So Sánh CEH v12 vs CEH v13 Phần 1
Chứng chỉ Certified Ethical Hacker (CEH) của EC-Council là một chứng chỉ uy tín trong lĩnh vực an ninh mạng. CEH v12 và CEH v13 là hai phiên bản khác nhau của chứng chỉ này, mỗi phiên bản có những cập nhật và thay đổi để phản ánh sự thay đổi của các mối đe dọa và công nghệ an ninh mạng. Dưới đây là so sánh chi tiết giữa CEH v12 và CEH v13:
1. Ngày phát hành và mức độ cập nhật
- CEH v12: Phát hành vào cuối năm 2022. Phiên bản này mang đến những thay đổi đáng kể với nội dung cập nhật tập trung vào các mối đe dọa và công cụ hiện đại.
- CEH v13: Phát hành vào năm 23 tháng 9 năm 2024. Phiên bản này tiếp tục phát triển, tích hợp các công nghệ mới, mối đe dọa và phương pháp phù hợp với những thách thức an ninh mạng hiện nay và mở rộng các kỹ thuật khai thác , tấn công dựa trên AI (sử dụng ChatGPT)
2. Cập nhật nội dung và chương trình học
- CEH v12:
- Tập trung vào học tập thực hành với CEH Practical, cung cấp yếu tố thực hành.
- Cập nhật các module bao gồm các công cụ, kỹ thuật và lỗ hổng bảo mật mới nhất, phản ánh chiến lược tấn công thực tế.
- Nhấn mạnh vào các vector tấn công mới nổi, bao gồm bảo mật đám mây, IoT và công nghệ vận hành (OT).
- Giới thiệu nền tảng học tập tương tác và hấp dẫn hơn.
- CEH v13 AI:
- Mở rộng phạm vi bảo mật đám mây và môi trường lai, phản ánh sự gia tăng sử dụng dịch vụ đám mây.
- Tăng cường tập trung vào phân tích malware và ransomware, giải quyết các mối đe dọa đang gia tăng.
- Cập nhật các module để bao gồm các tiến bộ mới nhất trong AI, ML và hack blockchain.
- Nhấn mạnh mạnh mẽ hơn vào tình báo mối đe dọa, phản ánh tầm quan trọng của các biện pháp an ninh mạng chủ động.
3. Phương pháp và cách tiếp cận học tập
- CEH v12:
- Khung học tập Learn, Certify, Engage, Compete: Hướng dẫn học viên qua các giai đoạn học tập, chứng nhận, tham gia thực tế và cạnh tranh (thông qua các thử thách Capture the Flag).
- Kết hợp lý thuyết, phòng lab thực hành và các thử thách hacking để củng cố kết quả học tập.
- CEH v13:
- Phát triển dựa trên khung của v12 nhưng được cải tiến để trở nên sống động hơn, tập trung nhiều vào AI nên còn được gọi là CEH v13 AI.
- Tích hợp môi trường thực tế để học tập thực hành.
- Nhấn mạnh hơn vào học tập liên tục với các tài nguyên được cập nhật thường xuyên để theo kịp các mối đe dọa mới nhất.
4. Cấu trúc và định dạng bài thi
- CEH v12:
- Bao gồm 125 câu hỏi trắc nghiệm.
- Thời gian: 4 giờ.
- Bài thi tập trung vào việc hiểu các công cụ, kỹ thuật tấn công.
- CEH v13:
- Giữ nguyên cấu trúc cơ bản với các cập nhật để phản ánh nội dung mới nhất.
- Có các bài tập thực hành nhiều hơn để chuẩn bị tốt hơn cho tình huống thực tế.
CEH v13 tiếp tục cải tiến và cập nhật để phù hợp hơn với thực tế an ninh mạng hiện nay, đặc biệt là với sự phát triển nhanh chóng của công nghệ và các mối đe dọa mới.
Sau đây CEH VIETNAM tiếp tục cung cấp bảng so sánh các module của CEH v12 và CEH v13 cùng những sự thay đổi.
| CEHv12 | CEHv13 |
|---|---|
| o Analyzing Malicious MS Office Documents | ▪ What is Sheep Dip Computer? |
| • Finding Suspicious Components | ▪ Antivirus Sensor Systems |
| • Finding Macro Streams | ▪ Introduction to Malware Analysis |
| • Dumping Macro Streams | ▪ Malware Analysis Procedure |
| • Identifying Suspicious VBA Keywords | ▪ Preparing Testbed |
| ▪ Dynamic Malware Analysis | ▪ Static Malware Analysis |
| o Port Monitoring | o File Fingerprinting |
| o Process Monitoring | o Local and Online Malware Scanning |
| o Registry Monitoring | o Performing Strings Search |
| o Windows Services Monitoring | o Identifying Packing/Obfuscation Methods |
| o Startup Programs Monitoring | o Finding the Portable Executables (PE) Information |
| o Event Logs Monitoring/Analysis | o Identifying File Dependencies |
| o Installation Monitoring | o Malware Disassembly |
| o Files and Folders Monitoring | o Analyzing ELF Executable Files |
| o Device Drivers Monitoring | o Analyzing Mach Object (Mach-O) Executable Files |
| o Network Traffic Monitoring/Analysis | o Analyzing Malicious MS Office Documents |
| o DNS Monitoring/Resolution | o Analyzing Suspicious PDF Document |
| o API Calls Monitoring | o Analyzing Suspicious Documents Using YARA |
| o System Calls Monitoring | ▪ Dynamic Malware Analysis |
| ▪ Virus Detection Methods | o Port Monitoring |
| ▪ Trojan Analysis: ElectroRAT | o Process Monitoring |
| o ElectroRAT Malware Attack Phases | o Registry Monitoring |
| • Initial propagation and Infection | o Windows Services Monitoring |
| • Deploying Malware | o Startup Programs Monitoring |
| • Exploitation | o Event Logs Monitoring/Analysis |
| • Maintaining Persistence | o Installation Monitoring |
| ▪ Virus Analysis: REvil Ransomware | o Files and Folders Monitoring |
| o REvil Ransomware Attack Stages | o Device Drivers Monitoring |
| • Initial Access | o Network Traffic Monitoring/Analysis |
| • Download and Execution | o DNS Monitoring/Resolution |
| • Exploitation | o API Calls Monitoring |
