1.2 The Five Phases of Ethical Hacking

Why the Five Phases Matter

EC-Council frames an attack as a repeatable five-phase methodology, and CEH v13 explicitly integrates AI assistance into each phase. Almost every later CEH domain — reconnaissance, scanning, enumeration, system hacking, evasion — is one of these phases studied in depth. Memorize the order and the intent of each phase: exam questions frequently describe an activity and ask you to classify it into the correct phase, or ask which phase comes next.

The Five Phases

Phase 1 — Reconnaissance (Footprinting)

Reconnaissance, also called footprinting, is information gathering. It divides into two sub-types:

• Passive reconnaissance — no direct interaction with the target's systems. Examples: public records, social media, search-engine data (Google dorking), WHOIS, DNS, Shodan. Very hard for the target to detect because the attacker never touches the target's infrastructure.
• Active reconnaissance — direct interaction such as DNS zone-transfer attempts, banner grabbing, or social engineering of employees. It yields richer data but is observable and can trigger alerts.

Phase 2 — Scanning

Scanning converts recon data into a concrete map: which hosts are alive (host discovery / ping sweeps), which ports are open, which services and versions run, and which known vulnerabilities exist. The canonical tool is Nmap; vulnerability scanners such as Nessus and OpenVAS automate the vuln-discovery step. Detective controls (IDS/IPS, NetFlow monitoring) are most effective here because scanning generates noticeable traffic.

Phase 3 — Gaining Access

This is exploitation — turning a discovered weakness into a foothold, then often escalating privilege from a normal user to root/administrator. Tools include the Metasploit Framework (exploit delivery), password crackers (Hydra online, John the Ripper/Hashcat offline), and injection tools (SQLmap). The exam tests why an exploit works and which control would have prevented it (patching, least privilege, input validation, MFA) — not exploit syntax.

Phase 4 — Maintaining Access (Persistence)

The attacker establishes persistence so a reboot or password change does not lock them out — via backdoors, rootkits, trojans, scheduled tasks, or rogue accounts — and may pivot to other hosts and establish command and control (C2). Endpoint detection and response (EDR) and file-integrity monitoring are the key countermeasures.

Phase 5 — Clearing Tracks (Covering Tracks)

The attacker performs anti-forensics to erase evidence: editing or deleting logs, timestomping (altering file timestamps), disabling auditing, and removing tools. Ethical hackers do not destroy client logs. Full, preserved logging supports the engagement report, lets the blue team validate detection, and maintains the client's forensic trail.

Mapping Phases to the 20 CEH Modules

The CEH v13 curriculum is 20 modules covering 550+ attack techniques, and they map cleanly onto the five phases: Module 1 (Introduction) sets context; Modules 2–4 (Footprinting, Scanning, Enumeration) are Recon + Scanning; Modules 5–6 (Vulnerability Analysis, System Hacking) plus 7–12 (Malware, Sniffing, Social Engineering, DoS, Session Hijacking, Evasion) drive Gaining/Maintaining/Clearing; Modules 13–20 (Web Servers, Web Apps, SQL Injection, Wireless, Mobile, IoT/OT, Cloud, Cryptography) are attack surfaces exercised across phases 2–4. Thinking in phases keeps the large blueprint coherent rather than a flat list of 20 modules.

Enumeration: The Bridge Between Scanning and Access

Between scanning and gaining access sits enumeration, an active extraction of detailed information from services the scan revealed — usernames, share names, group memberships, routing tables, and SNMP data. Where scanning answers what is open, enumeration answers what is behind it. Classic enumeration targets and ports include NetBIOS (137-139), SMB (445), SNMP (161 UDP), LDAP (389), SMTP (25), NTP (123), and DNS (53). A successful enumeration of valid usernames, for example, turns a blind password-spray into a targeted attack — which is exactly why it is the natural bridge to Phase 3.

Tools by Phase (Exam-Ready Summary)

Memorize a couple of representative tools per phase; CEH loves to give a tool name and ask which phase it belongs to, or vice versa.

Methodology Flow