EC-Council Expert

312-50v13

CEH v13 - Certified Ethical Hacker

The Certified Ethical Hacker (CEH) v13 is the world's most advanced ethical hacking certification and program. This certification validates expertise in identifying and addressing vulnerabilities in target systems using the same knowledge and tools as malicious hackers, but in a lawful and legitimate manner. CEH v13 introduces cutting-edge hacking techniques including AI-driven attacks, machine learning in cybersecurity, and modern cloud security testing.

The exam covers 21 comprehensive domains including information gathering, scanning, enumeration, system hacking, malware analysis, sniffing, social engineering, web application security, wireless security, mobile and IoT hacking, cloud computing security, and cryptography. The v13 version features enhanced coverage of AI-powered ethical hacking, adversarial machine learning, deep fake detection, and advanced persistent threat (APT) simulation.

CEH is ideal for security professionals, penetration testers, security auditors, network administrators, and anyone responsible for network infrastructure security. With over 450,000 CEH certified professionals worldwide, this certification is recognized by employers globally and meets DoD 8570 requirements. The certification demonstrates hands-on skills in penetration testing methodologies, vulnerability assessment, and ethical hacking techniques.

Updated Jan 2024 Cybersecurity

125

Questions

Practice Tests

70%

Pass Score

Views

Total Attempts

Avg. Score

Pass Rate

Discussions

Practice Tests Flash Cards Exam Topics Cheat Sheet

€5.00

CEH v13 Practice Exam 1

Comprehensive 125-question practice exam covering all five CEH v13 domains: information gathering and reconnaissance, network and system security, web application security, wireless mobile and IoT security, and advanced attack techniques and countermeasures.

125 Q 240 minutes 70%

Test Drive

€5.00

CEH v13 Practice Exam 2

125 Q 240 minutes 70%

Test Drive

€5.00

CEH v13 Practice Exam 3

125 Q 240 minutes 70%

Test Drive

€5.00

CEH v13 Practice Exam 4

125 Q 240 minutes 70%

Test Drive

€5.00

CEH v13 Practice Exam 5

125 Q 240 minutes 70%

Test Drive

€5.00

CEH v13 Practice Exam 6

125 Q 240 minutes 70%

Test Drive

Unlock All Content for 312-50v13

6 Practice Test(s) + Flash Cards — 3 months access

€39.99 €26.99 Save 30%

or included with Monthly subscription / Content Bundle

312-50v13 Cheat Sheet

Quick reference guide - 6 sections

Free Access

CEH v13 - Certified Ethical Hacker Exam Details

Detail	Value
Exam Code	312-50v13 (CEH v13)
Duration	4 hours
Number of Questions	125 questions
Passing Score	60-85% (scaled, varies by exam form)
Question Format	Multiple choice
Exam Fee	$1,199 USD (with training); $950 USD (exam voucher only via ECC Exam Center)
Certification Body	EC-Council
Validity	3 years (120 ECE credits to renew)
Prerequisite	Official training OR 2 years infosec experience + application

Exam Objective Domains

Module	Topic
1	Introduction to Ethical Hacking
2	Footprinting & Reconnaissance
3	Scanning Networks
4	Enumeration
5	Vulnerability Analysis
6	System Hacking
7	Malware Threats
8	Sniffing
9	Social Engineering
10	Denial-of-Service
11	Session Hijacking
12	Evading IDS, Firewalls & Honeypots
13	Hacking Web Servers
14	Hacking Web Applications
15	SQL Injection
16	Hacking Wireless Networks
17	Hacking Mobile Platforms
18	IoT & OT Hacking
19	Cloud Computing
20	Cryptography

What Is CEH v13?

The Certified Ethical Hacker (CEH) v13 is EC-Council's flagship cybersecurity certification that validates the skills needed to think like a hacker and proactively secure systems. CEH v13 introduces AI-powered hacking techniques and AI-driven security tools, reflecting the modern threat landscape. The exam covers 20 modules spanning the entire ethical hacking methodology from reconnaissance through post-exploitation. CEH v13 emphasizes hands-on skill with over 200 real-world labs using live tools and environments.

