Study guide
1.2 The Five Phases of Ethical Hacking
EC-Council Certified Ethical Hacker CEH
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map
2 Reconnaissance, Footprinting, Scanning & Enumeration
2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures
3 Vulnerability Analysis & System Hacking Phases
3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection
4 Malware Threats, Sniffing & Social Engineering
4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses
5 Network & Perimeter Hacking
5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders
6 Web Server & Web Application Hacking
6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts
7 Wireless Network Hacking
7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures
8 Mobile Platform, IoT & OT Hacking
8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security
9 Cloud Computing & Cryptography
9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices
1.2 The Five Phases of Ethical Hacking
Key Takeaways Explain This Topic AI
EC-Council's hacking methodology has five phases: Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Clearing Tracks (covering tracks)
Reconnaissance splits into passive (no direct contact, e.g., OSINT, WHOIS, DNS) and active (direct probing) information gathering
Scanning turns reconnaissance data into a live attack-surface map: open ports, services, versions, and known vulnerabilities
Gaining Access is exploitation and privilege escalation; Maintaining Access is persistence (backdoors, rootkits); Clearing Tracks is anti-forensics like log tampering
The five phases map onto the 20 CEH modules and ~550 attack techniques; an ethical hacker never destroys a client's logs during Clearing Tracks
Last updated: June 2026
Why the Five Phases Matter
EC-Council frames an attack as a repeatable five-phase methodology , and CEH v13 explicitly integrates AI assistance into each phase. Almost every later CEH domain — reconnaissance, scanning, enumeration, system hacking, evasion — is one of these phases studied in depth. Memorize the order and the intent of each phase: exam questions frequently describe an activity and ask you to classify it into the correct phase, or ask which phase comes next.
The Five Phases
# Phase Attacker Goal Representative Tools/Activities Primary Defensive Control
1 Reconnaissance Gather information about the target OSINT, WHOIS, nslookup / dig (DNS), Maltego, theHarvester, Shodan, Google dorks Minimize public footprint, monitor brand/domain mentions
2 Scanning Map the live attack surface Nmap (port/service/version), Nessus/OpenVAS (vuln scan), Netcat banner grab Network segmentation, IDS/IPS, reduce exposed services
3 Gaining Access Exploit a weakness for a foothold Metasploit, Hydra/John/Hashcat (password attacks), SQLmap, exploit code Patching, least privilege, input validation, MFA
4 Maintaining Access Keep persistent control Backdoors, rootkits, trojans, scheduled tasks, new accounts, C2 channels EDR, file-integrity monitoring, baseline review
5 Clearing Tracks Hide evidence of intrusion Log deletion/editing, clearev (Meterpreter), timestomping, removing tools Centralized tamper-evident logging (SIEM), write-once storage
Phase 1 — Reconnaissance (Footprinting)
Reconnaissance , also called footprinting, is information gathering. It divides into two sub-types:
Passive reconnaissance — no direct interaction with the target's systems. Examples: public records, social media, search-engine data (Google dorking), WHOIS, DNS, Shodan. Very hard for the target to detect because the attacker never touches the target's infrastructure.
Active reconnaissance — direct interaction such as DNS zone-transfer attempts, banner grabbing, or social engineering of employees. It yields richer data but is observable and can trigger alerts.
Phase 2 — Scanning
Scanning converts recon data into a concrete map: which hosts are alive (host discovery / ping sweeps), which ports are open, which services and versions run, and which known vulnerabilities exist. The canonical tool is Nmap ; vulnerability scanners such as Nessus and OpenVAS automate the vuln-discovery step. Detective controls (IDS/IPS, NetFlow monitoring) are most effective here because scanning generates noticeable traffic.
Phase 3 — Gaining Access
This is exploitation — turning a discovered weakness into a foothold, then often escalating privilege from a normal user to root/administrator. Tools include the Metasploit Framework (exploit delivery), password crackers ( Hydra online, John the Ripper / Hashcat offline), and injection tools ( SQLmap ). The exam tests why an exploit works and which control would have prevented it (patching, least privilege, input validation, MFA) — not exploit syntax.
Phase 4 — Maintaining Access (Persistence)
The attacker establishes persistence so a reboot or password change does not lock them out — via backdoors, rootkits , trojans, scheduled tasks, or rogue accounts — and may pivot to other hosts and establish command and control (C2) . Endpoint detection and response ( EDR ) and file-integrity monitoring are the key countermeasures.
Phase 5 — Clearing Tracks (Covering Tracks)
The attacker performs anti-forensics to erase evidence: editing or deleting logs, timestomping (altering file timestamps), disabling auditing, and removing tools. Ethical hackers do not destroy client logs. Full, preserved logging supports the engagement report, lets the blue team validate detection, and maintains the client's forensic trail.
Mapping Phases to the 20 CEH Modules
The CEH v13 curriculum is 20 modules covering 550+ attack techniques , and they map cleanly onto the five phases: Module 1 (Introduction) sets context; Modules 2–4 (Footprinting, Scanning, Enumeration) are Recon + Scanning ; Modules 5–6 (Vulnerability Analysis, System Hacking) plus 7–12 (Malware, Sniffing, Social Engineering, DoS, Session Hijacking, Evasion) drive Gaining/Maintaining/Clearing ; Modules 13–20 (Web Servers, Web Apps, SQL Injection, Wireless, Mobile, IoT/OT, Cloud, Cryptography) are attack surfaces exercised across phases 2–4. Thinking in phases keeps the large blueprint coherent rather than a flat list of 20 modules.
Enumeration: The Bridge Between Scanning and Access
Between scanning and gaining access sits enumeration , an active extraction of detailed information from services the scan revealed — usernames, share names, group memberships, routing tables, and SNMP data. Where scanning answers what is open , enumeration answers what is behind it . Classic enumeration targets and ports include NetBIOS (137-139) , SMB (445) , SNMP (161 UDP) , LDAP (389) , SMTP (25) , NTP (123) , and DNS (53) . A successful enumeration of valid usernames, for example, turns a blind password-spray into a targeted attack — which is exactly why it is the natural bridge to Phase 3.
Tools by Phase (Exam-Ready Summary)
- Phase Go-To Tools the Exam Names
- Recon Maltego, theHarvester, Shodan, Recon-ng, WHOIS, Google dorks
- Scanning Nmap, Hping3, Nessus, OpenVAS, Netcat
- Enumeration Enum4linux, snmp-check, ldapsearch, NetBIOS tools
- Gaining Access Metasploit, Hydra, John the Ripper, Hashcat, SQLmap
- Maintaining Access Netcat backdoors, rootkits, Meterpreter persistence
- Clearing Tracks Meterpreter clearev, timestomp, log editors
Memorize a couple of representative tools per phase; CEH loves to give a tool name and ask which phase it belongs to, or vice versa.