exe asktgt /user:labsvc /rc4:<NTLM hash> /ptt
Rubeus.exe kerberoast /outfile:hashes.txt
Rubeus.exe ptt /ticket:<base64 ticket>

Expected result: A successfully injected ticket lets the session act with the ticket’s privileges without ever supplying the plaintext password; klist shows the injected ticket. Important notes: Kerberoasting and pass-the-ticket both require an existing foothold and valid Kerberos traffic to/from a domain controller — they are post-exploitation/AD-specific techniques, not a network scan. Practice only in a dedicated, disposable training domain. Cross-reference: see Session Hijacking below for how ticket theft fits alongside TCP-level and web-session hijacking. Rubeus project documentation.

CeWL and Crunch

CeWL purpose: Build a wordlist from a website. Install cewl; use your local HTTP server.

cewl -d 1 -m 4 -w reports/site-words.txt http://127.0.0.1:8000

-d limits crawl depth, -m minimum word length, -w output. Inspect the saved words and compare them with your page. JavaScript-only content may not appear. CeWL options.

Crunch purpose: Generate combinations. Install crunch and use a tiny alphabet to avoid enormous output.

crunch 2 2 ab -o reports/tiny-words.txt

The first two numbers are minimum/maximum length; ab is the character set; -o writes output; -t supplies a pattern on supported versions. Expect aa, ab, ba, bb. The original crunch 6 8 can produce very large output; estimate combinations before trying it. Crunch reference.

7. Malware Threats

Practice with files you created, not live malware. Static tools inspect bytes without intentionally executing the sample; debuggers and sandboxes can execute it. Use a dedicated disposable environment for any course-provided unknown sample.

VirusTotal

Purpose / clue: Multi-engine file/URL/indicator analysis. Use the website to search a SHA-256 hash first. On Kali, compute a hash with sha256sum sample.bin; paste only the hash into search.

Controls: Search by hash, detections, details, behavior, relations, and community context. If no record exists, that is not a clean verdict. For a harmless file you created, an optional upload demonstrates analysis; never upload confidential files or URLs with secrets because submissions may be shared under the service's terms.

Success: Compare detection count with behavior and provenance. A single detection can be a false positive; zero detections cannot establish safety. Save the hash and report timestamp. VirusTotal explanation.

Cuckoo Sandbox

Purpose / clue: Automated behavior analysis inside a controlled guest VM. Cuckoo releases and forks have different installation and submission interfaces; the linked 2.x documentation is legacy. Use an instructor-provided working appliance or the exact documentation for your selected release.

Lab: Snapshot the analysis guest; submit a benign program you compiled; select the guest/machine and a short timeout; inspect process, file, registry, and network observations; restore the snapshot. Keep the guest isolated from production and shared folders.

Controls: Sample submission, guest selection, analysis timeout, network routing, and report export. No behavioral events can indicate a failed guest agent or launch, not a harmless sample. Capture the task status and guest health in your evidence. Cuckoo 2.x manual.

Process Explorer

Purpose / clue: Inspect Windows processes, handles, and DLLs. Download from Microsoft Sysinternals and run in profile D.

Lab: Open Notepad, locate its process, open Properties, and inspect image path, account, parent process, and loaded modules. Toggle the lower pane between DLL and handle views. Search for a handle to a file you opened.

Controls: Process tree, process properties, lower pane, handle/DLL search, and signature verification. Some protected processes reveal less information even with elevation. Do not terminate an unfamiliar system process as a troubleshooting shortcut. Success: Explain the difference between a running process, its executable file, and a loaded DLL. Process Explorer.

Process Monitor

Purpose / clue: Timeline of Windows file, Registry, and process/thread activity.

Lab: Start capture; filter Process Name to notepad.exe; save a text file in Notepad; stop capture. Open one file-write event and examine operation, path, result, and timestamp. Save the native log for later review.

Controls: Include/exclude filters, capture start/stop, event categories, event properties, and backing/log files. Filtering a view is different from eliminating events at capture time. Background processes create noise, so keep the window short. Compare with Process Explorer: current state versus activity history. Process Monitor.

Regshot

Purpose / clue: Compare before/after Registry snapshots. Use the project's Windows release in a disposable VM.

Lab: Take the first shot. In PowerShell, create a harmless per-user value, then take the second shot and Compare. The report should include the added key/value. Remove only that training key afterward.

New-Item -Path HKCU:\Software\CEHLab -Force
New-ItemProperty -Path HKCU:\Software\CEHLab `
  -Name Marker -Value Practice -PropertyType String -Force

Controls: First/second snapshot, optional directory scan, text/HTML report, and output path. Background changes are expected; correlate your exact key path. Cleanup: Remove-Item -LiteralPath HKCU:\Software\CEHLab. Regshot project.

strings

Purpose / clue: Extract readable sequences from binary data. Use GNU strings from binutils on Kali; Windows Sysinternals Strings uses different switches.

printf '\000CEH_LAB_MARKER\000' > sample.bin
strings -a -n 4 -t x sample.bin

Options: -a scans the whole file; -n sets minimum length; -t x prints hexadecimal offsets; -e l searches little-endian 16-bit strings on GNU builds. Expect the marker at offset 1. A string's presence does not establish that code executes it. Packed or encoded strings may not appear. GNU strings.

YARA

Purpose / clue: Rule-based file identification. Install yara. Save this as marker.yar in your lab folder; reuse sample.bin from the previous exercise.

rule CEH_Lab_Marker {
    strings:
        $marker = "CEH_LAB_MARKER"
    condition:
        $marker
}

yara -s marker.yar sample.bin

Options: -s prints matching strings; -r scans directories recursively; -c reports match count; -t TAG selects tagged rules; -C loads compiled rules. This example uses source rules, so no -C.

Expected: Rule name, file name, and marker offset. Change the marker and confirm the match disappears. A match proves the condition was met, not that the file is malicious. YARA CLI.

Ghidra

Purpose / clue: Static disassembly and decompilation. Install from the official project with its required Java version. Build a small benign C program or use one you own.

#include <stdio.h>
int main(void) {
    puts("CEH_LAB_MARKER");
    return 0;
}

Save as hello.c; with a compiler installed, gcc -g -O0 hello.c -o hello builds a Linux sample. Create a non-shared Ghidra project, import hello, accept appropriate analysis, find the marker string, then follow references into the function that uses it.

Controls: Import format/architecture, analysis options, Symbol Tree, Defined Strings, Listing, and Decompiler. Decompiler output is reconstructed pseudocode, not necessarily the original source. Success: Identify the string reference and call to a printing function. Ghidra project.

IDA

Purpose / clue: Disassembly and reverse engineering. Use an official edition supporting your sample's format/architecture.

Lab: Open the same benign executable, allow analysis, view Strings, follow a cross-reference, and compare graph and text views. Rename a local label and add a comment to explain the printing call. Save the analysis database separately from the original binary.

Controls: Loader/processor choice, analysis settings, functions, strings, xrefs, graph view, and comments. Decompiler availability depends on edition and architecture. If output looks nonsensical, verify file format and processor selection. IDA user guide.

x64dbg

Purpose / clue: Dynamic debugging of Windows programs. Compile the harmless sample as a Windows executable or use an instructor's benign sample; a Linux ELF executable will not work.

Lab: Open the executable in x64dbg for 64-bit or x32dbg for 32-bit. Run to an appropriate user-code point, set a breakpoint, then step while observing registers and the stack. Use Run, Pause, Step Into, and Step Over from the Debug menu. Stop the debug session afterward.