Exam Tip: CEH v13 heavily tests tool knowledge -- know which tool is used for which purpose. The exam is scenario-based: you will be given a situation and must identify the correct tool, technique, or attack vector. Memorize common tool names and their primary functions.

Ethical Hacking Phases

Phase	Description	Key Activities
1. Reconnaissance	Information gathering	OSINT, footprinting, social engineering
2. Scanning	Network & vulnerability scanning	Port scanning, service enumeration, vuln scanning
3. Gaining Access	Exploiting vulnerabilities	Password cracking, exploit execution, privilege escalation
4. Maintaining Access	Persistent access	Backdoors, rootkits, trojans
5. Clearing Tracks	Covering evidence	Log tampering, steganography, tunneling

Footprinting & Reconnaissance Tools

Tool	Purpose	Type
Maltego	OSINT link analysis and data mining	Passive
theHarvester	Email, subdomain, and name harvesting	Passive
Shodan	Internet-connected device search engine	Passive
Recon-ng	Web reconnaissance framework (modular)	Passive/Active
WHOIS	Domain registration information lookup	Passive
Censys	Internet-wide scanning and certificate search	Passive
FOCA	Metadata extraction from public documents	Passive
Google Dorking	Advanced search operators (site:, filetype:, intitle:, inurl:)	Passive

Exam Tip: Passive reconnaissance does NOT interact directly with the target (no packets sent). Active reconnaissance involves direct interaction (scanning, probing). OSINT is always passive. DNS lookups are generally considered passive, but zone transfers are active.

Nmap Scan Types

Scan Type	Flag	Description
TCP SYN (Stealth)	-sS	Half-open scan; sends SYN, does not complete handshake. Default for root.
TCP Connect	-sT	Full TCP handshake; used when SYN scan not possible. Default for non-root.
UDP	-sU	Scans UDP ports; slower due to lack of handshake feedback.
FIN	-sF	Sends FIN flag; closed ports respond with RST, open ports no response.
Xmas	-sX	Sets FIN, PSH, URG flags; same logic as FIN scan.
NULL	-sN	No flags set; same logic as FIN scan.
ACK	-sA	Determines firewall rules (filtered vs unfiltered); does not find open ports.
IDLE (Zombie)	-sI	Uses a zombie host with predictable IP ID; completely blind scan.
Version Detection	-sV	Probes open ports for service/version info.
OS Detection	-O	TCP/IP fingerprinting to determine operating system.

Exam Tip: FIN, Xmas, and NULL scans only work against RFC-compliant TCP stacks (most Unix/Linux). Windows sends RST for both open and closed ports, making these scans ineffective. The IDLE scan (-sI) is the only truly anonymous Nmap scan.

Enumeration Techniques & Ports

Protocol	Port	Enumeration Target	Tools
NetBIOS	137-139	Shares, users, groups	nbtstat, nbtscan, enum4linux
SNMP	161/162	Network devices, MIB data	snmpwalk, snmp-check, onesixtyone
LDAP	389/636	AD users, groups, OUs	ldapsearch, JXplorer, Softerra
SMB	445	Shares, users, policies	smbclient, enum4linux, CrackMapExec
NFS	2049	Exported shares	showmount, nfsstat
DNS	53	Zone transfers, records	nslookup, dig, dnsrecon, fierce
SMTP	25	Valid email users	VRFY, EXPN, RCPT TO commands

Vulnerability Assessment Tools

Tool	Type	Key Feature
Nessus	Commercial	Most widely used vulnerability scanner; credentialed & uncredentialed scans
OpenVAS	Open Source	Full-featured free vulnerability scanner (forked from Nessus)
Qualys	Cloud-based	SaaS vulnerability management platform
Nikto	Open Source	Web server scanner (misconfigurations, outdated software)

Password Cracking Techniques

Technique	Description	Tools
Dictionary Attack	Uses a wordlist of common passwords	John the Ripper, Hashcat, Hydra
Brute Force	Tries every possible combination	Hashcat, John the Ripper
Rule-Based	Dictionary + transformation rules (append numbers, capitalize)	Hashcat, John the Ripper
Rainbow Table	Pre-computed hash-to-password lookup tables	RainbowCrack, ophcrack
Pass-the-Hash	Uses captured NTLM hash without cracking it	Mimikatz, pth-toolkit, CrackMapExec
Credential Stuffing	Uses leaked credentials from breaches on other sites	Sentry MBA, STORM

Exam Tip: Salting defeats rainbow tables because each hash is unique even for identical passwords. NTLM hashes are unsalted, making them vulnerable to rainbow tables. Know that Mimikatz extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memory.

