ExamFinch.com My Study

Cheat sheet

CEH Cheat Sheet

Practice this exam

Security Overview

  • 6% of exam
  • Ethics Controls Methodology Laws Scope

Reconnaissance Techniques

  • 17% of exam
  • Footprinting Scanning Enumeration OSINT DNS

System Hacking

  • 15% of exam
  • Vulnerability Analysis Access Malware Privilege Persistence

Network Perimeter

  • 24% of exam
  • Sniffing Social Engineering DoS Hijacking Evasion

Web Application

  • 14% of exam
  • Web Servers Web Apps SQL Injection APIs Input

Wireless Hacking

  • 5% of exam
  • Wi-Fi Encryption Bluetooth Evil Twin WPA

Mobile IoT OT

  • 10% of exam
  • Mobile Android iOS IoT OT

Cloud Computing

  • 5% of exam
  • Cloud Models Containers Serverless Shared Responsibility IAM

Cryptography

  • 5% of exam
  • Ciphers PKI Hashing Signatures Cryptanalysis

Quick Facts

  • Exam CEH
  • Code 312-50
  • Questions 125 MCQ
  • Time 4 hours
  • Pass 60-85%
  • Delivery ECC or VUE
  • Credential Valid 3 years
  • Blueprint v5.0

Five Phases OV

  • Recon scan access persist cover
  • Recon Scan Access Persist Cover

Attack Phase Picker OV

  • Collect public data → Recon
  • Map exposed services → Scanning
  • Query users shares → Enumeration
  • Use weakness → Gaining access
  • Keep foothold → Persistence
  • Document risk → Reporting

Ethics + Scope OV

  • Authorization Written permission
  • Scope Allowed targets
  • ROE Testing rules
  • NDA Confidentiality promise
  • White hat Authorized tester
  • Black hat Unauthorized attacker
  • Gray hat Unapproved discovery
  • Disclosure Report through channels

CIA Triad OV

  • Keep secrets accurate available
  • Confidentiality Integrity Availability

Security Controls OV

  • CIA Core security goals
  • Confidentiality Prevent disclosure
  • Integrity Prevent tampering
  • Availability Keep accessible
  • Administrative Policies and training
  • Technical Logical safeguards
  • Physical Facility safeguards
  • Least privilege Minimum access

Hacking Phases OV

  • Recon Gather information
  • Scanning Find live services
  • Gaining access Exploit weakness
  • Maintaining access Keep foothold
  • Covering tracks Hide evidence
  • Reporting Document findings

Passive vs Active Recon RE

Passive

  • Public sources
  • No direct probes

Active

  • Touches target
  • More detectable
  • Contact changes risk

Recon Picker RE

  • Need no contact → Passive OSINT
  • Need domain owner → WHOIS
  • Need mail servers → MX lookup
  • Need live hosts → Ping sweep
  • Need open ports → Port scan
  • Need service version → Banner grab

Footprinting RE

  • Passive recon No target contact
  • Active recon Target interaction
  • OSINT Public sources
  • WHOIS Domain registration
  • DNS Name infrastructure
  • MX Mail servers
  • NS Name servers
  • Metadata Hidden file data

Scanning vs Enumeration RE

Scanning

  • Find hosts
  • Find services

Enumeration

  • Extract details
  • Query services
  • Enumeration asks deeper

Scanning + Enumeration RE

  • Ping sweep Find live hosts
  • Port scan Find open ports
  • Banner grab Identify service
  • OS fingerprint Infer platform
  • SNMP Device management
  • LDAP Directory queries
  • NetBIOS Windows names
  • SMB File sharing
  • SMTP Mail enumeration
  • NFS Unix shares

Vulnerability + Access SY

  • CVE Public vulnerability
  • CVSS Severity score
  • False positive Invalid finding
  • Exploit Use weakness
  • Payload Delivered action
  • Privilege escalation Gain higher rights
  • Password cracking Recover secrets
  • Hash One-way digest

Malware + Persistence SY

  • Virus Host-attached code
  • Worm Self-spreading malware
  • Trojan Disguised malware
  • Rootkit Stealth control
  • Ransomware Extortion encryption
  • Backdoor Hidden access
  • Botnet Controlled hosts
  • C2 Command channel

IDS vs IPS NE

IDS

  • Detects events
  • Alerts humans

IPS

  • Blocks traffic
  • Inline control
  • Inline can block

Network Attacks NE

  • Sniffing Capture traffic
  • ARP spoofing Poison MAC mapping
  • MITM Intercept session
  • DoS Deny service
  • DDoS Distributed denial
  • Session hijacking Steal session
  • Replay Reuse captured data
  • DNS poisoning Corrupt resolution