Controls: Breakpoints, registers, stack, memory views, and stepping. Step Into follows calls; Step Over runs a call without entering its implementation. A debugger actually executes code. x64dbg manual.

Malware taxonomy (quick reference)

Source: CEH v13 practice exam bank, Module 06/07 references. The tools above (VirusTotal, Cuckoo, Process Explorer/Monitor, Regshot, strings, YARA, Ghidra, IDA, x64dbg) are how you would analyze a sample; the exam separately tests whether you can name the malware category from a behavior description. These are exam-tested definitions, not something this lab guide provides hands-on steps for — practice only with files you created yourself, per the module intro above.

8. Sniffing

Wireshark

Purpose / clue: GUI packet/protocol analysis. Install wireshark; on Windows use the supported capture driver. Capture permissions should be configured for the capture component; avoid running the whole GUI as root.

Lab: Select loopback for profile A, or the isolated adapter for profile B. Start capture, request your HTTP page, stop, then use a display filter. On port 8000, use Decode As HTTP if needed. Inspect Ethernet/IP/TCP fields and use Follow TCP Stream.

Expected: HTTP request/response and the TCP handshake. TLS traffic does not reveal plaintext merely because you captured it. An empty view may be the wrong interface or filter. Saving a display-filtered view does not necessarily remove other packets; choose export options deliberately. Wireshark packet analysis.

tcpdump

Purpose / clue: CLI capture. Use loopback lo for the local server, or replace it with the isolated interface and target IP. Start this capture, then request the HTTP page from another terminal. Stop with Ctrl+C if fewer than 20 packets arrive.

sudo tcpdump -i lo -nn -c 20 -w reports/http.pcap 'tcp port 8000'
tcpdump -nn -r reports/http.pcap

Options: -i interface; -nn numeric addresses/ports; -c packet limit; -w write packets; -r read packets; -s 0 full snapshot length; -A ASCII payload; -X hex/ASCII; -D interfaces. host, port, and, and or are capture-filter expressions, not Wireshark display syntax.

Success: Reopen the capture in Wireshark. If reading fails with permission denied, adjust ownership of that one lab output file. Capture may continue indefinitely without matching packets unless stopped or externally timed. tcpdump reference.

Ettercap

Purpose / clue: Network analysis and MITM testing. Install the supported Kali package. Begin with offline reading of the capture you just made, not interception.

ettercap -T -r reports/http.pcap

Options: -T text interface, -G graphical interface, -i interface, -r input capture, -w capture output. Live MITM settings are a separate operation; do not enable them merely to inspect a file.

Expected: Protocol/session information for supported traffic. Empty application details can reflect encrypted data or an unrecognized port. Compare its view with Wireshark and explain why passive capture does not automatically see all traffic on a switched network. Ettercap reference.

Bettercap

Purpose / clue: Modular network assessment console. Install bettercap and use only the isolated lab adapter.

sudo bettercap -iface eth0

At the prompt run help, help net.recon, net.recon on, net.show, net.recon off, and quit. Generate your own traffic between the two VMs during this short observation.

Options/controls: -iface selects interface; console help MODULE lists module settings; set NAME VALUE configures a setting. -caplet FILE runs a saved command script, so review it before execution. Avoid automatic startup scripts from strangers.

Expected: The local host inventory reflects visible lab activity. This reconnaissance exercise does not require ARP spoofing. An empty inventory can indicate the wrong adapter or no observed traffic. Bettercap project.

arpspoof

Purpose / clue: ARP cache manipulation, often grouped with Ettercap and Bettercap. It ships with dsniff; -i selects interface, -t selects a specific host, and -r affects both directions on supported builds.

Syntax (recognition): arpspoof -i <interface> -t <target-IP> <gateway-IP> sends forged ARP replies to the target claiming the attacker’s MAC is the gateway’s; running the reverse with -t <gateway-IP> <target-IP> (or -r on builds that support it in one invocation) poisons both directions so return traffic is redirected too. IP forwarding (echo 1 > /proc/sys/net/ipv4/ip_forward) must be enabled first or the target loses connectivity instead of being transparently relayed.

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo arpspoof -i eth0 -t "$TARGET" "$GATEWAY"

Intro lab: Read local help/man page, then use a course-provided ARP-poisoning capture in Wireshark. Filter arp; compare claimed IP-to-MAC mappings with the known baseline. On Linux, ip neigh show displays your own neighbor cache. Save the packet numbers demonstrating a changed mapping.

Expected: Explain how false ARP replies can redirect traffic and why encryption still matters. Active interception requires a separate three-node lab and recovery plan; this introductory exercise teaches recognition without changing the starter network's traffic path. dsniff/arpspoof reference.

9. Social Engineering

Social-Engineer Toolkit (SET)

Purpose / clue: Menu-driven social-engineering assessment framework. Install set on Kali if available; launch with sudo setoolkit in the lab.

Lab: Read the startup information and main menus, identify the assessment categories, and exit before launching a delivery action. Design a fictional awareness scenario on paper: audience, permission, harmless message, landing-page explanation, and measurement plan.

Controls: Interactive module choice and module-specific configuration rather than one universal flag list. Menus can change by release. Do not copy an old menu number without reading its label. Success: Explain what SET coordinates and how approvals and scope apply to human subjects. TrustedSec SET.

Gophish

Purpose / clue: Phishing simulation and training platform. Use a private lab instance and a local mail sink or mailbox you control.

Workflow: Configure a sending profile for the lab mail server, create a clearly synthetic email template, create a landing page that says this is a training exercise, add one test recipient, send a test message, then run the one-recipient campaign. Keep password capture disabled.

Settings: Sending profile, template, landing page, recipient group, destination URL, launch time, and campaign status. No SMTP access means no email delivery; a browser preview alone does not test delivery. Open/click tracking is affected by mail security scanners and privacy features.

Success: Verify the intended test mailbox received the message, click it yourself, and correlate the event. Stop the campaign and remove the training recipient afterward. Gophish user guide.

Netcraft / PhishTank (anti-phishing recognition)

Purpose / clue: Source: Document 1 (Module 9, Social Engineering). These are recognition/defense-side tools, not lab commands — browser extensions and web services that report or crowdsource known phishing sites rather than something you install and drive from a CLI in this lab.

Netcraft: browser toolbar/extension backed by a community "neighborhood watch" reporting scheme; it blocks and warns about sites its community has flagged as fraudulent and surfaces background information (hosting, history) about a site you are visiting. (https://www.netcraft.com)

PhishTank: a collaborative clearinghouse of submitted/verified phishing URLs with a free API, used to check whether a given URL is a known phishing site. (https://phishtank.com)

Maltego and theHarvester in this module

Reuse module 2 with synthetic identities or your own domain. Produce a small contact/relationship map and mark which observations are verified. These tools gather context; they are not proof that a contact can be impersonated successfully. Challenge: Identify one piece of information that should not be collected for the approved training objective.

Social engineering technique glossary (quick reference)

Source: CEH v13 practice exam bank, Module 09 references. SET/Gophish above are the tools used to run a simulated campaign; the exam separately and frequently tests whether you can name the technique from a scenario description. Whaling and spear-phishing are covered as phishing-tool entries earlier in this module — the remaining techniques below have no tool of their own and are tested as pure scenario recognition.

10. Denial-of-Service

Concepts: DoS affects availability; DDoS uses distributed sources. Source count is a useful distinction, but modern attacks may involve reflection or amplification. This module focuses on recognizing resource exhaustion and validating monitoring with small, bounded traffic.