| • Lateral Movement / Defense Evasion and Discovery | o System Calls Monitoring |
| • Credential Access and Exfiltration / Command and Control | o Scheduled Tasks Monitoring |
| ▪ Fileless Malware Analysis: SockDetour | o Browser Activity Monitoring |
| o SockDetour Fileless Malware Attack Stages | ▪ Virus Detection Methods |
| • Pre-exploitation | ▪ Malware Code Emulation |
| • Initial infection | ▪ Malware Code Instrumentation |
| • Exploitation | ▪ Trojan Analysis: Coyote |
| • Post-exploitation | o Coyote Malware Attack Phases |
| • Client Authentication and C2 Communication After Exploitation | ▪ Virus Analysis: GhostLocker 2.0 |
| • Plugin Loading Feature | o GhostLocker 2.0 Malware Attack Phases |
| CEHv12 | CEHv13 |
|---|---|
| Malware Countermeasures | ▪ Fileless Malware Analysis: PyLoose |
| ▪ Trojan Countermeasures | o PyLoose Malware Attack Phases |
| ▪ Backdoor Countermeasures | ▪ AI-based Malware Analysis: FakeGPT |
| ▪ Virus and Worm Countermeasures | o FakeGPT Malware Attack Phases |
| ▪ Fileless Malware Countermeasures | Malware Countermeasures |
| Anti-Malware Software | ▪ Trojan Countermeasures |
| ▪ Anti-Trojan Software | ▪ Backdoor Countermeasures |
| ▪ Antivirus Software | ▪ Virus and Worm Countermeasures |
| ▪ Fileless Malware Detection Tools | ▪ Fileless Malware Countermeasures |
| ▪ Fileless Malware Protection Tools | ▪ AI-based Malware Countermeasures |
| ▪ Adware Countermeasures | |
| ▪ APT Countermeasures | |
| Anti-Malware Software | |
| ▪ Anti-Trojan Software | |
| ▪ Antivirus Software | |
| ▪ Fileless Malware Detection Tools | |
| ▪ Fileless Malware Protection Tools | |
| ▪ AI-Powered Malware Detection and Analysis Tools | |
| ▪ Endpoint Detection and Response (EDR/XDR) Tools | |
| Module 08: Sniffing | Module 08: Sniffing |
| Sniffing Concepts | Sniffing Concepts |
| ▪ Network Sniffing | ▪ Network Sniffing |
| ▪ Types of Sniffing | ▪ How a Sniffer Works |
| ▪ How an Attacker Hacks the Network Using Sniffers | ▪ Types of Sniffing |
| ▪ Protocols Vulnerable to Sniffing | o Passive Sniffing |
| ▪ Sniffing in the Data Link Layer of the OSI Model | o Active Sniffing |
| ▪ Hardware Protocol Analyzers | ▪ How an Attacker Hacks the Network Using Sniffers |
| ▪ SPAN Port | ▪ Protocols Vulnerable to Sniffing |
| ▪ Wiretapping | ▪ Sniffing in the Data Link Layer of the OSI Model |
| ▪ Lawful Interception | ▪ Hardware Protocol Analyzers |
| Sniffing Technique: MAC Attacks | ▪ SPAN Port |
| ▪ MAC Address/CAM Table | ▪ Wiretapping |
| ▪ How CAM Works | ▪ Lawful Interception |
| ▪ What Happens When a CAM Table Is Full? | Sniffing Technique: MAC Attacks |
| ▪ MAC Flooding | ▪ MAC Address |
| ▪ Switch Port Stealing | ▪ CAM Table |
| ▪ How to Defend against MAC Attacks | ▪ How CAM Works |
| CEHv12 | CEHv13 |
|---|---|
| Sniffing Technique: DHCP Attacks | ▪ What Happens when a CAM Table is Full? |
| ▪ How DHCP Works | ▪ MAC Flooding |
| ▪ DHCP Request/Reply Messages | ▪ Switch Port Stealing |
| ▪ DHCP Starvation Attack | ▪ How to Defend against MAC Attacks |
| ▪ Rogue DHCP Server Attack | Sniffing Technique: DHCP Attacks |
| ▪ How to Defend Against DHCP Starvation and Rogue Server Attacks | ▪ How DHCP Works |
| o MAC Limiting Configuration on Juniper Switches | ▪ DHCP Request/Reply Messages |
| o Configuring DHCP Filtering on a Switch | ▪ IPv4 DHCP Packet Format |
| Sniffing Technique: ARP Poisoning | ▪ DHCP Starvation Attack |
| ▪ What Is Address Resolution Protocol (ARP)? | ▪ Rogue DHCP Server Attack |
| ▪ ARP Spoofing Attack | ▪ DHCP Attack Tools |
| ▪ Threats of ARP Poisoning | ▪ How to Defend Against DHCP Starvation and Rogue Server Attacks |
| ▪ ARP Poisoning Tools | Sniffing Technique: ARP Poisoning |
| o Habu | ▪ What Is Address Resolution Protocol (ARP)? |
| ▪ How to Defend Against ARP Poisoning | ▪ ARP Spoofing Attack |
| ▪ Configuring DHCP Snooping and Dynamic ARP Inspection on Cisco Switches | ▪ Threats of ARP Poisoning |
| ▪ ARP Spoofing Detection Tools | ▪ ARP Spoofing/Poisoning Tools |
| Sniffing Technique: Spoofing Attacks | ▪ How to Defend Against ARP Poisoning |
| ▪ MAC Spoofing/Duplicating | ▪ Configuring DHCP Snooping and Dynamic ARP Inspection on Cisco Switches |
| ▪ MAC Spoofing Technique: Windows | ▪ ARP Spoofing Detection Tools |
| ▪ MAC Spoofing Tools | Sniffing Technique: Spoofing Attacks |
| ▪ IRDP Spoofing | ▪ MAC Spoofing/Duplicating |
| ▪ VLAN Hopping | ▪ MAC Spoofing Technique: Windows |
| ▪ STP Attack | ▪ MAC Spoofing Tools |
| ▪ How to Defend Against MAC Spoofing | ▪ IRDP Spoofing |
| ▪ How to Defend Against VLAN Hopping | ▪ VLAN Hopping |
| ▪ How to Defend Against STP Attacks | ▪ STP Attack |
| Sniffing Technique: DNS Poisoning | ▪ How to Defend Against MAC Spoofing |
| ▪ DNS Poisoning Techniques | ▪ How to Defend Against VLAN Hopping |
| o Intranet DNS Spoofing | ▪ How to Defend Against STP Attacks |
| o Internet DNS Spoofing | Sniffing Technique: DNS Poisoning |
| o Proxy Server DNS Poisoning | ▪ DNS Poisoning Techniques |
| o DNS Cache Poisoning | o Intranet DNS Spoofing |
