Your FREE CEH Flashcards 2026 – 200+ Cards

Confidentiality, Integrity, Availability — the three core goals of information security.

Ensuring only authorized people can access data; enforced by encryption and access control.

Ensuring data is accurate and unaltered; enforced by hashing and digital signatures.

Ensuring authorized users can access data and systems when needed; enforced by redundancy and backups.

Assurance that someone cannot deny an action; provided by digital signatures and logging.

A weakness or flaw in a system that could be exploited by a threat.

A potential danger — an attacker or malware — that could exploit a vulnerability.

The code or technique that actively takes advantage of a vulnerability.

The likelihood a threat exploits a vulnerability combined with the impact if it does.

Anything of value worth protecting — data, a server, a service, or a reputation.

Reconnaissance, Scanning, Gaining Access, Maintaining Access, Clearing Tracks.

Gathering information about the target before attacking.

Exploiting a weakness to get into a system, then escalating privileges.

Keeping the foothold with backdoors, rootkits, or new accounts.

Covering the trail — clearing logs, hiding files, disabling auditing.

An authorized, ethical hacker who tests systems with permission to improve security.

A malicious attacker who breaks into systems without authorization for harm or gain.

A hacker who probes systems without permission but without clear malicious intent.

An unskilled attacker who uses tools and exploits written by others.

An attacker motivated by a political or social cause.

Layering multiple independent controls so one failure doesn't expose the asset.

Lockheed Martin's 7 stages: recon, weaponization, delivery, exploitation, installation, C2, actions on objectives.

A knowledge base of real-world adversary tactics and techniques across the attack lifecycle.

A pentest where the tester has no prior knowledge of the target (external attacker view).

A pentest where the tester has full knowledge (architecture, source, credentials).

A pentest with partial knowledge, such as a standard user account.

The agreed scope, methods, timing, and limits of an authorized engagement.

A scan only identifies weaknesses; a penetration test actually exploits them.

Written permission and defined scope — the only thing separating a CEH from a criminal.

Payment Card Industry Data Security Standard — protects cardholder data.

U.S. law protecting the privacy and security of health information.

EU regulation governing personal-data privacy and protection.

International standard for an information security management system (ISMS).

Authentication, Authorization, Accounting.

A program that pays outside researchers for responsibly disclosed vulnerabilities.

Systematically gathering information to profile a target's network, people, and tech.

Gathering info with no direct contact — OSINT, WHOIS, DNS, Shodan, social media.

Interacting with the target directly — ping sweeps, port scans, banner grabbing.

Open-Source Intelligence — information gathered from publicly available sources.

Using search operators (site:, inurl:, intitle:, filetype:) to find exposed information.

A search engine that indexes Internet-connected devices and their open services.

A query returning domain/IP registration details (registrar, contacts, name servers).

Querying DNS records (A, MX, NS, TXT); a zone transfer can dump the whole zone.

Copying an entire DNS zone; if misconfigured, it leaks all records to an attacker.

A tool that gathers emails, subdomains, and hosts from public sources.

An OSINT tool that maps relationships between people, domains, and infrastructure.

The standard network scanner for host discovery, port scanning, and OS/version detection.

SYN → SYN/ACK → ACK — how a TCP connection is established.

Completes the full handshake — reliable but easily logged.

Sends SYN, never finishes the handshake — stealthier; the default for root.

Send unusual TCP flag combinations to slip past simple filters.

Probes connectionless services like DNS, SNMP, and DHCP.

Reading a service's response to identify its software and version.

Identifying the target operating system from network behavior.

Sending ICMP echo requests to a range to find live hosts.

Actively extracting users, shares, services, and config after scanning.

137–139 and 445 — enumerate Windows shares, users, and system names.

161 — default community strings ('public'/'private') can leak device config.

389 — enumerate directory objects: users, groups, and OUs.

Port 25 — VRFY/EXPN/RCPT TO can reveal valid email accounts.

123 — can reveal hosts and times that sync to a server.

2049 — network file shares that may be exported insecurely.

Shared 'passwords' for SNMP; defaults 'public' (read) and 'private' (write) are classic findings.

Reduce exposed ports and services — you can't attack a closed port.

A versatile tool to read/write network connections; banner grabbing and simple backdoors.

Old site versions revealing structure or data the target later removed.

Tracking email headers and read-receipts to map infrastructure and behavior.

A systematic review that identifies, classifies, and prioritizes weaknesses.

Common Vulnerability Scoring System — a 0–10 score rating a vulnerability's severity.

Common Vulnerabilities and Exposures — a public catalog of IDs for known vulnerabilities.

A finding flagged as a vulnerability that isn't actually exploitable.

Recovering passwords from hashes via dictionary, brute-force, hybrid, or rainbow tables.

Tries a wordlist of likely passwords against a hash or login.

Tries every possible combination until the password is found.

Combines a dictionary with appended numbers/symbols (e.g., Password123!).

A precomputed table of hashes used to reverse unsalted password hashes quickly.

Adding unique random data before hashing so identical passwords differ; defeats rainbow tables.

Authenticating with a captured NTLM hash without cracking the plaintext password.