LOIC/HOIC variants are legacy and do not have a dependable common CLI. Do not treat arbitrary download mirrors as a prerequisite. Slowloris implementations also differ; a switch from one implementation may have another meaning in another.

Bounded availability exercise

Start the local HTTP server and capture loopback traffic. Send five sequential requests, each with a two-second client timeout, at one-second intervals. This checks observability; it is not intended to exhaust the server.

for n in 1 2 3 4 5; do
  curl --max-time 2 -s -o /dev/null \
    -w '%{http_code} %{time_total}\n' http://127.0.0.1:8000/
  sleep 1
done

Read output: Compare response codes and elapsed times with access logs. In a supplied slow-HTTP capture, look for long-lived incomplete requests rather than only packet volume. Discuss request-header timeouts, connection limits, and upstream protection. A normal result from five requests says nothing about maximum capacity.

Challenge: Explain why limiting requests per second may not alone stop a connection-exhaustion problem. Hping3 reference, Slowloris project.

11. Session Hijacking

Tools recur here: Wireshark observes traffic; Ettercap/Bettercap analyze or alter network paths; Burp Suite and ZAP inspect web requests and sessions. Reuse their options from modules 8 and 14 rather than learning duplicate commands.

Session lab with two browser profiles

Use local DVWA and two separate browser profiles. Log in as your training user in profile A; keep B logged out. In Burp's HTTP history, identify the session cookie and the response that set it. Do not share or paste the cookie into public tools.

Steps: Record cookie attributes; observe whether login changes the session identifier; log out; use Repeater to resend your own earlier request; check whether the server still authorizes it. A 200 status alone is not proof of authorization: inspect the response content and redirects.

Expected: A report describing lifecycle behavior for your own session. The deliberately vulnerable app may behave poorly; document rather than assume the secure outcome. Plain HTTP cannot demonstrate a correctly deployed Secure-cookie flow. For that, use a separate HTTPS training app.

Challenge: Explain the difference between stealing a session, predicting an identifier, and fixing an identifier before login. Burp tools, ZAP guide.

Network-level session hijacking: TCP sequence prediction

Purpose / clue: Source: Document 1 (Module 11, Session Hijacking). Distinct from the web-cookie hijacking exercise above: here the target is the TCP sequence/acknowledgment numbers of an existing connection rather than an HTTP session identifier. An attacker who can predict (or sniff) the next sequence number can inject packets into an established TCP session without completing a new handshake.

Recognize (exam concept): Nmap can be used to gather a target’s TCP initial-sequence-number (ISN) behavior as one input to judging how predictable it is; modern operating systems use randomized ISNs specifically to defeat this, so a working demonstration needs an old or deliberately weakened training stack rather than a current Linux/Windows target. Treat this as recognition for the exam rather than a reproducible lab step on the starter profiles.

Kerberos ticket hijacking cross-reference: session hijacking also covers reusing a stolen Kerberos ticket to impersonate a user without their password (pass-the-ticket). See the Rubeus entry in System Hacking above for the tool and commands; conceptually it is the AD equivalent of the cookie-replay idea demonstrated with Burp Repeater above, but operating on a Kerberos ticket instead of an HTTP cookie.

Important notes: Do not attempt TCP sequence prediction or injection outside a dedicated, disposable lab; on the shared starter network it can disrupt the DVWA/profile-B exercises used by other modules. Session hijacking (network-layer) reference.

12. Evading IDS, Firewalls & Honeypots

Snort

Purpose / clue: Network IDS/IPS. Examples target Snort 3; Snort 2 configuration files and commands differ.

Rule syntax: a Snort rule has a rule header (action, protocol, source IP/port, direction, destination IP/port) followed by options in parentheses (match conditions and metadata).

alert tcp any any -> $HOME_NET 80 (msg:"Possible web probe"; content:"/admin"; sid:1000001; rev:1;)

Explanation: alert is the rule action (log an alert without blocking; other actions include log, pass, drop, and reject in inline/IPS mode). tcp is the protocol. any any is the source IP and port — unrestricted. -> shows one-way traffic direction (<> matches either direction). $HOME_NET 80 is the destination network variable and port. Inside the parentheses, msg: sets the alert text, content: matches a byte pattern in the payload, sid: is the required unique rule ID (values below 1,000,000 are reserved for the official rule set), and rev: is the rule revision number.

snort -V
snort -r reports/http.pcap

Options: -r reads a capture, -i reads an interface, -c specifies configuration, -R supplies rules in Snort 3, -T validates configuration, and -A selects alert mode. A packet summary without loaded detection rules is not a vulnerability scan.

Lab: Start with the saved HTTP capture. For rule practice, load an instructor-provided Snort 3 configuration and a simple lab rule, validate it, then replay the same capture offline. Record rule SID, packet timestamp, and matching evidence. No alerts can mean absent rules or missing traffic. Snort traffic input.

Suricata

Purpose / clue: IDS/IPS and network security monitoring. Install a supported package and its configuration/rules. Use a new output folder for each run.

mkdir -p reports/suricata
suricata -T -c /etc/suricata/suricata.yaml
suricata -r reports/http.pcap \
  -c /etc/suricata/suricata.yaml -l reports/suricata

Options: -T tests configuration, -c selects it, -r reads capture, -i live interface, -l output directory, -S an exclusive rule file, -V version. Check the installed release before using custom rule syntax.

Expected: Config validation succeeds; enabled outputs may include EVE JSON with flow/HTTP events. Not every benign request should trigger an alert. Permission errors may concern rule/config access or output ownership. Suricata CLI.

Cryptcat (encrypted Netcat variant)

Purpose / clue: Source: CEH v13 practice exam bank, Module 12 references. A Netcat variant (compare the Netcat entry in Scanning Networks above) that encrypts the connection with Twofish, an algorithm rated on par with AES. Because the payload is encrypted, a signature-based IDS inspecting content cannot recognize the traffic as malicious even when it crosses an ordinary HTTP port such as 80 or 443 — presented here as an IDS-evasion concept, consistent with the exam’s framing of Cryptcat specifically as an evasion technique rather than a discovery tool.

# listener
cryptcat -l -p 4444
# connect (same key on both ends)
cryptcat TARGET_IP 4444

-l listens; -p sets the port; -k sets a shared key on builds that support it (otherwise Cryptcat uses a built-in default key, which is a known weakness — do not rely on the default key for real confidentiality). Important notes: like plain Netcat, an open Cryptcat listener is a generic relay; only use it against your own disposable lab endpoints, and remove the listener afterward.

Nmap as a detection exercise

On the isolated target, enable logging or capture traffic. Repeat a small Nmap port selection with -T2, then -T3; compare timing and captured packets. Keep the same target and ports. Recognize -f fragmentation and --source-port as packet-shaping options, but do not assume they bypass a modern firewall or make a scan invisible.

Success: Explain observed visibility rather than claiming evasion from a scan result. A stateful firewall, host firewall, IDS sensor position, and application log each see different evidence. Nmap options.

Honeyd

Purpose / clue: Emulates virtual network hosts/services. It is legacy software and may need a supplied compatible training image.

Workflow: Inspect the course configuration defining a virtual host, personality, and services; bind only an unused isolated-lab address; start the supplied instance; scan that address with a small Nmap port list; compare emulated responses with a real VM.

Controls: Host templates, network personality, service definitions, address binding, and logging. Routing and ARP must direct traffic to the emulator. Do not reuse an occupied IP or import a config that binds your whole network. Honeyd project.