Privilege Escalation Techniques

Type	Technique	Platform
Vertical	DLL hijacking, unquoted service paths	Windows
Vertical	SUID/SGID abuse, kernel exploits	Linux
Vertical	Token impersonation (SeImpersonatePrivilege)	Windows
Vertical	Misconfigured sudo, cron job abuse	Linux
Horizontal	Session hijacking, IDOR exploitation	Web/Any

Malware Types

Type	Description	Key Characteristic
Virus	Self-replicating code that attaches to host files	Requires user action to spread
Worm	Self-replicating code that spreads over networks	Spreads autonomously (no user action)
Trojan	Disguised as legitimate software	Does NOT self-replicate
Ransomware	Encrypts files and demands payment	WannaCry, Petya, REvil, LockBit
Rootkit	Hides malware presence at OS/kernel level	Kernel rootkits are hardest to detect
Spyware	Monitors user activity covertly	Keyloggers, screen capture
Fileless Malware	Runs entirely in memory; no files on disk	Uses PowerShell, WMI, or LOLBins
APT	Advanced Persistent Threat; long-term targeted attack	State-sponsored, stealthy, persistent

Exam Tip: The key distinction between virus and worm: viruses need a host file and user action; worms are standalone and self-propagate. Trojans never self-replicate. Fileless malware is detected by behavior-based analysis, not signature-based antivirus.

Covering Tracks

Log Tampering: Clearing Windows Event Logs (wevtutil cl), editing Linux /var/log files, using Auditpol to disable auditing
Steganography: Hiding data within images, audio, or video files (tools: OpenStego, Snow, Steghide)
Timestomping: Modifying file timestamps to blend in (tool: Timestomp from Metasploit)
Alternate Data Streams (ADS): NTFS feature to hide data in file streams (Windows only)
Tunneling: Encapsulating traffic in allowed protocols (DNS tunneling, ICMP tunneling)

OWASP Top 10 (2021)

Rank	Vulnerability	Description
A01	Broken Access Control	Users acting beyond permissions (IDOR, privilege escalation)
A02	Cryptographic Failures	Weak encryption, plaintext transmission, exposed sensitive data
A03	Injection	SQL, NoSQL, OS command, LDAP injection
A04	Insecure Design	Fundamental architecture and design flaws
A05	Security Misconfiguration	Default configs, unnecessary features, missing hardening
A06	Vulnerable Components	Outdated libraries, frameworks with known CVEs
A07	Auth Failures	Broken authentication, session management issues
A08	Software & Data Integrity	Insecure CI/CD pipelines, unsigned updates, deserialization
A09	Logging & Monitoring Failures	Insufficient logging, no alerting on breaches
A10	SSRF	Server-Side Request Forgery; server makes requests to unintended locations

SQL Injection Types

Type	Description	Detection
In-Band (Classic)	Results returned in the same HTTP response	UNION-based, error-based
Blind (Boolean)	No direct output; infer from TRUE/FALSE page differences	Conditional responses
Blind (Time-Based)	No output; infer from response delay	SLEEP(), WAITFOR DELAY
Out-of-Band	Data exfiltrated via DNS or HTTP to attacker server	xp_dirtree, UTL_HTTP, LOAD_FILE
Second-Order	Payload stored and executed later in different query	Stored injection

Exam Tip: The primary defense against SQL injection is parameterized queries (prepared statements), NOT input validation alone. Tools: SQLmap (automated), Burp Suite (manual). Know the difference between UNION-based and blind injection techniques.

