48. CEH v13 Exam Modules Map and Practice Questions
48.9 Red vs Blue, Project and Real Incidents
Shevtat purple loop – CEH exam-module revision target OWN lab. Ethics closer. Chala finish kara!
CEH practice project = map two modules → build weak → awareness proof from Kali host-only → fix → re-verify. Real incidents = known facts only, say reported.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Uses exam-module names to excuse illegal scans | Scope paper + host-only; refuses cafe/client targets |
| Demonstrates SQLi/session themes only on OWN VM | Prepared statements; HTTPS cookies; SG least privilege; re-verify |
| Quotes breach stats from memory without sources | Well-known public facts; "reported"; control lesson |
Ravindra Bagale's Tip
In CEH prep, don't "dump 20 modules in one night". 2 modules a day + 1 lab tick. In interviews, don't rattle off module numbers – give a Blue control + your OWN story. This wins. Remember this.
Ravindra Bagale's Tip – मराठी
CEH prep मध्ये "20 modules dump in one night" – नको. रोज 2 modules + 1 lab tick. Interview मध्ये module number पटापट सांगू नका – Blue control + OWN story. हे जिंकते. लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
CEH prep में "20 modules dump in one night" – नहीं. रोज़ 2 modules + 1 lab tick. Interview में module number मत गिनाओ – Blue control + OWN story. यही जिताता है. याद रखो.
Lab
Complete the Project box below. Then answer aloud in clean English: "Which CEH modules did this project touch, and what did Blue change?" Record once; delete if it contains any real org names.
Project: Build it, hack it, fix it
Build: For fictional Sahyadri Traders (Pune) on YOUR host-only VM 192.168.56.50, deploy a tiny PHP+MySQL (or SQLite) product-price lookup that deliberately (1) uses string-concat SQL (Module 15), (2) serves the app on clear HTTP with a session cookie missing HttpOnly/Secure (Module 11), (3) leaves SSH password auth on and port 22 open to the lab segment (Module 06 awareness), (4) runs an older unpatched package you will later update (Module 05/13 mindset). Amazon Linux theme: sudo yum install httpd php mysql (or mariadb-server) then sudo service httpd start / sudo service mysqld start (Ubuntu notes: apt + sudo service apache2 start). Snapshot pre-ceh-weak. Hack (lab only / exam English): From Kali 192.168.56.10, gentle nmap -sS -T2 -p 22,80,443,3306 192.168.56.50 (Modules 03–04 awareness). Explain how a quoted OR condition on the price field can change the WHERE clause; show the session cookie readable on clear HTTP; note open SSH as a hardening gap. Never attack Sahyadri’s real suppliers, never flood (Module 10), never crack neighbour Wi-Fi (Module 16). Fix: PDO/mysqli prepared statements; lab HTTPS or at least document why production needs TLS; cookie HttpOnly/Secure; SSH keys only; sudo yum update -y for the stack; firewall allow 80/443/22 only from 192.168.56.10; MySQL bind localhost; sudo service httpd restart after config test. Re-verify: old SQLi-style input fails; DB port closed from Kali; cookie flags present; SSH password auth off. Exam / interview closer: "This mapped CEH modules 03, 06, 11, 13, 15 on my OWN Sahyadri lab – CEH study is not permission to hack systems without written authorisation."
Real incident: Equifax breach (2017)
Public reporting (US congressional materials, company statements, and major press) described attackers exploiting a known vulnerability in an internet-facing web component (Apache Struts – a patch was available before the intrusion window, as reported) with large volumes of personal data accessed afterward. Weakness themes: unpatched edge software + detection lag. CEH map: Modules 05, 13, 14 – vulnerability analysis and web server/app hygiene. Defence mindset: inventory internet-facing apps, patch SLAs, monitor. Source: Equifax public statements and contemporaneous major reporting (verify; say "reported" for record counts – no invented numbers here).
Real incident: WannaCry (2017)
Public reporting described a worldwide ransomware worm that abused a Windows SMB-related vulnerability (EternalBlue class, as widely reported), affecting organisations that had not applied available patches / compensating controls, including high-profile disruption in healthcare and other sectors as reported. Weakness themes: unpatched internet-reachable SMB exposure + wormable malware. CEH map: Modules 06, 07, 04/03 (service exposure). Defence mindset: patch, disable SMBv1 where appropriate, segment, backups, and never run worm demos outside isolated labs. Source: major vendor/CERT advisories and investigative reporting (verify; say "reported").
Thodkyaat sangaycha tar
- CEH v13 = 20 exam modules – this chapter maps each to book chapters + one Blue control (never treat the map as permission to hack).
- Modules 01–05: ethics, footprint, scan, enum, vuln analysis → ch17–ch20, ch34–ch37 (+ networking ch01–03).
- Modules 06–10: system hacking, malware, sniff, social, DoS → ch22–ch28, ch39–ch40.
- Modules 11–15: session, evasion, web server, web app, SQLi → ch41–ch42, ch07–ch08, ch21, ch29, ch10–ch11.
- Modules 16–20: wireless, mobile, IoT/OT, cloud, crypto → ch25, ch44, ch43, ch30 (+ AWS foundation), ch33.
- Practice: 50 CEH-style questions (Q1–Q25 Set A, Q26–Q50 Set B) – conceptual/defensive answers in clean English.
- Project Build-Hack-Fix for Sahyadri = Modules 03/06/11/13/15 on host-only
192.168.56.x. - Real incidents (Equifax (2017), WannaCry (2017)) = patch + exposure lessons — known facts only.
- Next: cheat sheets, Marathi glossary, About the Author (still ethics first).
Samjla ka? CEH v13 exam-module map ani practice questions complete – 20 modules mapped, Blue controls clear, OWN lab only. Pudhe **cheat sheets**, mag glossary ani About the Author. Chala revise kara, mitrano!