Cowrie

Purpose / clue: SSH/Telnet honeypot. Use its current installation guide and a disposable VM/container. Keep its management interface separate and use an unprivileged lab listening port such as 2222.

Lab: With the instance configured and listening, connect from Kali using ssh -p 2222 labuser@192.168.56.20. Use a synthetic credential accepted by the configured training setup; type pwd and ls, then exit. Inspect the recorded session and JSON event log.

Controls: SSH/Telnet enablement, listen endpoints, emulated filesystem, allowed credentials, and output plugins. The apparent shell is an emulation and not necessarily the real host filesystem. A connection to port 22 may hit the VM's real SSH service instead. Cowrie documentation.

13. Hacking Web Servers

Nikto

Purpose / clue: Web-server misconfiguration and known-file checks. Install nikto; use the local HTTP server or DVWA.

nikto -h http://127.0.0.1:8000 -maxtime 30s \
  -output reports/nikto.txt -Format txt

Options: -h host/URL, -p port, -ssl TLS, -maxtime overall host-test limit, -timeout request timeout, -output report, -Format report format. Confirm capitalization with nikto -Help for your build.

Expected: Server/header observations and possibly missing-header findings. These are leads to review, not proof of exploitable compromise. A 30-second limit may leave tests incomplete; state that in your report. A simple static server cannot demonstrate every check. Nikto reference.

WhatWeb

Purpose / clue: Web technology fingerprinting. Install whatweb.

whatweb -a 1 -v http://127.0.0.1:8000

Options: -a aggression level; use level 1 initially; -v verbose; --log-json=FILE structured report; --list-plugins lists recognizers. Compare results with the server you actually started. Headers can be modified or misleading, and a plugin match is a fingerprint rather than a vulnerability verdict. WhatWeb reference.

Gobuster

Purpose / clue: Content discovery using candidate paths. Install gobuster; use paths.txt and the profile A HTTP server.

gobuster dir -u http://127.0.0.1:8000 -w paths.txt \
  -t 1 --delay 200ms -o reports/gobuster.txt

Options: dir is the subcommand; -u URL, -w wordlist, -t worker count, --delay delay per worker, -x extensions, -o output. Use gobuster dir --help for mode-specific switches.

Expected: admin and docs appear, possibly with redirects to trailing slashes; missing is absent/404. Check one nonexistent URL manually first. Servers returning identical successful pages for all paths produce false positives; filtering by response length may help, but verify what it hides. Gobuster reference.

Nmap, Netcat, and Metasploit here

Reuse Nmap's -sV, Netcat connectivity checks, and Metasploit's auxiliary-module workflow. Identify the service before selecting application tests. Challenge: Explain why an open port, a server banner, and a vulnerability are three different findings. Keep all evidence tied to the same target and timestamp.

14. Hacking Web Applications

Burp Suite

Purpose / clue: Intercept and test HTTP traffic. Install an official Community or Professional edition. Use profile C; automatic Scanner availability depends on edition.

Guided lab: Start a temporary project, open Burp's browser, browse the local DVWA URL, and turn interception off while loading the page. Add only that local URL to scope. In HTTP history choose a harmless request, send it to Repeater, change a non-sensitive parameter or header, Send, and compare the response. Turn Intercept on for one request to observe the pause, then Forward it.

Expected / troubleshoot: The request and response appear in Repeater. A browser that hangs may be waiting on Intercept. Burp's browser avoids much external-browser proxy setup. If using another browser for HTTPS, install the Burp CA only in a dedicated lab profile. Export only sanitized evidence. Burp desktop guide, tool reference.

OWASP ZAP

Purpose / clue: Open-source web proxy and security testing. Install the official desktop build.

Workflow: Select Manual Explore for the local DVWA URL and launch its configured browser. Browse your own pages, then inspect History and passive alerts. Create a context containing only the local app. Use Protected mode and verify the context before an active scan. Begin with a small unauthenticated area; authentication configuration is a separate exercise.

Controls: Mode, context/scope, included/excluded URLs, passive scanner, spider, active scan policy, authentication, and report generation. Passive scanning analyzes observed traffic; active scanning sends additional test requests that can change state.

Success: Explain one alert with its request, response, confidence, and proposed validation. Missing authenticated pages can mean the scanner is being redirected to login. ZAP getting started.

Wfuzz

Purpose / clue: Place candidate values into a chosen request location. Install wfuzz; reuse the tiny path list.

wfuzz -c -t 1 -z file,paths.txt --hc 404 \
  http://127.0.0.1:8000/FUZZ

Options: FUZZ is the replacement marker; -z file,FILE supplies candidates; -t concurrency; --hc hides status codes; --hh hides character counts; --hw hides word counts; -c colors output. Compare status and length with a baseline nonexistent path before hiding anything.

Expected: The two known directories are distinguishable from the missing path. A filter can hide real results as well as noise. Gobuster specializes in discovery workflows; Wfuzz exposes flexible request substitution. Wfuzz reference.

Acunetix WVS

Purpose / clue: Web vulnerability scanner. Requires a supported licensed/trial instance; WVS is a product name used in the original study material.

Lab: Add the local training URL as a target reachable from the scanner; restrict scope; select a suitable crawl/audit profile and low request rate; scan a small area; open a finding and inspect its evidence. Configure a recorded login only when testing authenticated pages.

Controls: Target URL, scope exclusions, scan profile, login sequence, request rate, and report output. An external cloud scanner cannot reach Kali's localhost. Run the scanner where the target is reachable without publishing the vulnerable app to the Internet. Success: Compare one finding with your manual Burp observation. Acunetix documentation.

15. SQL Injection

SQLmap

Purpose / clue: Automated SQL-injection testing. Install sqlmap. Use DVWA's SQL Injection exercise at Low security, not the static HTTP server.

Prepare: In Burp, submit a normal ID query in DVWA; save that exact request as request.txt in your lab directory. It contains a lab cookie: keep it private. Confirm the request host/port is the local DVWA instance and that Repeater still receives the authenticated page.

sqlmap -r request.txt -p id --level=1 --risk=1 \
  --threads=1 --delay=0.5

Options: -r reads a captured HTTP request; -u supplies a URL directly; -p selects the parameter; --data supplies a POST body; --cookie supplies a session cookie; --level expands checks; --risk enables more intrusive categories; --threads concurrency; --delay spaces requests; --output-dir chooses output. Higher values do not mean better beginner settings.

Expected: On the deliberately vulnerable exercise, SQLmap may identify an injection technique and DBMS. Read interactive prompts and retain single-parameter scope. Do not add database dumping or operating-system access to this detection exercise. If redirected to login, refresh the captured request; cached results can also explain unexpectedly quick runs.

Challenge: Set DVWA to its stronger security level and compare behavior using a fresh capture and output directory. Failure to detect is not proof of absence. SQLmap usage, Kali options.

SQLmap: documented feature set (recognition)

Source: Document 1 (Module 15, SQL Injection). Beyond the single-parameter detection exercise above, sqlmap’s own documentation describes a much broader feature set. This is presented as recognition of what the tool supports, not as a new lab exercise — exact enumeration command lines from the source were too OCR-corrupted to reproduce reliably and are intentionally omitted rather than guessed.

The --dbs, -D <db> --tables, -T <table> --columns, and -T <table> -C <cols> --dump switches referenced in sqlmap’s own documentation correspond to this enumeration/dump workflow; verify exact syntax against your installed sqlmap --help before running it, since flag behavior has changed across releases.