XSS (Cross-Site Scripting) Types

Type	Description	Persistence
Reflected	Script reflected from web server in response (URL parameter)	Non-persistent (one request)
Stored	Script stored on server (database, comment, forum post)	Persistent (affects all viewers)
DOM-Based	Script executed via client-side DOM manipulation	Non-persistent (client-side only)

Network Attack Types

Attack	Description	Layer
ARP Spoofing	Sends fake ARP replies to associate attacker's MAC with target IP	Layer 2
DNS Poisoning	Corrupts DNS cache to redirect traffic to attacker	Layer 7
DHCP Starvation	Exhausts DHCP pool with fake requests; enables rogue DHCP	Layer 2-3
MAC Flooding	Overflows switch CAM table; switch acts as hub	Layer 2
MITM	Intercepts and potentially modifies communication	Various
SYN Flood	Sends SYN packets without completing handshake; exhausts connections	Layer 4

Web Attack Tools

Tool	Primary Use
Burp Suite	Web application security testing (proxy, scanner, repeater, intruder)
SQLmap	Automated SQL injection detection and exploitation
OWASP ZAP	Free web app security scanner (intercepting proxy)
WPScan	WordPress vulnerability scanner
DirBuster / Gobuster	Directory/file brute forcing on web servers
Metasploit	Exploitation framework (exploits, payloads, post-exploitation)

Wireless Security Protocols

Protocol	Encryption	Key Management	Security Level
WEP	RC4 (24-bit IV)	Static key	Broken (crackable in minutes)
WPA	TKIP (RC4-based)	Per-packet key mixing	Weak (TKIP vulnerabilities)
WPA2 Personal	AES-CCMP	Pre-shared key (PSK)	Strong (vulnerable to offline dict attack)
WPA2 Enterprise	AES-CCMP	802.1X / RADIUS	Strong (per-user auth)
WPA3 Personal	AES-CCMP / AES-GCMP	SAE (Dragonfly handshake)	Strongest (forward secrecy)
WPA3 Enterprise	192-bit suite	802.1X / RADIUS	Strongest (CNSA suite)

Exam Tip: WPA3 uses SAE (Simultaneous Authentication of Equals) which replaces the 4-way handshake and provides protection against offline dictionary attacks and forward secrecy. WPA2 PSK is vulnerable to KRACK and offline dictionary attacks if the 4-way handshake is captured.

Wireless Attack Tools

Tool	Purpose
Aircrack-ng	Complete Wi-Fi audit suite (capture, crack WEP/WPA)
Kismet	Wireless network detector and sniffer
Wifite	Automated wireless attack tool
Fern Wi-Fi Cracker	GUI-based wireless security auditing tool
Fluxion	Evil twin attack tool for WPA/WPA2

Cloud Computing Threats

Data Breach: Unauthorized access to cloud-stored sensitive data
Insecure APIs: Weak authentication, lack of encryption, excessive permissions
Misconfiguration: Open S3 buckets, public databases, excessive IAM permissions
Account Hijacking: Phishing, credential theft, session hijacking of cloud accounts
Insider Threats: Malicious or negligent cloud administrators
Side-Channel Attacks: Exploiting shared hardware in multi-tenant environments
Cryptojacking: Unauthorized use of cloud resources for cryptocurrency mining

Cryptography Essentials

Algorithm	Type	Key Size	Notes
AES	Symmetric Block	128/192/256 bits	Industry standard; replaced DES
DES	Symmetric Block	56 bits	Obsolete; brute-forceable
3DES	Symmetric Block	168 bits (effective 112)	Deprecated; slow
RSA	Asymmetric	2048/4096 bits	Key exchange, digital signatures
Diffie-Hellman	Key Exchange	2048+ bits	Secure key exchange over insecure channel
ECC	Asymmetric	256 bits	Smaller keys, same strength as RSA 3072
SHA-256	Hash	256-bit output	Integrity verification, digital signatures
MD5	Hash	128-bit output	Broken (collision attacks); do not use for security

Exam Tip: Symmetric = one shared key (fast, used for bulk data). Asymmetric = public/private key pair (slow, used for key exchange and signatures). Hashing is ONE-WAY -- it cannot be decrypted. MD5 and SHA-1 are both considered insecure due to collision vulnerabilities.

