CEH v13 AI Master | Certified Ethical Hacker + CEH Practical Live Online in Patna

The first module of the CEH v13 AI course explains what information security protects, how attackers operate, and where a Certified Ethical Hacker stands within the law.

• Elements of information security, classes of attack and types of hacker
• The CEH ethical hacking framework, the Cyber Kill Chain and MITRE ATT&CK
• AI-driven ethical hacking and ChatGPT-based tools for security testers
• Risk management, the threat intelligence lifecycle and incident management
• Laws and standards such as PCI DSS, HIPAA, SOX, GDPR and the DPA

This is the pre-attack phase of ethical hacking. You collect as much public information about a target as you can before you touch its systems.

• Advanced search engine techniques, people search services and dark web footprinting
• WHOIS lookups, DNS footprinting, traceroute analysis and email footprinting
• Competitive intelligence and footprinting through social networking sites
• Lab work: footprint a target with search engines, internet research services and AI-powered OSINT tools

You learn how to find live hosts, open ports and running services on a network, and how defenders notice the same scans.

• Host discovery and port scanning, including scans driven by AI
• Service version detection, OS discovery and banner grabbing
• Scanning beyond IDS and firewalls
• Network scan detection and prevention

Enumeration turns scan results into detail you can use, such as user names, shares and service information. The module also covers the countermeasures.

• NetBIOS, SNMP, LDAP, NTP, NFS and SMTP enumeration
• DNS cache snooping and DNSSEC zone walking
• IPsec, VoIP, RPC, SMB and Unix/Linux user enumeration
• Enumeration using AI, followed by enumeration countermeasures

Here you learn to find security loopholes in a target organisation's network, communication infrastructure and end systems, and to report them clearly.

• Vulnerability classification, scoring systems and vulnerability databases
• The vulnerability management lifecycle and vulnerability research
• Scanning with vulnerability assessment tools, including AI-powered ones
• Reading and producing vulnerability assessment reports

With eight lab objectives, this is the most practical module in the official outline. It follows an attack from the first cracked password to the removal of evidence.

• Password cracking and exploitation with the Metasploit Framework and AI-powered exploitation tools
• Buffer overflow attacks and Active Directory enumeration
• Privilege escalation on Windows and Linux
• Keyloggers, spyware, rootkits, steganography and steganalysis
• Persistence, post-exploitation, clearing logs and covering tracks

You study how malicious software is built and spread, then take samples apart to see what they do.

• Trojans, viruses, worms, ransomware and fileless malware
• The APT lifecycle and AI-based malware
• Static and dynamic malware analysis
• Virus detection methods, anti-Trojan software and AI-powered malware detection and analysis tools

Packet sniffing shows what is really travelling across a network. You practise the attacks and then learn how to detect and stop them.

• MAC flooding, DHCP starvation, ARP spoofing and ARP poisoning
• MAC spoofing, VLAN hopping, STP attacks and DNS poisoning
• Lab work: run a man-in-the-middle attack and capture traffic with sniffing tools
• Sniffer detection and tools that find interfaces in promiscuous mode

Many breaches begin with a person and not a server. This module covers how attackers manipulate people and how to audit that weakness in an organisation.

• Human-based, computer-based and mobile-based social engineering techniques
• Phishing, phishing tools and how to detect a phishing attack
• Impersonation, including impersonation using AI, and identity theft
• Social engineering countermeasures and anti-phishing toolbars

You learn how DoS and DDoS attacks take a service offline, and how to recognise an attack and protect against it.

• DoS and DDoS attack techniques
• Botnets and DoS/DDoS attack toolkits
• Lab work: run DoS and DDoS attacks against a target host in the lab
• DoS/DDoS detection techniques, protection tools and protection services

Session hijacking exposes weaknesses in session management, authentication, authorisation and cryptography at both the application and the network level.

• Application-level session hijacking and compromising session IDs
• Network-level, TCP/IP, RST and blind hijacking
• Session hijacking tools
• Detection methods, detection tools and approaches to prevention

This module looks at perimeter defences from both sides: how they work, how attackers get past them, and how to close the gaps.