Mole (SQL injection exploitation tool)

Purpose / clue: Source: Document 1 (Module 15, SQL Injection). https://sourceforge.net — an automatic SQL injection exploitation tool distinct from sqlmap. Given a vulnerable URL and a valid string on the site, it can detect and exploit the injection using the UNION technique or a Boolean-query-based technique, through a command-based interface with autocompletion for commands and arguments.

SQLi concepts to recognize

Timing is noisy: compare repeated baseline requests and account for network/server delays. Parameterized queries are a primary defense; input filtering alone is not equivalent.

IBM Security AppScan / HCL AppScan

Purpose / clue: Application security testing; the original list uses the historical IBM branding. Current product naming, interfaces, and licensing should be checked with HCL's documentation.

Lab: In the available AppScan edition, create a scan for the local training application; configure scope, login, exploration, and a limited test policy; run; inspect a SQLi finding's request/response and remediation. Use Burp to reproduce only the benign evidence permitted by the exercise.

Controls: Start URL, excluded paths, authentication/session handling, test policy, scan limits, and report format. False positives and expired sessions require manual review. Burp, ZAP, and Acunetix can also support SQLi assessment; SQLmap is the specialized automation association. HCL AppScan documentation.

16. Wireless Networks

Profile E requires an adapter and driver supporting monitor mode; many VM network adapters do not expose Wi-Fi radio frames. A compatible USB adapter passed through to Kali is commonly needed. Use a spare AP you own, a test client, and a known test passphrase. Nearby networks are not part of the lab.

Aircrack-ng suite: component map

airmon-ng and airodump-ng

Install aircrack-ng. List interfaces, check conflicting processes, and start monitor mode. Use the actual radio name; the resulting monitor interface may not be wlan0mon.

sudo airmon-ng
sudo airmon-ng check
sudo airmon-ng start wlan0
sudo airodump-ng --channel 6 --bssid AA:BB:CC:DD:EE:FF \
  --write reports/own-ap wlan0mon

Replace the channel and BSSID with your AP's values. Capture briefly while you manually reconnect your own client through its normal Wi-Fi controls, then stop with Ctrl+C. Restore managed mode with sudo airmon-ng stop wlan0mon. Restart the normal network manager if you stopped it manually.

Expected: AP/channel, station activity, and capture files. A handshake is not guaranteed; verify capture quality. check kill stops interfering processes and can disconnect you, so do not use it blindly. airmon-ng, suite reference.

aireplay-ng

Purpose: Test whether the adapter can inject frames. After verifying the isolated AP and monitor interface, a basic injection test is:

sudo aireplay-ng --test -a AA:BB:CC:DD:EE:FF wlan0mon

--test selects test mode; -a identifies your AP; interface is the final argument. The test may transmit probe frames and is not purely passive. Do it only in a radio environment where that activity is authorized. No successful response can reflect driver, range, channel, or AP behavior; do not infer the network is secure. This exercise does not use deauthentication. Aircrack-ng suite.

aircrack-ng

Purpose: Offline auditing of supported WEP/WPA/WPA2-PSK captures; do not generalize this workflow to WPA3-SAE. Create a tiny list containing your own test AP's passphrase and one wrong value.

aircrack-ng -a 2 -b AA:BB:CC:DD:EE:FF \
  -w wifi-words.txt reports/own-ap-01.cap

-a 2 selects WPA/WPA2-PSK mode; -b selects BSSID; -w supplies candidate passphrases. Use the actual capture filename. Expect recovery only if the capture contains usable authentication material and the correct candidate is present. A capture without a valid handshake cannot be fixed by a larger wordlist. aircrack-ng documentation.

Kismet

Purpose / clue: Passive wireless discovery and monitoring. Install a supported build, select your wireless data source, then open its local web interface as documented for that release.

Lab: Observe your AP's SSID/BSSID, channel, and encryption advertisement. Generate traffic with your own client and compare timestamps. Stop capture and save the session log.

Controls: Capture source, channel selection/hopping, device filters, logging, and alerts. A displayed nearby device is not an authorized test target. Empty results usually indicate the wrong capture source, permissions, or unsupported hardware. Kismet introduction.

Reaver

Purpose / clue: WPS PIN security auditing. It does not test every kind of Wi-Fi password. Install reaver only for your test AP; inspect help first.

reaver -h
wash -h

Options to recognize: -i monitor interface, -b AP BSSID, -c channel, -v verbosity. Start with the bundled Wash discovery utility on the isolated radio lab to check whether the AP advertises WPS, using its local help for the installed build. Then disable WPS in your own AP's settings and compare advertisements.

Expected: Explain the difference between WPS status and WPA security mode. A disabled or locked WPS service is not a failure of the exercise. Reaver/Wash reference.

Wifite and Wireshark

Wifite purpose: Orchestrates wireless tools. Run wifite --help; identify -i interface and any ESSID/BSSID selectors present in your version. Study its selected workflow and prerequisites before allowing automation; some modes actively disrupt connections. First reproduce the manual capture workflow above, then compare its result with a course-provided Wifite transcript. Wifite reference.

Wireshark exercise: Open your own capture. Filter eapol to inspect authentication exchange packets; inspect beacon security information separately. Monitor-mode radiotap/802.11 capture differs from ordinary Ethernet capture. Memory sequence: airmon manages mode; airodump captures; aireplay injects; aircrack audits keys.

17. Mobile Platforms

Use an Android emulator and an APK you built or are permitted to inspect. Build a small debug app from Android Studio's starter template; keep its package ID and APK path. The tools do not provide an Android lab merely by being installed.

ADB

Purpose / clue: Android Debug Bridge. Install official SDK Platform Tools; enable debugging on the emulator or authorize your computer on your own device.

adb devices -l
adb shell getprop ro.product.model
adb install -r app-debug.apk
adb logcat -d > reports/android-log.txt

Options/commands: -s SERIAL selects a device; devices -l lists details; shell runs device commands; install -r replaces an app while keeping its data where supported; push/pull transfer accessible files; logcat reads logs; -d on logcat dumps and exits.

Expected: A device appears as authorized and the test app installs. unauthorized requires accepting the on-device trust prompt; multiple devices require -s. Non-rooted devices restrict access. Remove only your test app afterward with adb uninstall YOUR_PACKAGE_ID. ADB documentation.

MobSF

Purpose / clue: Static/dynamic mobile application analysis. Use the project's supported local deployment; dynamic analysis requires a compatible configured emulator and additional setup.

Lab: Upload your own debug APK to the local interface, run static analysis, inspect manifest permissions, exported components, signing information, and a code finding. Export the report and compare each finding with your source.

Controls: File submission, static report sections, analysis settings, dynamic device configuration, and report export. Static analysis findings can be contextual or false positives. A successful static report does not establish that dynamic analysis is configured. MobSF project.

JADX

Purpose / clue: DEX/APK decompilation into Java-like source. Install jadx or use its official distribution.

jadx -d reports/jadx app-debug.apk
jadx-gui app-debug.apk

Options: -d output directory; -j worker count; --no-res skips resources; --no-src skips source. Search for a string from your app and follow its references. Decompiled source may be incomplete or misleading after optimization/obfuscation. Compare it with the original you own. JADX project/options.

APKTool

Purpose / clue: Decode APK resources/manifest and disassemble bytecode to smali; it is not the same as JADX's Java-like decompilation.

apktool d app-debug.apk -o reports/apk-decoded
apktool b reports/apk-decoded -o reports/rebuilt.apk

Options: d decode, b build, -o output; decode -f overwrites an existing destination; -s avoids source decoding; -r avoids resource decoding. Use fresh output folders rather than overwriting work unintentionally.