Requesting service tickets and cracking them offline to recover service-account passwords.

Gaining higher access than granted — vertical (to admin) or horizontal (to another user).

Moving from a low-privilege account to administrator or root.

Moving sideways to another user's account at the same level.

Tricking a program into loading a malicious library to run attacker code.

Abusing a Linux root-owned binary with the setuid bit to gain root.

Malware that hides deep in the system (often the kernel) for stealthy privileged access.

User-mode hooks normal programs; kernel-mode runs with the highest privilege and is harder to detect.

Software or hardware that records keystrokes to capture passwords and input.

Malware that secretly collects information about a user or system.

Hiding data inside other data (e.g., within an image) to conceal its existence.

Deleting or altering log entries to cover the attacker's tracks.

Malicious software — viruses, worms, trojans, ransomware, spyware, rootkits, fileless.

Malware that attaches to a host file and needs user action to run and spread.

Self-propagating malware that spreads across networks with no user action.

Malware disguised as legitimate software that opens a hidden backdoor when run.

Malware that encrypts a victim's data and demands payment for the decryption key.

Ransomware that also steals data and threatens to leak it if no ransom is paid.

Malware that runs in memory using legitimate tools to evade disk-based detection.

Advanced Persistent Threat — a skilled, well-resourced adversary keeping long-term stealthy access.

Malicious code that executes when a specific condition (date/event) is met.

Inspecting malware without running it (strings, hashes, headers).

Running malware in a sandbox to observe its behavior.

A hidden method of bypassing authentication to regain access to a system.

Capturing and inspecting network traffic, often to harvest credentials or data.

A NIC mode that captures all traffic on a segment, not just frames addressed to it.

Passive works on hubs; active (ARP poisoning) is needed on switched networks.

A packet analyzer used to capture and inspect network traffic in detail.

A command-line packet capture tool for Unix/Linux.

Sending forged ARP replies to redirect LAN traffic through the attacker (on-path).

Dynamic ARP Inspection (DAI), static ARP entries, and encryption.

Overflowing a switch's CAM table so it fails open and broadcasts like a hub.

Port security — limit the number of MAC addresses per port.

Exhausting the DHCP pool, then offering an attacker-controlled gateway/DNS.

A switch feature that blocks rogue DHCP servers and starvation attacks.

Injecting false DNS records so victims resolve a name to an attacker's host.

Adds cryptographic signatures to DNS to prevent record forgery.

Secretly relaying or altering traffic between two parties (formerly man-in-the-middle).

Changing a device's MAC address to impersonate another or bypass filters.

Manipulating people into divulging info or actions that compromise security.

A fraudulent email that tricks the victim into revealing credentials or running malware.

Phishing targeted at a specific individual or organization.

Phishing that targets high-value executives.

Voice phishing — a social-engineering attack over a phone call.

SMS phishing — a social-engineering attack by text message.

Inventing a believable scenario to extract information from a target.

Following an authorized person through a secure door without credentials.

Posing as IT, a vendor, or an executive to gain trust and access.

Impersonating a trusted executive or vendor to authorize fraudulent payments.

An employee/contractor misusing authorized access to harm the organization.

Recurring security-awareness training plus phishing simulations.

Overwhelming a system so legitimate users can't access it.

A distributed DoS launched from many compromised machines (a botnet) at once.

A network of malware-infected 'zombie' hosts controlled by an attacker.

A protocol DoS that exhausts server state with half-open TCP connections.

A DoS that saturates the target's bandwidth (UDP/ICMP floods, amplification).

Low-volume valid-looking requests that exhaust app resources (e.g., Slowloris).

A defense that lets a server handle SYN floods without allocating state.

Taking over an authenticated session by stealing or predicting the session ID.

Planting a known session ID before the victim logs in, then reusing it.

Prevents JavaScript from reading a cookie — blunts cookie theft via XSS.

Ensures a cookie is only sent over HTTPS.

Intrusion Detection System — detects and alerts on suspicious traffic (passive).

Intrusion Prevention System — detects and blocks suspicious traffic inline (active).

A firewall that tracks connection state to allow only valid return traffic.

A decoy system that lures attackers away from real assets and records them.

A network of honeypots that mimics a real environment.

Fragmentation, encoding, and tunneling to break the signature an IDS looks for.

Probing which ports/services a firewall permits by manipulating TTLs.

The list of the most critical web application security risks.

Targeting server software/config — traversal, defaults, unpatched CVEs.

Using ../ to access files outside the intended web root.

Inserting malicious SQL into input so the database runs unintended commands.

Parameterized queries (prepared statements) plus input validation.

SQL injection where results come back in the same channel (union/error-based).

Inferring data via true/false (boolean) or response timing (time-based).

A classic SQLi payload that makes a WHERE clause always true to bypass login.

Injecting script into a trusted site that runs in another user's browser.

Malicious script persisted on the server and served to many users.

Malicious script echoed back from a request and run immediately.

XSS executed entirely in the browser via the page's own JavaScript.

Output encoding plus a Content Security Policy (CSP).

Forcing an authenticated user's browser to send an unwanted request to a trusted site.

Anti-CSRF tokens and SameSite cookies.

