Free CEH Exam Flashcards

Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Clearing Tracks. Order matters: information gathering always precedes exploitation, and covering tracks is the final step to avoid detection.

Black box = tester has no prior knowledge (simulates an outside attacker). White box = full knowledge of the environment. Gray box = partial knowledge, simulating an insider or a low-privilege user.

Confidentiality (only authorized access), Integrity (data is unaltered/trustworthy), Availability (systems accessible when needed). Most attacks map to compromising one of these three pillars.

Ethical hacking is legal only with written authorization defining scope, targets, timing, and methods. Without it, the same activity is an offense under laws like the US Computer Fraud and Abuse Act.

Passive recon gathers data without touching the target (WHOIS, OSINT, Google dorking, social media). Active recon directly probes the target (DNS queries, port scans), which can be logged and detected.

Using advanced search operators to find exposed data. Examples: site: limits to a domain, filetype: finds documents, inurl: matches URL strings, intitle: matches page titles. The GHDB catalogs known vulnerable queries.

A request that asks a DNS server to return all records for a zone. If a misconfigured server allows it to anyone, an attacker maps the entire internal namespace. Tools: dig axfr, nslookup, dnsrecon.

Scanning discovers live hosts, open ports, and services. Enumeration actively connects to those services to extract usernames, shares, and configuration data (e.g., SNMP community strings, SMB shares, LDAP, NetBIOS).

SYN -> SYN/ACK -> ACK. A full-connect scan completes it; a SYN (half-open/stealth) scan sends SYN, reads SYN/ACK, then sends RST to avoid completing the connection and reduce logging.

-sS = SYN/stealth scan (default for privileged users). -sT = full TCP connect scan. -sU = UDP scan. -sV = service/version detection via banner probing. -O adds OS fingerprinting.

Connecting to a service to read its response banner, revealing software and version (e.g., telnet to port 80, netcat, Nmap -sV). Used to match a target version against known exploits.

A vulnerability assessment identifies and lists weaknesses (often automated, no exploitation). A penetration test actively exploits them to prove real-world impact and demonstrate exploitability.

Common Vulnerability Scoring System rates severity 0.0-10.0. Bands: Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0). Used to prioritize remediation.

Vertical = gaining higher privileges than granted (user to admin/root). Horizontal = accessing resources of another user at the same privilege level. Both follow initial access.

Dictionary tries a wordlist of likely passwords. Brute force tries every combination (slow but exhaustive). A rainbow table uses precomputed hash chains; a unique salt per password defeats it.

Authenticating with a captured NTLM hash instead of cracking the plaintext password. Works because Windows NTLM accepts the hash as proof of identity; mitigated by Credential Guard and least privilege.

Hiding data inside another file (image, audio, video) so its existence is concealed, unlike encryption which hides only the content. Used to exfiltrate data and evade DLP.

Malware that hides its presence and maintains privileged access by subverting the OS. Kernel-mode rootkits are the most dangerous and often require reimaging the system to fully remove.

A virus needs a host file and user action to spread. A worm is self-replicating and spreads across networks without user interaction, making it propagate far faster (e.g., Conficker, WannaCry).

Malware disguised as legitimate software that the user installs willingly. Unlike viruses/worms it does not self-replicate; its goal is to deliver a payload such as a backdoor (RAT) or keylogger.

Malware that encrypts files and demands payment for the decryption key. Modern variants add double extortion: data is exfiltrated first, then victims are threatened with public leaks.

Malware that runs in memory using legitimate tools (PowerShell, WMI, living-off-the-land binaries) and writes little or nothing to disk, evading signature-based antivirus.

Static analysis inspects the sample without running it (strings, hashes, disassembly). Dynamic analysis executes it in a sandbox to observe behavior. Sandbox-aware malware may not detonate if it detects analysis.

Sending forged ARP replies so the attacker's MAC is mapped to the gateway's IP, placing the attacker in the path of traffic. Enables man-in-the-middle on a switched LAN. Mitigated by Dynamic ARP Inspection.

Overwhelming a switch's CAM table with bogus MAC addresses so it fails open and behaves like a hub, broadcasting frames to all ports for sniffing. Port security limits MACs per port to prevent it.