Expected: Inspect AndroidManifest.xml and smali directories. A rebuilt APK requires appropriate signing before installation; rebuilding alone does not make it installable. Resource/framework mismatches can prevent rebuild. APKTool CLI.

Frida

Purpose / clue: Dynamic instrumentation. Install matching Frida client/server versions in a compatible emulator, or integrate Frida Gadget into your own debug app. Ordinary unrooted devices may not permit a server-based attach.

frida-ps -Uai

This lists applications from a USB-connected/recognized test device. In a compatible lab, frida -U -n PROCESS_NAME attaches to your own running app; replace the process name and use console help to inspect the session.

Options: -U device, -n process name, -p PID, -f spawn an application, -l load a JavaScript instrumentation file. Do not load a script you have not inspected. Success: List or attach to your own app and detach without changing behavior. Version mismatch and permission errors are common prerequisites issues. Frida quickstart.

Drozer

Purpose / clue: Android application security assessment. Use matching console/agent versions and a compatible test emulator. Enable the agent's server only in the lab.

adb forward tcp:31415 tcp:31415
drozer console connect

Inside the console use help, list, and run app.package.list if that module is present. Inspect module help before supplying its arguments.

Controls: Console connection, module selection, module arguments, and package scope. Expected: Locate your test app among packages; visibility can be limited by Android version and agent privileges. Disable the agent server and remove the forwarding rule afterward with adb forward --remove tcp:31415. Drozer project.

Additional mobile platform tools (recognition)

Source: Document 1 (Module 17, Hacking Mobile Platforms). These appear in the courseware alongside ADB/MobSF/JADX/APKTool/Frida/Drozer above but without lab-runnable command syntax in the source — listed for recognition rather than as new hands-on steps.

18. IoT & OT

Use offline firmware files and protocol captures or a simulator. An OT process can be affected by ordinary scans; the starter lab does not authorize tests on building or industrial controllers.

Shodan, Nmap, and Wireshark

Reuse Shodan for your own public asset inventory, Nmap for the isolated simulator's small service list, and Wireshark for supplied captures. Describe each observation separately: public banner, active response, and protocol content. Challenge: Explain why a device identified as a controller is not safe to scan just because it is online.

Binwalk

Purpose / clue: Firmware signatures and embedded content. Use the current supported release; Binwalk v3 differs from older Python-based versions.

binwalk --help
binwalk firmware.bin

Choose a firmware image you are permitted to analyze or create a harmless practice archive with tar -czf firmware.bin www. The latter demonstrates a compressed-file signature, not a realistic device image.

Options: -e requests extraction on supported builds; -M recursive extraction exists in some versions; consult installed help before using either. First inspect signatures, then extract only in a disposable folder/container with resource limits. External extractors may be required.

Expected: Offset, signature, and description; not every signature is correct. A compressed/encrypted image may not reveal a filesystem. Do not run extracted executables. Binwalk project.

Firmwalker

Purpose / clue: Search an already extracted firmware filesystem for configuration and sensitive-data indicators. Obtain the project from its official repository; inspect the script before running.

./firmwalker.sh /path/to/extracted-firmware

Replace the path with your disposable extracted tree. Keep the script and its output outside the tree being searched. The directory argument is the primary input; this is not a firmware extractor. Lab: Place a harmless synthetic configuration file in a practice tree, run the analysis, and inspect the report. Check output location in the installed script.

Expected: Candidate files/strings requiring manual review. A matching word such as password does not prove an exposed secret. Store reports privately and never reuse synthetic credentials. Firmwalker repository.

Protocol recognition exercise

These are protocols, not single tools. Start with Wireshark's protocol filters where supported, such as mqtt, coap, modbus, and bacnet. Port numbers and dissector names can vary; confirm the actual packet decode. Avoid sending write/control requests to real equipment.

19. Cloud Computing

Cloud CLIs administer accounts; they are not automatically vulnerability scanners. Use a separate sandbox, least-privilege identities, and a budget alert. The commands below emphasize identity and inventory; an account is not created by installing its CLI. Never put access keys into a PDF, source repository, or screenshot.

AWS CLI

Setup: Install the official CLI and configure a lab SSO/profile through your sandbox's approved sign-in process.

aws --version
aws sts get-caller-identity --profile lab --output json

Options: --profile selects stored configuration; --region selects region; --output chooses format; --query filters output; --no-cli-pager disables paging; help documents a command. Verify Account and Arn before any inventory operation. Credentials may expire, and the default profile may point elsewhere. Challenge: Explain why identity verification should precede a scan. AWS CLI parameters.

Azure CLI

Setup: Install the official CLI, sign in with az login, and select the intended test subscription by its actual ID.

az --version
az account show --output table

Options: --subscription scopes supported commands; --resource-group is used by many resource operations; --output selects formatting; --query filters results; --help shows command help. Confirm tenant/subscription before proceeding. Signing in does not imply that every subscription is authorized for this exercise. Azure CLI reference.

Google Cloud CLI

Setup: Install the official CLI and initialize a dedicated test configuration.

gcloud --version
gcloud auth list
gcloud config list

Options: --project chooses the project; --configuration selects a named configuration; --account selects identity; --format controls output; --filter narrows supported list results. Confirm active account and project. An empty resource list can reflect the wrong project or insufficient permissions. gcloud reference.

Docker

Purpose: Container lifecycle and inspection. Install the supported engine; reuse the DVWA lab if already configured.

docker ps
docker ps -a
docker images

Options/commands: ps -a includes stopped containers; logs NAME shows output; inspect NAME shows metadata; run --name names a new container; -p HOST_IP:HOST_PORT:CONTAINER_PORT publishes a port; --rm removes a container when it exits.

Lab: Inspect only the training container's port mappings and verify they bind to localhost. Do not print environment variables if they contain secrets. Docker access is powerful; use the dedicated VM. Docker CLI.

kubectl

Purpose: Kubernetes administration. Requires a functioning local test cluster and kubeconfig; Docker alone does not provide one.

kubectl config current-context
kubectl get namespaces
kubectl get pods -n default -o wide

Options: --context selects cluster context; -n selects namespace; -A lists across namespaces for supported resources; -o yaml|json|wide selects output; -l KEY=VALUE filters labels. describe explains an object; logs reads a pod's logs.

Expected: The context is your lab cluster. No pods in default can be normal. An API connection error may mean the cluster is stopped or kubeconfig points elsewhere. Challenge: Distinguish context, namespace, pod, and container. kubectl quick reference.

ScoutSuite

Purpose / clue: Multi-cloud configuration assessment. Install in the supported isolated Python environment and grant only documented read permissions in the sandbox.

scout --help
scout aws --help

Workflow: Verify identity with the cloud CLI; choose provider/authentication options shown by that release; limit scope where supported; run and inspect the local report. For releases supporting it, scout aws --profile lab selects the AWS profile.

Controls: Provider, authentication/profile, services, regions, output, and rate limits. Missing permissions create coverage gaps; they are not passing checks. Reports contain infrastructure details. ScoutSuite project.

Prowler

Purpose / clue: Cloud security checks and reporting, historically strongly associated with AWS. Install its current CLI in a supported environment.

prowler --help
prowler aws --help

Workflow: Select your provider and sandbox identity, list supported checks with that version's help, choose one small service/check scope, run, and inspect pass/fail/manual results. Common AWS options include --profile, --region, and check/service selectors; verify their exact spellings locally before the first run.