• How IDS, IPS and the different types of firewall work
• IDS and firewall evasion, plus NAC and endpoint security evasion
• Honeypot types and tools, including deploying a honeypot to catch malicious traffic
• Lab work: bypass firewall rules with tunnelling and bypass antivirus
• Countermeasures against IDS and firewall evasion

You learn a structured methodology for auditing web server infrastructure, from reconnaissance through to hardening.

• Web server architecture, vulnerabilities and attacks
• DNS server hijacking and web cache poisoning
• Footprinting, banner grabbing, directory brute forcing and vulnerability scanning
• Web server password hacking, and web server hacking using AI
• Countermeasures, attack detection and web server security tools

Web applications get a module of their own, built around the OWASP Top 10 (2021) and a step-by-step web application hacking methodology.

• Footprinting web infrastructure and analysing web applications
• Bypassing client-side controls and attacking access controls
• Web services, web APIs, webhooks and the web API hacking methodology
• Web application security testing, fuzz testing and encoding schemes
• Lab work: web spidering, vulnerability scanning and web application hacking using AI

A full module on SQL injection, covering how to find it, exploit it and prevent it.

• Error-based, union-based and blind (inferential) SQL injection
• The SQL injection methodology: information gathering, vulnerability detection and launching the attack
• Advanced SQL injection, SQL injection tools and SQL injection with AI
• Evasion techniques, countermeasures and SQL injection detection tools

You learn how Wi-Fi networks are secured, where that security breaks, and how to audit a wireless environment.

• Wireless standards, wireless encryption and wireless threats
• The wireless hacking methodology: Wi-Fi discovery and wireless traffic analysis
• Lab work: crack a WPA2 network and create a rogue access point
• Wireless attack countermeasures and Wi-Fi security auditing tools

This module covers mobile attack vectors on Android and iOS, mapped to the OWASP Top 10 Mobile Risks (2024).

• The anatomy of a mobile attack and app sandboxing issues
• SMiShing, call spoofing, OTP and two-factor hijacking, and camera or microphone capture
• Android rooting and Android hacking, including exploiting a device through ADB
• iOS jailbreaking and iOS hacking
• Mobile Device Management (MDM), mobile security guidelines and security tools

Connected devices and industrial control systems bring risks of their own. You learn how these systems are attacked and how they are secured.

• IoT architecture, technologies and protocols, and the OWASP Top 10 IoT threats
• The IoT hacking methodology, including capturing and analysing device traffic
• IT/OT convergence (IIoT), OT technologies and OT protocols
• OT vulnerabilities, threats and attacks, and the OT hacking methodology
• IoT and OT hacking tools and security tools

The module covers cloud concepts such as containers and serverless computing, then moves on to cloud threats, attacks and security techniques.

• Containers, Docker, Kubernetes and serverless computing
• The OWASP Top 10 Cloud Security Risks, and container and Kubernetes vulnerabilities
• AWS, Microsoft Azure and Google Cloud hacking, and container hacking
• Lab work: enumerate and exploit open S3 buckets, and escalate IAM privileges through a misconfigured policy
• Cloud network security, cloud security controls and cloud security tools

The final official module explains how data is protected with encryption and how weak cryptography is broken.

• Ciphers, symmetric and asymmetric encryption algorithms, and message digest functions
• Public Key Infrastructure (PKI), signed certificates and digital signatures
• Email encryption and disk encryption
• Cryptanalysis methods, cryptography attacks and cryptanalysis tools
• Blockchain, quantum cryptography and quantum computing attacks, with a lab on cryptography using AI

This is an exam, not a 21st module. EC-Council describes it as 20 practical challenges in 6 hours on the iLabs Cyber Range, using live virtual machines, networks and applications. Passing it after the knowledge exam earns CEH Master.

• Network scanning, OS banner grabbing, and service and user enumeration
• Vulnerability analysis of the target network, communication infrastructure and end systems
• System hacking, steganography, steganalysis, covering tracks and the use of malware
• Packet sniffing and different types of cryptography attacks
• Web server and web application attacks such as directory traversal, parameter tampering, XSS and SQL injection