| • SAD DNS Attack | o Internet DNS Spoofing |
| ▪ DNS Poisoning Tools | o Proxy Server DNS Poisoning |
| ▪ How to Defend Against DNS Spoofing | o DNS Cache Poisoning |
| CEHv12 | CEHv13 |
|---|---|
| Sniffing Tools | ▪ DNS Poisoning Tools |
| ▪ Sniffing Tool: Wireshark | ▪ How to Defend Against DNS Spoofing |
| o Follow TCP Stream in Wireshark | Sniffing Tools |
| o Display Filters in Wireshark | ▪ Wireshark |
| o Additional Wireshark Filters | o Follow TCP Stream in Wireshark |
| ▪ Sniffing Tools | o Display Filters in Wireshark |
| o RITA (Real Intelligence Threat Analytics) | o Additional Wireshark Filters |
| ▪ Packet Sniffing Tools for Mobile Phones | ▪ Sniffing Tools |
| Sniffing Countermeasures | Sniffing Countermeasures |
| ▪ How to Defend Against Sniffing | ▪ How to Defend Against Sniffing |
| ▪ How to Detect Sniffing | ▪ How to Detect Sniffing |
| ▪ Sniffer Detection Techniques | ▪ Sniffer Detection Techniques |
| o Ping Method | ▪ Promiscuous Detection Tools |
| o DNS Method | |
| o ARP Method | |
| ▪ Promiscuous Detection Tools | |
| Module 09: Social Engineering | Module 09: Social Engineering |
| Social Engineering Concepts | Social Engineering Concepts |
| ▪ What is Social Engineering? | ▪ What is Social Engineering? |
| ▪ Phases of a Social Engineering Attack | o Common Targets of Social Engineering |
| Social Engineering Techniques | o Impact of Social Engineering Attack on an Organization |
| ▪ Types of Social Engineering | o Behaviors Vulnerable to Attacks |
| ▪ Human-based Social Engineering | o Factors that Make Companies Vulnerable to Attacks |
| o Impersonation | o Why is Social Engineering Effective? |
| o Impersonation (Vishing) | ▪ Phases of a Social Engineering Attack |
| o Eavesdropping | ▪ Types of Social Engineering |
| o Shoulder Surfing | Human-based Social Engineering Techniques |
| o Dumpster Diving | ▪ Impersonation |
| o Reverse Social Engineering | ▪ Impersonation (Vishing) |
| o Piggybacking | ▪ Eavesdropping |
| o Tailgating | ▪ Shoulder Surfing |
| o Diversion Theft | ▪ Dumpster Diving |
| o Honey Trap | ▪ Reverse Social Engineering |
| o Baiting | ▪ Piggybacking |
| o Quid Pro Quo | ▪ Tailgating |
| o Elicitation | ▪ Diversion Theft |
| ▪ Computer-based Social Engineering | ▪ Honey Trap |
| o Phishing | ▪ Baiting |
| • Examples of Phishing Emails | ▪ Quid Pro Quo |
| CEHv12 | CEHv13 |
|---|---|
| • Types of Phishing | ▪ Elicitation |
| ✓ Spear Phishing | ▪ Bait and Switching |
| ✓ Whaling | Computer-based Social Engineering Techniques |
| ✓ Pharming | ▪ Phishing |
| ✓ Spimming | o Examples of Phishing Emails |
| ✓ Angler Phishing | o Types of Phishing |
| ✓ Catfishing Attack | o Phishing Tools |
| ✓ Deepfake Attacks | ▪ Crafting Phishing Emails with ChatGPT |
| o Phishing Tools | ▪ Other Techniques for Computer-based Social Engineering |
| ▪ Mobile-based Social Engineering | ▪ Perform Impersonation using AI: Create Deepfake Videos |
| o Publishing Malicious Apps | ▪ Perform Impersonation using AI: Voice Cloning |
| o Repackaging Legitimate Apps | ▪ Perform Impersonation on Social Networking Sites |
| o Fake Security Applications | ▪ Impersonation on Facebook |
| o SMiShing (SMS Phishing) | ▪ Social Networking Threats to Corporate Networks |
| Insider Threats | ▪ Identity Theft |
| ▪ Insider Threats/Insider Attacks | o Types of Identity Theft |
| ▪ Types of Insider Threats | o Common Techniques Attackers Use to Obtain Personal Information for Identity Theft |
| o Accidental Insider | o Indications of Identity Theft |
| ▪ Behavioral Indications of an Insider Threat | Mobile-based Social Engineering Techniques |
| Impersonation on Social Networking Sites | ▪ Publishing Malicious Apps |
| ▪ Social Engineering through Impersonation on Social Networking Sites | ▪ Repackaging Legitimate Apps |
| ▪ Impersonation on Facebook | ▪ Fake Security Applications |
| ▪ Social Networking Threats to Corporate Networks | ▪ SMiShing (SMS Phishing) |
| Identity Theft | ▪ QRLJacking |
| ▪ Identity Theft | Social Engineering Countermeasures |
| Social Engineering Countermeasures | ▪ Social Engineering Countermeasures |
| ▪ Social Engineering Countermeasures | ▪ How to Defend against Phishing Attacks? |
| ▪ How to Defend against Phishing Attacks? | ▪ Identity Theft Countermeasures |
| ▪ Detecting Insider Threats | ▪ Voice Cloning Countermeasures |
| ▪ Insider Threats Countermeasures | ▪ Deepfake Attack Countermeasures |
| ▪ Identity Theft Countermeasures | ▪ How to Detect Phishing Emails? |
| ▪ How to Detect Phishing Emails? | ▪ Anti-Phishing Toolbar |
| ▪ Anti-Phishing Toolbar | ▪ Common Social Engineering Targets and Defense Strategies |
| ▪ Common Social Engineering Targets and Defense Strategies | ▪ Audit Organization's Security for Phishing Attacks using OhPhish |
| ▪ Social Engineering Tools | |
| ▪ Audit Organization's Security for Phishing Attacks using OhPhish |
| CEHv12 | CEHv13 |
|---|---|
| Module 10: Denial-of-Service | Module 10: Denial-of-Service |