Social + Evasion NE

  • Phishing Mass deception
  • Spear phishing Targeted deception
  • Whaling Executive targeting
  • Vishing Voice phishing
  • Smishing SMS phishing
  • IDS Detect intrusion
  • IPS Block intrusion
  • Honeypot Decoy system

Web Input WE

  • Validate encode parameterize authorize
  • Validate Encode Parameterize Authorize

XSS vs CSRF WE

XSS

  • Inject script
  • Victim runs code

CSRF

  • Forge action
  • Browser sends request
  • Code vs action

Web Defense Picker WE

  • SQL injection → Parameterized queries
  • Stored XSS → Output encoding
  • CSRF risk → CSRF tokens
  • IDOR risk → Object authorization
  • File inclusion → Path allowlist
  • API abuse → Rate limits

Web Attacks WE

  • XSS Client script injection
  • CSRF Forced browser action
  • SQLi Database injection
  • IDOR Broken object access
  • LFI Local file include
  • RFI Remote file include
  • SSRF Server-side request
  • Web shell Remote web control

SQL Injection Types WE

  • Union SQLi Merge query output
  • Error SQLi Leak via errors
  • Boolean blind True false inference
  • Time blind Delay inference
  • Stacked queries Multiple statements
  • Parameterized Bind inputs
  • Escaping Neutralize characters
  • Least privilege Limit database rights

Wireless Basics WI

  • SSID Network name
  • BSSID AP MAC
  • WEP Broken RC4
  • WPA TKIP transition
  • WPA2 AES CCMP
  • WPA3 SAE handshake
  • Evil twin Rogue lookalike AP
  • Deauth Forced disconnect

Jailbreak vs Rooting MO

Jailbreak

  • iOS restrictions
  • App Store bypass

Rooting

  • Android privileges
  • System control
  • Platform differs

Mobile IoT OT MO

  • Jailbreak iOS restriction removal
  • Rooting Android privilege gain
  • Sideloading Unofficial app install
  • MDM Device policy control
  • IoT Connected devices
  • Default creds Common IoT risk
  • OT Physical process tech
  • SCADA Industrial control

IaaS vs SaaS CL

IaaS

  • You manage OS
  • More control

SaaS

  • Provider manages app
  • Less control
  • Control shifts responsibility

Cloud Security CL

  • IaaS Customer manages OS
  • PaaS Customer manages app
  • SaaS Customer manages data
  • IAM Cloud access control
  • Bucket exposure Public storage leak
  • Container escape Break isolation
  • Serverless Function execution
  • API keys Cloud secrets

Crypto Goals CR

  • Encrypt hash sign certify
  • Encrypt Hash Sign Certify

Symmetric vs Asymmetric CR

Symmetric

  • One shared key
  • Fast bulk data

Asymmetric

  • Key pair
  • Trust exchange
  • Speed vs trust

Crypto Picker CR

  • Need confidentiality → Encryption
  • Need integrity → Hashing
  • Need authenticity → Digital signature
  • Need key exchange → Asymmetric crypto
  • Store passwords → Salted hashes
  • Trust certificates → PKI

Cryptography CR

  • Symmetric One shared key
  • Asymmetric Public private keys
  • Hashing One-way integrity
  • Salt Unique hash input
  • PKI Certificate trust
  • CA Certificate issuer
  • Digital signature Integrity and nonrepudiation
  • Cryptanalysis Break cryptography

Common Traps

Authorization

  • Written permission ≠ Good intent only

Recon Detection

  • Passive OSINT ≠ Active probing

Vulnerability Testing

  • Finding weakness ≠ Proving exploit

Hashing

  • Integrity digest ≠ Reversible encryption

XSS

  • Browser executes script ≠ Database query changes

WPA

  • Handshake capture ≠ Plaintext password capture

Cloud Security

  • Shared responsibility ≠ Provider owns everything

IDS

  • Detection alerting ≠ Automatic blocking

Last Minute

  • 1. Get written authorization first
  • 2. Scope defines legal boundary
  • 3. Recon before scanning always
  • 4. Enumeration extracts service details
  • 5. IDS detects; IPS blocks
  • 6. SQLi: parameterize queries
  • 7. XSS: encode output
  • 8. WEP is broken
  • 9. WPA3 uses SAE
  • 10. Hashing is not encryption
  • 11. IaaS means OS responsibility
  • 12. CEH pass score varies

CEH

  • Practice Questions 212 questions Study Guide 51 topics Cheat Sheet 120 facts Flashcards 50 cards Shorts 4 short s Videos 1 video Blogs 1 blog Free CE Podcast