Certified Ethical Hacker (CEH v12 / v13)
Demonstrate comprehensive knowledge of ethical hacking methodologies, reconnaissance techniques, system attack phases, network perimeter exploitation, web application attacks, wireless vulnerabilities, cloud hacking, and cryptography countermeasures.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
CEH is an internationally recognized certification by EC-Council validating knowledge of ethical hacking phases, penetration testing methodologies, attack vectors, and defensive countermeasures.
The ANSI-accredited CEH (Theory) exam consists of 125 multiple-choice questions to be completed within 4 hours (240 minutes) administered at Pearson VUE or ECC Exam centers.
The passing threshold varies from 60% to 85% depending on the specific exam question bank difficulty form assigned by EC-Council.
Domains include: (1) Information Security & Ethical Hacking Overview (6%), (2) Reconnaissance Techniques (21%), (3) System Hacking Phases and Attack Techniques (17%), (4) Network and Perimeter Hacking (14%), (5) Web Application Hacking (16%), (6) Wireless Network Hacking (6%), (7) Mobile Platform, IoT, and OT Hacking (8%), (8) Cloud Computing (6%), and (9) Cryptography (6%).
1. Reconnaissance (Footprinting), 2. Scanning & Enumeration, 3. Gaining Access (Exploitation), 4. Maintaining Access (Backdoors, Rootkits), and 5. Clearing Tracks (Log Tampering, Covering Traces).
The preparatory phase where hackers collect information about target networks, domain names, IP blocks, employee details, and technologies using passive OSINT and active scanning tools.
Vulnerability scanning identifies potential security weaknesses using automated scanners (Nessus, OpenVAS). Penetration testing actively attempts to exploit weaknesses to measure actual impact.
Adversaries steal or predict a valid session token (via XSS, packet sniffing, or session fixation) to impersonate an authenticated user without providing legitimate credentials.
DoS attacks originate from a single source system. DDoS attacks flood targets with overwhelming traffic from thousands of geographically distributed compromised computers (botnets).
OWASP Top 10 vulnerabilities including SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Insecure Deserialization, Broken Access Control, and Server-Side Request Forgery (SSRF).
Using packet fragmentation, decoy scanning (-D in Nmap), source port manipulation, IP address spoofing, custom proxy chains, and encrypted tunneling.
Security officers, auditors, security professionals, site administrators, penetration testers, and anyone concerned about the integrity of enterprise network infrastructure.