| DoS/DDoS Concepts | DoS/DDoS Concepts |
| ▪ What is a DoS Attack? | ▪ What is a DoS Attack? |
| ▪ What is a DDoS Attack? | ▪ What is a DDoS Attack? |
| Botnets | o How do DDoS Attacks Work? |
| ▪ Organized Cyber Crime: Organizational Chart | Botnets |
| ▪ Botnets | ▪ Organized Cyber Crime: Organizational Chart |
| ▪ A Typical Botnet Setup | ▪ Botnets |
| ▪ Botnet Ecosystem | ▪ A Typical Botnet Setup |
| ▪ Scanning Methods for Finding Vulnerable Machines | ▪ Botnet Ecosystem |
| ▪ How Does Malicious Code Propagate? | ▪ Scanning Methods for Finding Vulnerable Machines |
| DoS/DDoS Attack Techniques | ▪ How Does Malicious Code Propagate? |
| ▪ Basic Categories of DoS/DDoS Attack Vectors | DDoS Case Study |
| o Volumetric Attacks | ▪ DDoS Attack |
| • UDP Flood Attack | ▪ Hackers Advertise Links for Downloading Botnets |
| • ICMP Flood Attack | ▪ Use of Mobile Devices as Botnets for Launching DDoS Attacks |
| • Ping of Death and Smurf Attacks | ▪ DDoS Case Study: HTTP/2 'Rapid Reset' Attack on Google Cloud |
| • Pulse Wave and Zero-Day DDoS Attacks | DoS/DDoS Attack Techniques |
| o Protocol Attacks | ▪ Basic Categories of DoS/DDoS Attack Vectors |
| • SYN Flood Attack | ▪ DoS/DDoS Attack Techniques |
| • Fragmentation Attack | o UDP Flood Attack |
| • Spoofed Session Flood Attack | o ICMP Flood Attack |
| o Application Layer Attacks | o Ping of Death Attack |
| • HTTP GET/POST and Slowloris Attacks | o Smurf Attack |
| • UDP Application Layer Flood Attack | o Pulse Wave DDoS Attack |
| ▪ Multi-Vector Attack | o Zero-Day DDoS Attack |
| ▪ Peer-to-Peer Attack | o NTP Amplification Attack |
| ▪ Permanent Denial-of-Service Attack | o SYN Flood Attack |
| ▪ TCP SACK Panic | o Fragmentation Attack |
| ▪ Distributed Reflection Denial-of-Service (DRDoS) Attack | o Spoofed Session Flood Attack |
| ▪ DDoS Extortion/Ransom DDoS (RDDoS) Attack | o HTTP GET/POST Attack |
| ▪ DoS/DDoS Attack Tools | o Slowloris Attack |
| ▪ DoS and DDoS Attack Tools for Mobiles | o UDP Application Layer Flood Attack |
| DDoS Case Study | o Multi-Vector Attack |
| ▪ DDoS Attack | o Peer-to-Peer Attack |
| ▪ Hackers Advertise Links for Downloading Botnets | o Permanent Denial-of-Service Attack |
| ▪ Use of Mobile Devices as Botnets for Launching DDoS Attacks | o TCP SACK Panic Attack |
| ▪ DDoS Case Study: DDoS Attack on Microsoft Azure | o Distributed Reflection Denial-of-Service (DRDoS) Attack |
| CEHv12 | CEHv13 |
|---|---|
| DoS/DDoS Attack Countermeasures | o DDoS Extortion/Ransom DDoS (RDDoS) Attack |
| ▪ Detection Techniques | ▪ DoS/DDoS Attack Toolkits in the Wild |
| ▪ DoS/DDoS Countermeasure Strategies | DoS/DDoS Attack Countermeasures |
| ▪ DDoS Attack Countermeasures | ▪ Detection Techniques |
| o Protect Secondary Victims | ▪ DoS/DDoS Countermeasure Strategies |
| o Detect and Neutralize Handlers | ▪ DDoS Attack Countermeasures |
| o Prevent Potential Attacks | o Protect Secondary Victims |
| o Deflect Attacks | o Detect and Neutralize Handlers |
| o Mitigate Attacks | o Prevent Potential Attacks |
| o Post-Attack Forensics | o Deflect Attacks |
| ▪ Techniques to Defend against Botnets | o Mitigate Attacks |
| ▪ Additional DoS/DDoS Countermeasures | o Post-Attack Forensics |
| ▪ DoS/DDoS Protection at ISP Level | ▪ Techniques to Defend against Botnets |
| ▪ Enabling TCP Intercept on Cisco IOS Software | ▪ Additional DoS/DDoS Countermeasures |
| ▪ Advanced DDoS Protection Appliances | ▪ DoS/DDoS Protection at ISP Level |
| ▪ DoS/DDoS Protection Tools | ▪ Enabling TCP Intercept on Cisco IOS Software |
| ▪ DoS/DDoS Protection Services | ▪ Advanced DDoS Protection Appliances |
| ▪ DoS/DDoS Protection Tools | |
| ▪ DoS/DDoS Protection Services | |
| Module 11: Session Hijacking | Module 11: Session Hijacking |
| Session Hijacking Concepts | Session Hijacking Concepts |
| ▪ What is Session Hijacking? | ▪ What is Session Hijacking? |
| ▪ Why is Session Hijacking Successful? | ▪ Why is Session Hijacking Successful? |
| ▪ Session Hijacking Process | ▪ Session Hijacking Process |
| ▪ Packet Analysis of a Local Session Hijack | ▪ Packet Analysis of a Local Session Hijack |
| ▪ Types of Session Hijacking | ▪ Types of Session Hijacking |
| ▪ Session Hijacking in OSI Model | ▪ Session Hijacking in OSI Model |
| ▪ Spoofing vs. Hijacking | ▪ Spoofing vs. Hijacking |
| Application-Level Session Hijacking | Application-Level Session Hijacking |
| ▪ Application-Level Session Hijacking | ▪ Compromising Session IDs Using Sniffing |
| ▪ Compromising Session IDs using Sniffing and by Predicting Session Token | ▪ Compromising Session IDs by Predicting Session Token |
| o How to Predict a Session Token | o How to Predict a Session Token |
| ▪ Compromising Session IDs Using Man-in-the-Middle/Manipulator-in-the-Middle Attack | ▪ Compromising Session IDs Using Man-in-the-Middle/Manipulator-in-the-Middle Attack |
| ▪ Compromising Session IDs Using Man-in-the-Browser/Manipulator-in-the-Browser Attack | ▪ Compromising Session IDs Using Man-in-the-Browser/Manipulator-in-the- Browser Attack |
