48. CEH v13 Exam Modules Map and Practice Questions
48.4 Modules 11–15 Map (Session Hijacking through SQL Injection)
Web-heavy cluster. OWASP + sessions + SQLi. He cluster CEH + job donhi madhe weighty.
Module 11 – Session Hijacking
Book: ch41 (Session Hijacking – Tokens, Cookies and Defence).
Focus: cookie/token theft ideas on clear HTTP; fixation themes at awareness level.
Blue: HTTPS, Secure/HttpOnly/SameSite, regenerate session ID at login, short idle timeout.
Module 12 – Evading IDS, Firewalls, and Honeypots
Book: ch42 (Evading IDS, Firewalls and Honeypots), ch32 (Linux and Network Hardening).
Focus: why attackers fragment/encode/slow-scan in concept; defenders still win with layers.
Blue: IDS/IPS tuning, egress filter, honeypot isolation, Suricata-style awareness, least open ports.
Module 13 – Hacking Web Servers
Book: ch07, ch08 (Apache/Nginx install and config), ch21 (Web Application Testing Tools).
Focus: misconfig, default pages, verbose errors, outdated server banners – OWN stack.
Blue: patch httpd/nginx, hide versions where sensible, tight file perms, sudo service httpd restart after tested config.
Module 14 – Hacking Web Applications
Book: ch21, ch29 (OWASP Top 10).
Focus: XSS, broken access control/IDOR, SSRF, security misconfig – fix then re-verify on DVWA/Juice OWN.
Blue: output encoding + CSP, authZ checks, allow-lists, disable debug, secrets out of repos.
Module 15 – SQL Injection
Book: ch10, ch11 (MySQL), ch29 (OWASP SQLi class).
Focus: why string-concat SQL is dangerous; prepared statements as the fix; lab proof only.
Blue: parameterised queries, least-privilege DB user, WAF as layer (not only layer), error messages generic.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Steals session cookie on clear HTTP lab demo | HTTPS + cookie flags; session regenerate on login |
| Explains SQLi on OWN DVWA order field | PDO/mysqli prepared statements; re-test until old OR-style input fails |
| Noise against public IDS "to practise evasion" | Only OWN lab; production = report + improve rules |
Ravindra Bagale's Tip
In Module 15 answers, don't paste a real OR payload, not even on an exam cheat-sheet – keep it conceptual: "a quoted OR condition that changes the WHERE clause". The interviewer looks at the fix. Got it?
Ravindra Bagale's Tip – मराठी
Module 15 answers मध्ये real OR payload paste करू नका, exam cheat-sheet वर पण नाही – conceptual: "a quoted OR condition that changes the WHERE clause". Interviewer fix बघतो. समजले का?
Ravindra Bagale's Tip – हिंदी
Module 15 answers में real OR payload paste मत करो, exam cheat-sheet पर भी नहीं – conceptual: "a quoted OR condition that changes the WHERE clause". Interviewer fix देखता है. समझ आया?
Lab
Sahyadri OWN 192.168.56.50 PHP lookup: break it with concat SQL (lab), then fix with prepared statements. From Kali prove the old input no longer returns all rows. Screenshot weak → fixed for Module 15 revision.