Running OS commands through unvalidated input.

Local/Remote File Inclusion — loading attacker-chosen files via input.

Server-Side Request Forgery — making the server request attacker-chosen URLs.

Failing to enforce what authenticated users may do — a top OWASP risk.

Insecure Direct Object Reference — accessing others' data by changing an ID.

Treating all user input as untrusted and checking it server-side.

Web Application Firewall — filters layer-7 attacks like injection and XSS.

A proxy/toolkit for intercepting and testing web application requests.

Tricking a cache into storing and serving a malicious response.

Tricking a user into clicking a hidden element via a transparent overlay/iframe.

Obsolete Wi-Fi encryption using RC4 with a weak, reused IV — completely broken.

Wi-Fi security using AES-CCMP; weak pre-shared keys are crackable offline.

Current Wi-Fi standard; SAE (Dragonfly) resists offline password cracking.

The WPA2 key exchange; capturing it enables an offline dictionary attack.

A suite for capturing handshakes and cracking WEP/WPA keys.

A rogue access point impersonating a legitimate SSID to capture traffic/credentials.

An unauthorized AP attached to a network, creating a backdoor.

Forging deauth frames to knock clients off so they reconnect (often to an evil twin).

Brute-forcing the 8-digit Wi-Fi Protected Setup PIN to recover the passphrase.

Sending unsolicited messages to a Bluetooth device.

Stealing data from a Bluetooth device without permission.

Taking control of a Bluetooth device to make calls or read data.

Key Reinstallation Attack against the WPA2 four-way handshake.

Searching for Wi-Fi networks while moving, to map and target them.

The list of the most critical mobile application security risks.

Removing an OS's built-in restrictions — also removes security protections.

Adding malware to a legitimate app and redistributing it.

Storing sensitive data (tokens, credentials) unprotected on a device.

Mobile Device Management — enforces policy, encryption, and remote wipe.

Bring Your Own Device — employees use personal devices for work.

Corporate-Owned, Personally Enabled device model.

Malware that draws a fake screen over a real app to steal input.

Internet of Things — networked physical devices, often with weak defaults.

Leading IoT risks: weak passwords, insecure services, no update mechanism.

Hard-coded/default passwords on IoT devices that are rarely changed.

Operational Technology — systems that monitor and control physical processes.

Industrial Control Systems / Supervisory Control and Data Acquisition.

OT flips the CIA triad to Availability → Integrity → Confidentiality (safety first).

Short-range IoT protocols that expand the wireless attack surface.

Isolating IoT/OT devices on separate networks as a key defense.

A reference architecture for segmenting ICS/OT network zones.

Provider secures the cloud; customer secures data, identities, and config.

Infrastructure as a Service — customer manages OS, apps, and data (the most).

Platform as a Service — provider manages the runtime; customer manages apps/data.

Software as a Service — provider manages almost everything (customer: data/access).

The leading cause of cloud breaches — e.g., a public storage bucket.

An object-storage bucket left readable to anyone — a classic cloud finding.

Stolen long-lived API keys let an attacker abuse cloud resources.

Using stolen cloud resources to mine cryptocurrency.

Packages an app with its dependencies, sharing the host OS kernel (e.g., Docker).

Breaking out of a container's isolation to reach the host or other containers.

Sensitive values (passwords, keys) used by pods — must be protected.

Running functions without managing servers; risks include over-permissioned roles.

Granting IAM roles only the minimum permissions needed.

Cloud Access Security Broker — enforces policy between users and cloud services.

One shared secret key encrypts and decrypts; fast (AES, DES/3DES).

A public/private key pair; encrypt with one key, decrypt with the other (RSA, ECC).

A one-way function producing a fixed-length digest (SHA-256); not reversible.

The current symmetric block-cipher standard (Rijndael); 128/192/256-bit keys.

An asymmetric algorithm whose security rests on factoring large numbers.

Elliptic Curve Cryptography — strong asymmetric security with smaller keys.

A key-exchange algorithm that derives a shared secret over an insecure channel.

A broken hash function — practical collisions make it unsafe for integrity.

A broken hash function — collision attacks exist; replaced by SHA-256/SHA-3.

A secure hash producing a 256-bit digest, widely used for integrity.

A hash signed with the sender's private key; proves integrity and authenticity.

Encrypt FOR someone with their public key; SIGN with your own private key.

Public Key Infrastructure — CAs, policies, and keys that issue digital certificates.

A file binding a public key to a verified identity, signed by a CA.

A trusted entity that issues and signs digital certificates.

Certificate Revocation List / Online Certificate Status Protocol — revocation checks.

Uses asymmetric crypto to exchange a fast symmetric session key (hybrid).

Exploits collision math to find two inputs with the same hash faster than brute force.

Encrypting identical blocks identically leaks patterns — avoid ECB.

Storing copies of cryptographic keys with a trusted third party for recovery.

Tools for email encryption and signing using public-key cryptography.

Protecting data at rest by encrypting the whole drive (e.g., BitLocker).

Unique random data added before hashing so equal passwords differ.

When two different inputs produce the same hash — a flaw in MD5/SHA-1.