| o Steps to Perform Man-in-the-Browser Attack | ▪ Compromising Session IDs Using Client-side Attacks |
| ▪ Compromising Session IDs Using Client-side Attacks | ▪ Compromising Session IDs Using Client-side Attacks: Cross-site Script Attack |
| CEHv12 | CEHv13 |
|---|---|
| ▪ Compromising Session IDs Using Client-side Attacks: Cross-site Script Attack | ▪ Compromising Session IDs Using Client-side Attacks: Cross-site Request Forgery Attack |
| ▪ Compromising Session IDs Using Client-side Attacks: Cross-site Request Forgery Attack | ▪ Compromising Session IDs Using Session Replay Attacks |
| ▪ Compromising Session IDs Using Session Replay Attacks | ▪ Compromising Session IDs Using Session Fixation |
| ▪ Compromising Session IDs Using Session Fixation | ▪ Session Hijacking Using Proxy Servers |
| ▪ Session Hijacking Using Proxy Servers | ▪ Session Hijacking Using CRIME Attack |
| ▪ Session Hijacking Using CRIME Attack | ▪ Session Hijacking Using Forbidden Attack |
| ▪ Session Hijacking Using Forbidden Attack | ▪ Session Hijacking Using Session Donation Attack |
| ▪ Session Hijacking Using Session Donation Attack | Network-Level Session Hijacking |
| ▪ PetitPotam Hijacking | ▪ Three-way Handshake |
| Network-Level Session Hijacking | ▪ TCP/IP Hijacking |
| ▪ Network Level Session Hijacking | ▪ IP Spoofing: Source Routed Packets |
| ▪ TCP/IP Hijacking | ▪ RST Hijacking |
| ▪ IP Spoofing: Source Routed Packets | ▪ Blind Hijacking |
| ▪ RST Hijacking | ▪ UDP Hijacking |
| ▪ Blind and UDP Hijacking | ▪ MITM Attack Using Forged ICMP and ARP Spoofing |
| ▪ MiTM Attack Using Forged ICMP and ARP Spoofing | ▪ PetitPotam Hijacking |
| Session Hijacking Tools | Session Hijacking Tools |
| ▪ Session Hijacking Tools | Session Hijacking Countermeasures |
| o Hetty | ▪ Session Hijacking Detection Methods |
| ▪ Session Hijacking Tools for Mobile Phones | ▪ Protecting against Session Hijacking |
| Session Hijacking Countermeasures | ▪ Web Development Guidelines to Prevent Session Hijacking |
| ▪ Session Hijacking Detection Methods | ▪ Web User Guidelines to Prevent Session Hijacking |
| ▪ Protecting against Session Hijacking | ▪ Session Hijacking Detection Tools |
| ▪ Web Development Guidelines to Prevent Session Hijacking | ▪ Approaches to Prevent Session Hijacking |
| ▪ Web User Guidelines to Prevent Session Hijacking | ▪ Approaches to Prevent MITM Attacks |
| ▪ Session Hijacking Detection Tools | ▪ IPsec |
| ▪ Approaches Causing Vulnerability to Session Hijacking and their Preventative Solutions | ▪ Session Hijacking Prevention Tools |
| ▪ Approaches to Prevent Session Hijacking | |
| o HTTP Referrer Header | |
| ▪ Approaches to Prevent MITM Attacks | |
| o DNS over HTTPS | |
| o Password Manager | |
| o Zero-trust Principles | |
| ▪ IPsec | |
| o IPsec Authentication and Confidentiality | |
| ▪ Session Hijacking Prevention Tools |
| CEHv12 | CEHv13 |
|---|---|
| Module 12: Evading IDS, Firewalls, and Honeypots | Module 12: Evading IDS, Firewalls, and Honeypots |
| IDS, IPS, Firewall, and Honeypot Concepts | IDS, IPS, and Firewall Concepts |
| ▪ Intrusion Detection System (IDS) | ▪ Intrusion Detection System (IDS) |
| o How an IDS Detects an Intrusion? | o Intrusion Prevention System (IPS) |
| o General Indications of Intrusions | o How an IDS Detects an Intrusion? |
| o Types of Intrusion Detection Systems | o General Indications of Intrusions |
| o Types of IDS Alerts | o Types of Intrusion Detection Systems |
| ▪ Intrusion Prevention System (IPS) | o Types of IDS Alerts |
| ▪ Firewall | ▪ Firewall |
| o Firewall Architecture | o Firewall Architecture |
| o Demilitarized Zone (DMZ) | o Demilitarized Zone (DMZ) |
| o Types of Firewalls | o Types of Firewalls |
| o Firewall Technologies | • Types of Firewalls Based on Configuration |
| • Packet Filtering Firewall | • Types of Firewalls Based on Working Mechanism |
| • Circuit-Level Gateway Firewall | o Packet Filtering Firewall |
| • Application-Level Firewall | o Circuit-Level Gateway Firewall |
| • Stateful Multilayer Inspection Firewall | o Application-Level Firewall |
| • Application Proxy | o Stateful Multilayer Inspection Firewall |
| • Network Address Translation (NAT) | o Application Proxy |
| • Virtual Private Network | o Network Address Translation (NAT) |
| o Firewall Limitations | o Virtual Private Network |
| ▪ Honeypot | o Next-Generation Firewalls (NGFWs) |
| o Types of Honeypots | o Firewall Limitations |
| IDS, IPS, Firewall, and Honeypot Solutions | IDS, IPS, and Firewall Solutions |
| ▪ Intrusion Detection using YARA Rules | ▪ Intrusion Detection using YARA Rules |
| ▪ Intrusion Detection Tools | ▪ Intrusion Detection Tools |
| o Snort | ▪ Intrusion Prevention Tools |
| • Snort Rules | ▪ Firewalls |
| • Snort Rules: Rule Actions and IP Protocols | Evading IDS/Firewalls |
| • Snort Rules: The Direction Operator and IP Addresses | ▪ IDS/Firewall Evasion Techniques |