Symmetric vs Asymmetric Encryption

Feature	Symmetric	Asymmetric
Keys	One shared secret key	Public + private key pair
Speed	Fast (1000x faster)	Slow
Key Distribution	Problem (must share securely)	Easy (public key is public)
Use Case	Bulk data encryption	Key exchange, digital signatures
Algorithms	AES, DES, 3DES, Blowfish, RC4	RSA, ECC, Diffie-Hellman, ElGamal

IDS vs IPS vs Firewall

Feature	Firewall	IDS	IPS
Action	Block/Allow based on rules	Detect and alert only	Detect, alert, and block
Position	Inline (gateway)	Passive (monitors copy of traffic)	Inline (active blocking)
Detection	Port/IP rules	Signature + anomaly-based	Signature + anomaly-based
Tools	iptables, pfSense	Snort, Suricata, OSSEC	Snort (inline), Suricata, Fail2Ban

Social Engineering Attack Types

Attack	Vector	Description
Phishing	Email	Mass email impersonating trusted entity
Spear Phishing	Email	Targeted at specific individual/organization
Whaling	Email	Targets C-suite / senior executives
Vishing	Voice/Phone	Voice phishing via phone calls
Smishing	SMS	Phishing via text messages
Pretexting	Any	Creating a fabricated scenario to extract info
Baiting	Physical/Digital	Luring victim with something enticing (USB drop, free download)
Tailgating	Physical	Following authorized person through secure door
Watering Hole	Web	Compromising a website frequently visited by targets

Essential Tool-to-Purpose Mapping

Category	Tools
Port Scanning	Nmap, Hping3, MegaPing, NetScanTools
Packet Sniffing	Wireshark, tcpdump, Ettercap, Capsa
Password Cracking	John the Ripper, Hashcat, Hydra, ophcrack, L0phtCrack
Exploitation	Metasploit, BeEF, Empire, Cobalt Strike
ARP Spoofing	arpspoof, Ettercap, Cain & Abel, BetterCAP
Steganography	OpenStego, Steghide, Snow, QuickStego
Mobile Hacking	zANTI, Drozer, Frida, APKTool, Objection
DoS / DDoS	LOIC, HOIC, Slowloris, hping3

Exam Tip: The CEH exam is heavily tool-focused. For each tool, know: what it does, which attack phase it belongs to, and one distinguishing feature. Wireshark = packet capture (passive), Ettercap = MITM (active), Nmap = scanning, Metasploit = exploitation, Hashcat = password cracking (GPU-accelerated).

DoS vs DDoS

Feature	DoS	DDoS
Source	Single machine	Multiple machines (botnet)
Mitigation	Block source IP	Rate limiting, CDN, WAF, scrubbing centers
Common Types	SYN flood, Ping of Death, Slowloris	Volumetric, protocol, application layer
Amplification	N/A	DNS, NTP, SSDP, Memcached amplification

312-50v13

CEH v13 - Certified Ethical Hacker

CEH v13 Practice Exam 1

CEH v13 Practice Exam 2

CEH v13 Practice Exam 3

CEH v13 Practice Exam 4

CEH v13 Practice Exam 5

CEH v13 Practice Exam 6

Unlock All Content for 312-50v13

Preview (10 / 120)

Flash Cards

Available Languages

Exam Topics

312-50v13 Cheat Sheet

CEH v13 - Certified Ethical Hacker Exam Details

Exam Objective Domains

What Is CEH v13?

Ethical Hacking Phases

Footprinting & Reconnaissance Tools

Nmap Scan Types

Enumeration Techniques & Ports

Vulnerability Assessment Tools

Password Cracking Techniques

Privilege Escalation Techniques

Malware Types

Covering Tracks

OWASP Top 10 (2021)

SQL Injection Types

XSS (Cross-Site Scripting) Types

Network Attack Types

Web Attack Tools

Wireless Security Protocols

Wireless Attack Tools

Cloud Computing Threats

Cryptography Essentials

Symmetric vs Asymmetric Encryption

IDS vs IPS vs Firewall

Social Engineering Attack Types

Essential Tool-to-Purpose Mapping

DoS vs DDoS