Passive sniffing works on a hub (all traffic visible, undetectable). Active sniffing is required on a switch and injects traffic (ARP poisoning, MAC flooding, DHCP attacks), which is detectable.

Phishing is mass, generic bait. Spear phishing is tailored to a specific person or org using researched details. Whaling specifically targets high-value executives (C-suite).

Pretexting = inventing a believable scenario to extract information (posing as IT support). Tailgating (piggybacking) = following an authorized person through a secured door without credentials.

It exploits human trust, authority, urgency, and helpfulness rather than software flaws. The primary defense is security awareness training, verification procedures, and a no-blame reporting culture.

DoS comes from a single source; DDoS uses many distributed compromised hosts (a botnet), making it harder to filter by source and far higher in volume.

Sending many SYN packets with spoofed sources and never completing the handshake, exhausting the target's half-open connection table. SYN cookies mitigate it without keeping per-connection state.

Taking over an authenticated session, typically by stealing or predicting a session token/cookie, so the attacker inherits the victim's authenticated state without needing credentials.

An IDS detects and alerts but does not block (out of band). An IPS sits inline and can drop malicious traffic. False negatives (missed attacks) are more dangerous than false positives.

A decoy system designed to attract and study attackers. Any interaction with it is suspicious by definition. Useful for early detection and threat intelligence, not for production service.

Packet fragmentation, encryption/tunneling, source-port manipulation, decoy scanning (Nmap -D), slow/low scans, and encoding payloads to avoid signature matches.

Injecting SQL through unsanitized input to read or alter the database. The definitive fix is parameterized queries (prepared statements); input filtering and least-privilege DB accounts are secondary defenses.

Union-based extracts data via UNION SELECT. Error-based reads data from DB error messages. Blind SQLi infers data from true/false responses (boolean) or response delays (time-based) when no output is shown.

Stored XSS persists in the database and hits every viewer. Reflected XSS bounces off the server in a crafted link. DOM-based XSS executes purely client-side via unsafe DOM manipulation.

Tricking an authenticated user's browser into sending an unwanted request to a trusted site. Defended with anti-CSRF tokens and SameSite cookies. Contrast with XSS, which executes attacker script.

Using ../ sequences in a path parameter to read files outside the web root (e.g., /etc/passwd). Mitigated by input validation and serving files through safe, canonicalized paths.

WEP (RC4, broken). WPA (TKIP, interim fix). WPA2 (AES-CCMP, long standard). WPA3 (SAE/Dragonfly handshake) resists offline dictionary attacks and adds forward secrecy.

A rogue access point broadcasting a legitimate SSID to lure clients into connecting, enabling man-in-the-middle and credential capture. Mitigated by WPA3, certificate-based 802.1X, and WIPS.

Wi-Fi Protected Setup's 8-digit PIN is validated in two halves, reducing brute-force effort dramatically (Reaver/Pixie Dust). Recommendation: disable WPS entirely.

Mobile risks center on insecure data storage, weak server-side controls, insecure communication, and reverse engineering. Rooting/jailbreaking removes OS sandbox protections an attacker relies on.

They often ship with default credentials, no patch mechanism, weak or no encryption, and long deployment lifetimes. Compromised IoT devices are commonly recruited into botnets (e.g., Mirai).

The provider secures the cloud (physical, hypervisor, host). The customer secures what is in the cloud (data, identity, configuration, access). Most cloud breaches stem from customer misconfiguration.

VMs are isolated by a hypervisor with separate kernels. Containers share the host kernel, so a container escape can compromise the host. Harden with namespaces, cgroups, and minimal images.

Symmetric uses one shared key (fast, e.g., AES) but has a key-distribution problem. Asymmetric uses a public/private key pair (e.g., RSA, ECC), solving key exchange but slower. TLS uses both.

Hashing is one-way and fixed-length (SHA-256), used for integrity and password storage. Encryption is reversible with a key, used for confidentiality. A hash cannot be 'decrypted'.

Signing a message hash with the sender's private key provides integrity, authentication, and non-repudiation. It does NOT provide confidentiality unless the message is also encrypted.