Success: Explain one failed check, the evidence collected, and the documented remediation. Coverage depends on permissions and supported services. Do not grant admin simply to remove access-denied messages. Prowler documentation.

Pacu

Purpose / clue: AWS assessment framework. Install the official project; start an empty lab session.

pacu

Lab: Use help and list; inspect a module with help MODULE_NAME or the documented module-information command for your release. Read its required permissions and side effects before execution. Begin with an inventory-only module in a dedicated sandbox, after verifying the imported profile/session identity.

Controls: Session, credential/profile selection, module selection, module arguments, and regions. Modules may perform very different actions; run is not a harmless universal discovery operation. Success: Document a module's purpose and required permission without running a state-changing module. Pacu project.

Trivy

Purpose / clue: Vulnerability and configuration assessment for images/filesystems and more. Install its official supported package. Scan an existing lab image by the exact name/tag shown by docker images.

trivy image --scanners vuln --severity HIGH,CRITICAL \
  --format json --output reports/trivy.json IMAGE:TAG

Replace IMAGE:TAG. image selects image scanning; fs PATH scans a filesystem; --scanners selects scanner types; --severity filters output; --format and --output control reporting. Initial database download needs connectivity; record database freshness.

Expected: Findings include package, installed/fixed version where known, and vulnerability ID. Zero HIGH/CRITICAL results says nothing about severities you excluded. Rebuild/update an image and compare results if a fix exists. Trivy guide.

kube-bench

Purpose / clue: Compare Kubernetes configuration with CIS Benchmark checks. It needs appropriate access to node configuration, not merely remote kubectl access.

kube-bench --help

Lab: Use the project's documented node installation or job manifest for your disposable cluster and its Kubernetes version. Run a supported benchmark; read PASS, FAIL, WARN, and manual-check output. Common controls include --benchmark, --version, and --json; use the exact supported combination for your release.

Expected: Explain one result and its node evidence. Managed services may hide control-plane files, making some checks unavailable rather than passing. A benchmark score is not a complete cluster security assessment. kube-bench project.

20. Cryptography

OpenSSL

Purpose / clue: Hashing, certificates, and TLS/cryptographic operations. Install openssl. First compare file hashes, then create a disposable self-signed certificate.

printf 'CEH lab\n' > file.txt
openssl dgst -sha256 file.txt
openssl req -x509 -newkey rsa:2048 -noenc \
  -keyout lab-key.pem -out lab-cert.pem -days 1 \
  -subj '/CN=lab.test'
openssl x509 -in lab-cert.pem -text -noout

Options: dgst -sha256 hashes; req -x509 creates a self-signed certificate; -newkey chooses key algorithm/size; -keyout and -out name files; -days validity; -subj subject; x509 -in loads a certificate; -text decodes fields; -noout omits encoded output. -noenc is for current OpenSSL; older versions use -nodes. The generated private key is intentionally unencrypted and belongs only in the disposable lab.

Expected: Inspect issuer, subject, dates, public key, and signature algorithm. A self-signed certificate is not automatically trusted or hostname-valid for a browser; modern hostname validation normally uses SAN. Change the text file and compare its hash. Digest command, certificate request command.

GPG / GnuPG

Purpose / clue: File/email encryption and signatures. Begin with symmetric encryption so no key infrastructure is required. Enter a disposable passphrase at the prompt.

gpg --symmetric --cipher-algo AES256 --output file.txt.gpg file.txt
gpg --output recovered.txt --decrypt file.txt.gpg
cmp file.txt recovered.txt

Options: --symmetric uses a passphrase; --encrypt uses recipient public keys; --recipient selects a recipient; --decrypt decrypts; --output chooses output; --detach-sign creates a separate signature; --verify checks one; --list-keys lists public keys.

Expected: cmp prints nothing and returns success for identical files. For public-key practice, generate a disposable key with gpg --full-generate-key, identify its fingerprint, then select that fingerprint with --recipient. The original bare gpg --encrypt file.txt needs a recipient selection. Encryption does not itself establish the sender's identity. GnuPG commands.

VeraCrypt

Purpose / clue: Encrypted volumes/containers. Use the official desktop installer in your practice VM.

Lab: Create Volume -> encrypted file container -> standard volume. Choose a new file in your lab folder, a small size such as 50 MB, a supported filesystem, and a disposable password. Mount the container, copy a harmless file, dismount, and remount to verify access.

Controls: Volume type, container path, encryption/hash choices, size, filesystem, password, mount point/drive, and dismount. Choose a file container rather than a physical disk or system-encryption workflow. Never overwrite an existing file as the container path. An open mounted volume exposes plaintext to authorized local access. VeraCrypt beginner tutorial.

CyberChef

Purpose / clue: Browser-based data transformations: encodings, hashes, and more. Use an official local/offline copy for sensitive data.

Lab: Enter a synthetic string, add To Base64, then From Base64, and verify the round trip. Separately calculate SHA-256 and compare it with OpenSSL for exactly the same input bytes. Save the recipe so you can repeat it.

Controls: Input, recipe order, operation settings, output, and save/load recipe. Encoding is reversible representation, not encryption. Hash differences often come from a trailing newline, character encoding, or hashing decoded bytes instead of literal text. Success: Explain why Base64 cannot protect a password and why SHA-256 is not a decryptable cipher. CyberChef.

Additional tools from the earlier list

These compact cards extend coverage beyond the immediately preceding cheat sheet. Use the main module exercises as prerequisites. Legacy products may need course-provided images rather than a current general-purpose installation.

Reconnaissance and scanning extras

Google search operators: site:YOUR_DOMAIN filetype:pdf narrows indexed pages to a domain and file type; quotation marks request an exact phrase. Try a document you published yourself. No result can mean the page is not indexed. Search operators are search syntax, not operating-system switches.

traceroute / tracert: Trace responding network hops. Linux traceroute -n -m 5 192.168.56.20 avoids DNS and limits hops; Windows tracert -d -h 5 192.168.56.20 is analogous. A directly connected lab target may show only one hop. Stars can reflect unanswered probes, not a broken route; Linux/Windows probe methods differ.

HTTrack: Mirror your own small HTTP site using httrack http://127.0.0.1:8000/ -O reports/mirror. -O chooses output; depth and URL include/exclude rules constrain scope. Inspect the generated local pages. Dynamic/authenticated content may not mirror faithfully. HTTrack reference.

Zenmap: Nmap's GUI. Set the single lab target, enter the small Nmap command from module 3, inspect the generated command, run, then save results. Controls include target, profile, command, ports/hosts views, and scan comparison. A profile may contain more aggressive options than you intend. Zenmap manual.

Angry IP Scanner: GUI host/port discovery. Select only the two lab IPs, configure a small port list, run, and export. Controls include address feeder, fetchers, ports, timeouts, and result filters. Compare an open SSH port with Nmap's result. An ICMP-unresponsive host can still have open services. Documentation.

Masscan: Fast asynchronous port scanning. For a tiny bounded example use sudo masscan 192.168.56.20 -p22,8000 --rate 10. -p selects ports, --rate packets per second, and -oL FILE saves list output. Verify positives with Nmap. Raw-network/interface requirements make localhost an unsuitable substitute. Masscan reference.

arp-scan: Local Ethernet discovery. sudo arp-scan --interface=eth0 192.168.56.20 probes the one lab target. --interface chooses the link; --localnet covers the whole directly attached network and should be used only when that entire segment is in scope. Expect an IP/MAC mapping; routed hosts cannot be discovered this way. arp-scan reference.

