This sheet maps the full CEH v13 (CEH AI) exam from EC-Council, the 125-question, 4-hour assessment built around 20 modules and the five phases of ethical hacking (reconnaissance, scanning, gaining access, maintaining access, and covering tracks). It distills every testable concept across footprinting, scanning, enumeration, system and web hacking, wireless, mobile, IoT/OT, cloud, and cryptography into recall-ready rows, with the exam's preferred framings and the misconceptions candidates fall for called out explicitly. CEH is criterion-referenced: the graded answer is the technique, tool, or countermeasure EC-Council teaches, so the focus throughout is recognizing the method, not memorizing trivia. Treat every payload here as a concept to identify, never a weapon to run.
What This Cheat Sheet Covers
This topic spans 60 focused tables and 701 indexed concepts, 687 flashcards, 20 practice tests with 813 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Information Security Fundamentals, Attack Classification, and Hacker ClassesTable 2: Ethical Hacking, CEH Methodology, and AI-Driven HackingTable 3: Cyber Kill Chain and MITRE ATT&CK FrameworkTable 4: Information Assurance, Risk Management, Threat Intelligence, and Incident ManagementTable 5: Information Security Laws, Standards, and Compliance RegulationsTable 6: Footprinting Concepts and Search Engine, OSINT, and Social Networking FootprintingTable 7: Whois, DNS, and Network FootprintingTable 8: Email, Social Engineering Footprinting, and AI-Powered OSINTTable 9: Network Scanning Concepts and Host Discovery TechniquesTable 10: Port Scanning Techniques and Service Version DiscoveryTable 11: OS Discovery, Banner Grabbing, and Scanning Beyond IDS and FirewallTable 12: Enumeration Concepts, NetBIOS, and SMB EnumerationTable 13: SNMP, LDAP, NTP, NFS, and RPC EnumerationTable 14: SMTP, DNS, IPsec, VoIP, Unix/Linux Enumeration, and CountermeasuresTable 15: Vulnerability Classification and Scoring SystemsTable 16: Vulnerability Management Lifecycle, Assessment Types, and ToolsTable 17: Password Cracking Concepts and Password Attack TypesTable 18: Windows and Linux Authentication Attacks and Password-Cracking ToolsTable 19: Vulnerability Exploitation, Metasploit Framework, and Buffer OverflowTable 20: Active Directory Enumeration and Privilege EscalationTable 21: Maintaining Access: Executing Applications, Keyloggers, Spyware, and RootkitsTable 22: Steganography and SteganalysisTable 23: Covering Tracks and Clearing LogsTable 24: Malware Concepts, Trojans, and Advanced Persistent ThreatsTable 25: Viruses, Worms, Ransomware, and Fileless and AI-Based MalwareTable 26: Malware Analysis, Detection Methods, and CountermeasuresTable 27: Sniffing Concepts, MAC Flooding, and DHCP StarvationTable 28: ARP Poisoning, MAC Spoofing, VLAN Hopping, and STP AttacksTable 29: DNS Poisoning, Sniffing Tools, and Sniffer DetectionTable 30: Social Engineering Concepts and Human-Based TechniquesTable 31: Phishing, Identity Theft, and Social Engineering CountermeasuresTable 32: DoS and DDoS Attack Techniques and BotnetsTable 33: DoS and DDoS Detection, Protection Tools, and ServicesTable 34: Application-Level Session HijackingTable 35: Network-Level Session Hijacking, Tools, and PreventionTable 36: IDS, IPS, and Firewall Concepts and TypesTable 37: IDS and Firewall Evasion Techniques and Antivirus BypassTable 38: Honeypots and IDS/Firewall Evasion CountermeasuresTable 39: Web Server Architecture, Vulnerabilities, and AttacksTable 40: Web Server Attack Methodology, Tools, and CountermeasuresTable 41: Web Application Concepts and OWASP Top 10 Application Security Risks 2021Table 42: Web Application Hacking Methodology and Client-Side BypassTable 43: Web Services, Web API, and Webhook HackingTable 44: SQL Injection Types and Attack TechniquesTable 45: SQL Injection Methodology, Tools, Evasion, and CountermeasuresTable 46: Wireless Standards, Encryption, and ThreatsTable 47: Wireless Hacking Methodology, Attacks, and CountermeasuresTable 48: Mobile Attack Vectors and OWASP Top 10 Mobile Risks 2024Table 49: Android Hacking and SecurityTable 50: iOS Hacking and Mobile Device ManagementTable 51: IoT Architecture, Protocols, and OWASP IoT ThreatsTable 52: IoT Attacks, Hacking Methodology, and ToolsTable 53: OT, ICS, and SCADA HackingTable 54: Cloud Computing Concepts, Containers, Kubernetes, and ServerlessTable 55: Cloud Threats, Container/Kubernetes Vulnerabilities, and AttacksTable 56: Cloud Hacking (AWS, Azure, GCP, Container) and Cloud Security ControlsTable 57: Cryptography Concepts, Ciphers, and Encryption AlgorithmsTable 58: Hash Functions, PKI, Digital Signatures, and CertificatesTable 59: Email Encryption, Disk Encryption, Blockchain, and Cryptography ToolsTable 60: Cryptanalysis and Cryptography Attacks
Quick IndexSubscribe to unlock
A jump-to index of every table row in this cheat sheet.