| • Snort Rules: Port Numbers | o IDS/Firewall Identification |
| • Intrusion Detection Tools | o IP Address Spoofing |
| o Intrusion Detection Tools for Mobile Devices | o Source Routing |
| ▪ Intrusion Prevention Tools | o Tiny Fragments |
| ▪ Firewalls | o Bypass Blocked Sites Using an IP Address in Place of a URL |
| o Firewalls for Mobile Devices | o Bypass Blocked Sites Using Anonymous Website Surfing Sites |
| ▪ Honeypot Tools | o Bypass an IDS/Firewall Using a Proxy Server |
| CEHv12 | CEHv13 |
|---|---|
| Evading IDS | o Bypassing an IDS/Firewall through the ICMP Tunneling Method |
| ▪ IDS Evasion Techniques | o Bypassing an IDS/Firewall through the ACK Tunneling method |
| o Insertion Attack | o Bypassing an IDS/Firewall through the HTTP Tunneling Method |
| o Evasion | o Bypassing Firewalls through the SSH Tunneling Method |
| o Denial-of-Service Attack (DoS) | o Bypassing Firewalls through the DNS Tunneling Method |
| o Obfuscating | o Bypassing an IDS/Firewall through External Systems |
| o False Positive Generation | o Bypassing an IDS/Firewall through MITM Attacks |
| o Session Splicing | o Bypassing an IDS/Firewall through Content |
| o Unicode Evasion Technique | o Bypassing an IDS/WAF using an XSS Attack |
| o Fragmentation Attack | o Other Techniques for Bypassing WAF |
| o Overlapping Fragments | o Bypassing an IDS/Firewall through HTML Smuggling |
| o Time-To-Live Attacks | o Evading an IDS/Firewall through Windows BITS |
| o Invalid RST Packets | ▪ Other Techniques for IDS Evasion |
| o Urgency Flag | o Insertion Attack |
| o Polymorphic Shellcode | o Evasion |
| o ASCII Shellcode | o Denial-of-Service Attack (DoS) |
| o Application-Layer Attacks | o Obfuscating |
| o Desynchronization | o False Positive Generation |
| o Other Types of Evasion | o Session Splicing |
| Evading Firewalls | o Unicode Evasion Technique |
| ▪ Firewall Evasion Techniques | o Fragmentation Attack |
| o Firewall Identification | o Time-To-Live Attacks |
| o IP Address Spoofing | o Urgency Flag |
| o Source Routing | o Invalid RST Packets |
| o Tiny Fragments | o Polymorphic Shellcode |
| o Bypass Blocked Sites Using an IP Address in Place of a URL | o ASCII Shellcode |
| o Bypass Blocked Sites Using Anonymous Website Surfing Sites | o Application-Layer Attacks |
| o Bypass a Firewall Using a Proxy Server | o Desynchronization |
| o Bypassing Firewalls through the ICMP Tunneling Method | o Domain Generation Algorithms (DGA) |
| o Bypassing Firewalls through the ACK Tunneling Method | o Encryption |
| o Bypassing Firewalls through the HTTP Tunneling Method | o Flooding |
| • Why do I Need HTTP Tunneling? | Evading NAC and Endpoint Security |
| • HTTP Tunneling Tools | ▪ NAC and Endpoint Security Evasion Techniques |
| o Bypassing Firewalls through the SSH Tunneling Method | ▪ Bypassing NAC using VLAN Hopping |
| • SSH Tunneling Tools: Bitvise and Secure Pipes | ▪ Bypassing NAC using Pre-authenticated Device |
| CEHv12 | CEHv13 |
|---|---|
| o Bypassing Firewalls through the DNS Tunneling Method | ▪ Bypassing Endpoint Security using Ghostwriting |
| o Bypassing Firewalls through External Systems | ▪ Bypassing Endpoint Security using Application Whitelisting |
| o Bypassing Firewalls through MITM Attacks | ▪ Bypassing Endpoint Security by Dechaining Macros |
| o Bypassing Firewalls through Content | ▪ Bypassing Endpoint Security by Clearing Memory Hooks |
| o Bypassing the WAF using an XSS Attack | ▪ Bypassing Endpoint Security by Process Injection |
| o Other Techniques for Bypassing WAF | ▪ Bypassing the EDR using LoLBins |
| • Using HTTP Header Spoofing | ▪ Bypassing Endpoint Security by CPL (Control Panel) Side-Loading |
| • Using Blacklist Detection | ▪ Bypassing Endpoint Security using ChatGPT |
| • Using Fuzzing/Bruteforcing | ▪ Bypassing Antivirus using Metasploit Templates |
| • Abusing SSL/TLS ciphers | ▪ Bypassing Windows Antimalware Scan Interface (AMSI) |
| o Bypassing Firewalls through HTML Smuggling | ▪ Other Techniques for Bypassing Endpoint Security |
| o Bypassing Firewalls through Windows BITS | IDS/Firewall Evading Tools |
| Evading NAC and Endpoint Security | ▪ Packet Fragment Generator Tools |
| ▪ Bypassing NAC using VLAN Hopping | Honeypot Concepts |
| ▪ Bypassing NAC using Pre-authenticated Device | ▪ Honeypot |
| ▪ Bypassing Endpoint Security using Ghostwriting | o Types of Honeypots |
| ▪ Bypassing Endpoint Security using Application Whitelisting | o Honeypot Tools |
| ▪ Bypassing Endpoint Security using XLM Weaponization | ▪ Detecting Honeypots |
| ▪ Bypassing Endpoint Security by Dechaining Macros | ▪ Detecting and Defeating Honeypots |
| ▪ Bypassing Endpoint Security by Clearing Memory Hooks | ▪ Honeypot Detection Tools |
| ▪ Bypassing Antivirus using Metasploit Templates | IDS/Firewall Evasion Countermeasures |
| ▪ Bypassing Symantec Endpoint Protection | ▪ How to Defend Against IDS Evasion |
| ▪ Other Techniques for Bypassing Endpoint Security | ▪ How to Defend Against Firewall Evasion |