Enumeration and credential extras

rpcclient: Windows/Samba RPC queries. rpcclient -U labuser 192.168.56.20 prompts for the lab password; at the prompt try srvinfo, help, then quit. -U selects user, -c executes a command string, -N suppresses the password prompt. RPC permissions may differ from share access. Samba rpcclient.

showmount: NFS export discovery. On a separately configured training NFS server, showmount -e SERVER asks for its export list. -e is exports; it does not mount a filesystem or prove you can read it. Pure NFSv4 setups may not provide the older mount service used by this utility. The starter target does not enable NFS.

Medusa: Online authentication assessment, similar in purpose to Hydra. For the same two-entry lab list: medusa -h 192.168.56.20 -u labuser -P passwords.txt -M ssh -t 1 -f. -h is host, -u user, -P password file, -M module, -t concurrency, -f stop after success for the host. Note that -h is not a help flag here. Medusa reference.

PowerSploit: Archived PowerShell assessment framework. Use the archived source for recognition or an instructor-supplied compatible image. Read a module's source and comment-based help; identify its parameters and side effects without importing unfamiliar scripts. PowerView/PowerUp names refer to different purposes. There is no single universal switch list. Archived project.

pwdump: A family of Windows hash-extraction utilities, not a single standardized binary. Recognize the Windows password-hash association. In a course, inspect a synthetic exported record and identify username, RID, and hash fields; use only that build's manual for options. Extraction is not needed for the synthetic John/Hashcat lab.

Ophcrack: Rainbow-table-based password recovery. Load a course-supplied synthetic hash file, select compatible tables, run, and compare recovered/unrecovered entries. Controls are Load, Tables, and Crack. Hash type/table coverage matters; it is not a universal modern password recovery method. Ophcrack project.

Analysis, web, and cryptography extras

PEStudio: Static Windows PE inspection. Open your own hello.exe, inspect imports, sections, strings, and indicators, and compare with Ghidra. GUI views control inspection; suspicious imports alone do not establish malware. Avoid uploading the file through an external integration unless intended. Winitor.

TShark: Wireshark's CLI. tshark -r reports/http.pcap -Y http displays matching packets. -r input capture; -Y display filter; -f live capture filter; -i live interface; -T fields -e FIELD extracts selected fields. Compare the count and decode with Wireshark. TShark manual.

macof: CAM-table stress tool in dsniff. Recognize randomized Ethernet source traffic and switch-table exhaustion. Read its installed help to identify interface (-i) and count (-n) controls; analyze an instructor-supplied capture rather than stressing a shared switch. A virtual switch may not reproduce a physical switch's behavior. dsniff reference.

Dirb: Dictionary-based web content discovery. dirb http://127.0.0.1:8000/ paths.txt -r uses your tiny list; -r disables recursion and -o FILE saves output. Compare known directories with Gobuster. Response codes can be misleading on custom error pages. Dirb reference.

DirBuster: GUI directory/file discovery. Set the local URL, one worker, your small list, and nonrecursive mode; run and export. Compare request count with the server log. Java compatibility and packaging can vary because this is an older tool. DirBuster reference.

w3af: Web audit framework. In a compatible course image, inspect discovery/audit/output plugins, select the local URL, and start with a restricted discovery profile. Save and review the report. Its legacy dependencies may not work in modern Python environments; do not globally downgrade your workstation to run it. w3af project.

CrypTool: Cryptography education environment. Load a Caesar-cipher or hashing template, supply synthetic text, change the key/input, and compare outputs. Controls are the selected template's components and parameters. Classical-cipher exercises explain concepts, not modern secure deployment. CrypTool 2.

AI assistants, including ChatGPT: Use a synthetic scan excerpt and ask for explanations of fields or flashcards. Check every suggested command against installed help; do not submit secrets or treat generated output as evidence. These are study assistants, not proof that a vulnerability exists.

MQTT tools: a local message exercise

Install Mosquitto and its clients in the lab. Start a broker listening only on localhost according to its current configuration guide. In terminal 1, subscribe to one synthetic topic; in terminal 2, publish once.

mosquitto_sub -h 127.0.0.1 -t ceh/lab -C 1 -v

mosquitto_pub -h 127.0.0.1 -t ceh/lab -m 'practice'

-h is broker, -p port, -t topic, publish -m message, subscribe -C 1 exits after one message, and subscribe -v prints topic with payload. Expect ceh/lab practice. If the broker requires authentication, use its configured training credentials and TLS setup; do not disable those controls on an existing broker. Publisher, subscriber.

Lab checklist and troubleshooting

A repeatable practice loop

1. State the question: for example, which service is listening on the known lab port?

2. Confirm target, account, interface, scope, and tool version.

3. Predict the expected observation before running the command.

4. Run the smallest useful test and save its output.

5. Explain the evidence and at least one alternative explanation.

6. Change one controlled variable and repeat.

7. Stop listeners/captures, remove synthetic credentials, and restore the lab if needed.

Troubleshooting map

Your lab notebook

For each exercise, record: date; tool/version; objective; target and scope; exact command/settings; prerequisite state; expected result; actual result; evidence filename; explanation; next test; cleanup. Redact secrets before exporting notes.

Suggested progression: Local HTTP discovery -> packet capture -> file/hash exercises -> network enumeration -> scanner comparison -> web/session/SQLi practice -> Windows and mobile analysis -> wireless and cloud specializations. You can study all tool associations before purchasing additional equipment or licenses.

Scope reminder: This is a study guide derived from the supplied conversation and public tool documentation, not an official exhaustive EC-Council tool catalog or a prediction of exam questions. Use the exam provider's current blueprint for certification requirements. References are linked beside the relevant instructions; installed help remains the authority for your exact build.

Exam Concept Quick-Reference (terminology, not lab tools)

Source: CEH v13 practice exam bank (879 questions, Exams A–E). These are definitions the exam tests directly rather than tools with install/command steps, compiled from recurring question patterns across the bank. Each is a named attack/technique/protocol concept, not something this lab guide provides hands-on steps for.

OSI Seven-Layer Model (quick reference)

General networking reference, not sourced to a specific exam question — included because CEH exams routinely ask which layer a protocol/device/attack operates at. Mapping a protocol to "the layer it is best known for" is a simplification; some protocols span layers depending on context.

Well-Known TCP/UDP Ports (quick reference)

General networking reference covering the ports most frequently tested across the CEH exam bank (service enumeration, footprinting, firewall/evasion questions). Cross-reference the tool entries above that already name specific ports (SNMP 161/162, LDAP 389/636, Kerberos 88, NetBIOS 137-139, NFS/rpcbind 111, SMB 445) rather than duplicating their full explanations here.

Cipher / Hash Algorithm Comparison (quick reference)

General cryptography reference, complementing the OpenSSL/VeraCrypt/CyberChef entries in the Cryptography module above. CEH exams commonly ask to classify an algorithm as symmetric, asymmetric, or a hash/KDF, and to identify which are considered broken/deprecated versus current best practice.

High-Priority Tool Recognition Map

Cover the right-hand column and recall the matching tool. These associations preserve the original cheat sheet's final recognition map.

Acronym Quick-Reference (A–Z)

A consolidated, alphabetized index of every acronym used across this document, plus common CEH/networking acronyms not otherwise spelled out inline — a fast lookup for the moment you hit an acronym mid-document (or on the exam) and cannot recall its expansion. Where a term already has a fuller definition earlier in this document (e.g., in the Exam Concept Quick-Reference table or a tool entry), this list gives only the expansion; see the relevant module/table above for the full explanation.