Mind MapSubscribe to unlock
An interactive map of every table and concept in this topic.
Table 1: Information Security Fundamentals, Attack Classification, and Hacker Classes
CEH v13 Module 01 (Introduction to Ethical Hacking) foundations: the elements of information security, EC-Council's five-category attack classification, the hacker-class taxonomy, and the three threat categories every candidate must recognize.
| Concept | Example | Description | |
|---|---|---|---|
Encryption protects confidentiality hashing protects integrity redundancy protects availability | • The three core elements of information security. • Confidentiality: only authorized parties can read data • Integrity: data is not altered without authorization • Availability: systems and data are accessible when needed | ||
A digital signature confirms a file genuinely came from its claimed sender | • Assurance that a message, file, or user genuinely is what it claims to be • Confirms origin and identity, not accountability • Not to be confused with non-repudiation, which proves an action cannot be denied later | ||
A timestamped digital signature stops a signer denying they approved a payment | • Protection against someone falsely denying they performed an action • Guarantees a party cannot deny sending a message or making a transaction • Often confused with authenticity (which only proves identity, not deniability) | ||
Sniffing traffic on open Wi-Fi traffic analysis eavesdropping | • Monitoring or intercepting communication without altering data • Targets confidentiality and is hard to detect because the system is unchanged • Not to be confused with active attacks, which modify data | ||
Man-in-the-middle altering a transaction DoS masquerade | • Modifying, disrupting, or destroying data or services through direct interaction with the target • Affects integrity and availability and is easier to detect than a passive attack | ||
Shoulder surfing a PINdropping a malicious USBevil twin Wi-Fi | • An attack requiring physical proximity to the target • The attacker must be near the person, system, or facility • Bypasses digital defenses by exploiting physical security gaps | ||
A disgruntled employee leaks or deletes confidential records | • An attack by someone with authorized access who misuses their privileges • Hardest category to detect because the actor is already trusted and has bypassed authentication | ||
Malware pre-installed on software or modified hardware before delivery | • Tampering with hardware or software during the supply chain or distribution stage, so the system is compromised before it reaches the user • Also called a supply-chain attack | ||
Breaching a network to steal data or deploy ransomware for profit | • A malicious hacker who attacks without authorization for personal, financial, or political gain • Defined by lack of consent plus harmful intent | ||
A penetration tester probing a client network under a signed contract | • An ethical hacker who works with full consent of the target to find and fix vulnerabilities • Also called an ethical hacker • the role the CEH credential certifies | ||
Probing a public system uninvited, then reporting the flaw found | • A hacker in the moral middle: acts without explicit authorization but lacks black-hat malice • The defining gap is missing consent, not intent | ||
A novice running a downloaded exploit tool without understanding it | • An unskilled attacker who relies on pre-written tools and scripts rather than writing their own exploits • Distinguished from a skilled hacker by lack of expertise, not intent | ||
Defacing a government site or DDoS to protest a political cause | • A hacker motivated by a political, social, or ideological cause rather than money • Treats attacks as a form of protest or civil disobedience | ||
A nation-state team breaching another country's critical infrastructure | • A hacker funded and directed by a government to conduct espionage or cyber warfare • The most resourced and persistent class because of state backing | ||
Crashing critical infrastructure for a cause despite certain capture | • A hacker who aims to bring down a target for a cause and is not concerned with the consequences, including arrest or prison • Defined by indifference to repercussions | ||
Attacking critical systems to spread fear for an ideological aim | • A hacker driven by religious or ideological beliefs who seeks to cause large-scale fear, disruption, or harm • Distinguished from a hacktivist by intent to cause mass damage, not just protest | ||
Network: MITM, DoS Host: malware, privilege escalation Application: SQL injection, XSS | • EC-Council groups information security threats into three categories by target • Not to be confused with a fourth "system" category, which is not an EC-Council threat category |