| o Hosting Phishing Sites | ▪ How to Defend Against Endpoint Security Evasion |
| o Passing Encoded Commands | ▪ How to Defend Against NAC Evasion |
| o Fast Flux DNS Method | ▪ How to Defend Against Anti-virus Evasion |
| o Timing-based Evasion | |
| o Signed Binary Proxy Execution | |
| IDS/Firewall Evading Tools | |
| ▪ IDS/Firewall Evading Tools | |
| ▪ Packet Fragment Generator Tools | |
| Detecting Honeypots | |
| ▪ Detecting Honeypots | |
| o Detecting and Defeating Honeypots | |
| ▪ Honeypot Detection Tools: Send-Safe Honeypot Hunter | |
| IDS/Firewall Evasion Countermeasures | |
| ▪ How to Defend Against IDS Evasion | |
| ▪ How to Defend Against Firewall Evasion |
| CEHv12 | CEHv13 |
|---|---|
| Module 13: Hacking Web Servers | Module 13: Hacking Web Servers |
| Web Server Concepts | Web Server Concepts |
| ▪ Web Server Operations | ▪ Web Server Operations |
| ▪ Web Server Security Issues | ▪ Web Server Security Issues |
| ▪ Why are Web Servers Compromised? | ▪ Why are Web Servers Compromised? |
| Web Server Attacks | ▪ Apache Web Server Architecture |
| ▪ DNS Server Hijacking | o Apache Vulnerabilities |
| ▪ DNS Amplification Attack | ▪ IIS Web Server Architecture |
| ▪ Directory Traversal Attacks | o IIS Vulnerabilities |
| ▪ Website Defacement | ▪ NGINX Web Server Architecture |
| ▪ Web Server Misconfiguration | o NGINX Vulnerabilities |
| ▪ HTTP Response-Splitting Attack | Web Server Attacks |
| ▪ Web Cache Poisoning Attack | ▪ DNS Server Hijacking |
| ▪ SSH Brute Force Attack | ▪ DNS Amplification Attack |
| o Web Server Password Cracking | ▪ Directory Traversal Attacks |
| ▪ Other Web Server Attacks | ▪ Website Defacement |
| o DoS/DDoS Attacks | ▪ Web Server Misconfiguration |
| o Man-in-the-Middle Attack | ▪ HTTP Response-Splitting Attack |
| o Phishing Attacks | ▪ Web Cache Poisoning Attack |
| o Web Application Attacks | ▪ SSH Brute Force Attack |
| Web Server Attack Methodology | ▪ FTP Brute Force with AI |
| ▪ Information Gathering | ▪ HTTP/2 Continuation Flood Attack |
| o Information Gathering from Robots.txt File | ▪ Frontjacking Attack |
| ▪ Web Server Footprinting/Banner Grabbing | ▪ Other Web Server Attacks |
| o Web Server Footprinting Tools | o Web Server Password Cracking |
| o Enumerating Web Server Information Using Nmap | o DoS/DDoS Attacks |
| ▪ Website Mirroring | o Man-in-the-Middle Attack |
| o Finding Default Credentials of Web Server | o Phishing Attacks |
| o Finding Default Content of Web Server | o Web Application Attacks |
| o Finding Directory Listings of Web Server | Web Server Attack Methodology |
| • Dirhunt | ▪ Information Gathering |
| ▪ Vulnerability Scanning | o Information Gathering from Robots.txt File |
| o Finding Exploitable Vulnerabilities | ▪ Web Server Footprinting/Banner Grabbing |
| ▪ Session Hijacking | o Web Server Footprinting Tools |
| ▪ Web Server Password Hacking | o Web Server Footprinting with AI |
| ▪ Using Application Server as a Proxy | o Web Server Footprinting using Netcat with AI |
| ▪ Web Server Attack Tools | ▪ IIS Information Gathering using Shodan |
| o Metasploit | ▪ Abusing Apache mod_userdir to Enumerate User Accounts |
| CEHv12 | CEHv13 |
|---|---|
| • Metasploit Exploit Module | ▪ Enumerating Web Server Information Using Nmap |
| • Metasploit Payload and Auxiliary Modules | ▪ Finding Default Credentials of Web Server |
| • Metasploit NOPS Module | ▪ Finding Default Content of Web Server |
| o Web Server Attack Tools | ▪ Directory Brute Forcing |
| Web Server Attack Countermeasures | o Directory Brute Forcing with AI |
| ▪ Place Web Servers in Separate Secure Server Security Segment on Network | ▪ Vulnerability Scanning |
| ▪ Countermeasures | o NGINX Vulnerability Scanning using Nginxpwner |
| o Patches and Updates | ▪ Finding Exploitable Vulnerabilities |
| o Protocols and Accounts | o Finding Exploitable Vulnerabilities with AI |
| o Files and Directories | ▪ Session Hijacking |
| ▪ Detecting Web Server Hacking Attempts | ▪ Web Server Password Hacking |
| ▪ How to Defend Against Web Server Attacks | ▪ Using Application Server as a Proxy |
| ▪ How to Defend against HTTP Response-Splitting and Web Cache Poisoning | ▪ Path Traversal via Misconfigured NGINX Alias |
| ▪ How to Defend against DNS Hijacking | ▪ Web Server Attack Tools |
| ▪ Web Server Security Tools | Web Server Attack Countermeasures |
| o Web Application Security Scanners | ▪ Place Web Servers in Separate Secure Server Security Segment on Network |
| o Web Server Security Scanners | ▪ Countermeasures: Patches and Updates |
| o Web Server Malware Infection Monitoring Tools | ▪ Countermeasures: Protocols and Accounts |
| o Web Server Security Tools | ▪ Countermeasures: Files and Directories |
| o Web Server Pen Testing Tools | ▪ Detecting Web Server Hacking Attempts |
| Patch Management | ▪ How to Defend against Web Server Attacks |
| ▪ Patches and Hotfixes | ▪ How to Defend against HTTP Response-Splitting and Web Cache Poisoning |
