CEH Practical is a 6 hours lab-based practical exam that includes a set of challenges with Web, Host, Forensic, and Network. The exam took place in iLabs, where we are provided two machines; Kali Linux and windows server 2016 for solving the challenges and 4 more servers (linux+Windows) where challenges are hosted. A total of 20 questions are provided to us, a few of them are (Multiple Choice Question) MCQ, and the rest of them require us to submit the flag or information asked. In order to pass the exam, all we need to do is to secure 70% marks which means to solve 14 questions. The challenges are intermediate level except for 1/2 question.
I got a partial scholarship for CEH Practical exam and planned to give it a try. Despite poor internet and unstable laptop, I took the risk and attempted the exam and passed. If you have an Internet speed of fewer than 5 Mbps then I don’t suggest you go for it because their Kali Linux instance sucks, responds very slow which is certainly an irritating experience.
I am not pinpointing the issues and the type of the challenge but here are some key things you need to know.
Tools to know about:
- Nmap – Nmap is love and it is the fulcrum.
- Hydra – To bruteforce passwords.
- Wp-scan – Scanning and extracting information from a WordPress site.
- John the ripper – Another password cracking tool with huge use.
- Sqlmap – SQL injection exploitation tool
- Rainbow Crack – Password cracking using tainbow tables.
- Wireshark – Network Packet Analysis tool.
- Openstego – Steganography tool to extract information from files.
- Veracrypt – Disc encryption utility.
- Hash Calc – A tool to calculate md5 checksum of the file for verifying integrity.
Terms to be familiar with:
- Wireshark packet analysis (Detecting DOS/RAT/HTTP)
- Cracking NTLM hashes
- SQL injection (Authenticated)
- Blind SQL injection
- WordPress user enumeration
- Password Bruteforce
- User enumeration in windows
- Insecure Direct Object Reference (IDOR)
- FTP Cracking
- Damn Vulnerable Web Application (DVWA)
- Simple Network Management Protocol (SNMP) enumeration
If you are familiar with Kali Linux and play CTF (Capture the flag) challenges regularly then I bet you will finish this 6-hour exam in less than 90 minutes.
Personal Opinion: It’s an easy exam.
Pro Tip: Enumeration/Network scanning is the key.
Unpopular Tip: Go for CompTIA Pentest+ instead.
Feel Free to personally message me, I will be glad enough to help you regarding the certification.
Hello,
I got the scholarship from EC Council and intend to take the exam at the beginning of June 2021. I went through the ilabs platform but it is so bulky that it is difficult to keep everything in memory.
I would like to have some detailed help how to proceed with the preparation.
Hi Aneerav,
I am not sure about the Ilab stuff but the information about the tools I have mentioned are quite useful for CEH exam, have information about their usage first, and feel free to DM me.
Regards,
Smaran