| ▪ What is Patch Management? | ▪ How to Defend against DNS Hijacking |
| ▪ Installation of a Patch | ▪ Web Application Security Scanners |
| ▪ Patch Management Tools | ▪ Web Server Security Scanners |
| ▪ Web Server Malware Infection Monitoring Tools | |
| ▪ Web Server Security Tools | |
| ▪ Web Server Pen Testing Tools | |
| Patch Management | |
| ▪ Patches and Hotfixes | |
| ▪ What is Patch Management? | |
| ▪ Installation of a Patch | |
| ▪ Patch Management Best Practices | |
| ▪ Patch Management Tools |
| CEHv12 | CEHv13 |
|---|---|
| Module 14: Hacking Web Applications | Module 14: Hacking Web Applications |
| Web Application Concepts | Web Application Concepts |
| ▪ Introduction to Web Applications | ▪ Introduction to Web Applications |
| ▪ Web Application Architecture | ▪ Web Application Architecture |
| ▪ Web Services | ▪ Web Services |
| ▪ Vulnerability Stack | ▪ Vulnerability Stack |
| Web Application Threats | Web Application Threats |
| ▪ OWASP Top 10 Application Security Risks - 2021 | ▪ OWASP Top 10 Application Security Risks – 2021 |
| o A01 - Broken Access Control | o A01 – Broken Access Control |
| o A02 - Cryptographic Failures/Sensitive Data Exposure | o A02 – Cryptographic Failures/Sensitive Data Exposure |
| o A03 - Injection Flaws | o A03 – Injection Flaws |
| • SQL Injection Attacks | o A04 – Insecure Design |
| • Command Injection Attacks | o A05 – Security Misconfiguration |
| • Command Injection Example | o A06 – Vulnerable and Outdated Components/Using Components with Known Vulnerabilities |
| • File Injection Attack | o A07 – Identification and Authentication Failures/Broken Authentication |
| • LDAP Injection Attacks | o A08 – Software and Data Integrity Failures |
| • Other Injection Attacks | o A09 – Security Logging and Monitoring Failures/Insufficient Logging and Monitoring |
| ✓ JNDI Injection | o A10 – Server-Side Request Forgery (SSRF) |
| • Cross-Site Scripting (XSS) Attacks | ▪ Web Application Attacks |
| ✓ Cross-Site Scripting Attack Scenario: Attack via Email | o Directory Traversal |
| ✓ XSS Attack in Blog Posting | o Hidden Field Manipulation Attack |
| ✓ XSS Attack in Comment Field | o Pass-the-Cookie Attack |
| o A04 - Insecure Design | o Same-Site Attack |
| o A05 - Security Misconfiguration | o SQL Injection Attacks |
| • XML External Entity (XXE) | o Command Injection Attacks |
| o A06 - Vulnerable and Outdated Components/Using Components with Known Vulnerabilities | o Command Injection Example |
| o A07 - Identification and Authentication Failures/Broken Authentication | o File Injection Attack |
| o A08 - Software and Data Integrity Failures | o LDAP Injection Attacks |
| • Insecure Deserialization | o Other Injection Attacks |
| o A09 - Security Logging and Monitoring Failures/Insufficient Logging and Monitoring | o Cross-Site Scripting (XSS) Attacks |
| o A10 - Server-Side Request Forgery (SSRF) | o Cross-Site Scripting Attack Scenario: Attack via Email |
| • Types of Server-Side Request Forgery (SSRF) Attack | o XSS Attack in Blog Posting |
| ✓ Injecting SSRF payload | o XSS Attack in Comment Field |
| ✓ Cross-Site Port Attack (XSPA) | o Techniques to Evade XSS Filters |
| CEHv12 | CEHv13 |
|---|---|
| ▪ Other Web Application Threats | o Web-based Timing Attacks |
| o Directory Traversal | o XML External Entity (XXE) Attack |
| o Unvalidated Redirects and Forwards | o Unvalidated Redirects and Forwards |
| • Open Redirection | o Magecart Attack |
| • Header-Based Open Redirection | o Watering Hole Attack |
| • JavaScript-Based Open Redirection | o Cross-Site Request Forgery (CSRF) Attack |
| o Watering Hole Attack | o Cookie/Session Poisoning |
| o Cross-Site Request Forgery (CSRF) Attack | o Insecure Deserialization |
| o Cookie/Session Poisoning | o Web Service Attack |
| o Web Service Attack | o Web Service Footprinting Attack |
| o Web Service Footprinting Attack | o Web Service XML Poisoning |
| o Web Service XML Poisoning | o DNS Rebinding Attack |
| o Hidden Field Manipulation Attack | o Clickjacking Attack |
| o Web-based Timing Attacks | o MarioNet Attack |
| o MarioNet Attack | o Other Web Application Attacks |
| o Clickjacking Attack | Web Application Hacking Methodology |
| o DNS Rebinding Attack | ▪ Footprint Web Infrastructure |
| o Same-Site Attack | o Server Discovery |
| o Pass-the-cookie Attack | o Server Discovery: Banner Grabbing |
| Web Application Hacking Methodology | o Port and Service Discovery |
| ▪ Web Application Hacking Methodology | o Detecting Web App Firewalls and Proxies on Target Site |
| ▪ Footprint Web Infrastructure | o WAF Detection with AI |
| o Server Discovery | o Hidden Content Discovery |
| o Service Discovery | o Detect Load Balancers |
| o Server Identification/Banner Grabbing | o Detecting Load Balancers using AI |
| o Detecting Web App Firewalls and Proxies on Target Site | o Detecting Web App Technologies |
| o Hidden Content Discovery | o WebSockets Enumeration |
| o Detect Load Balancers | ▪ Analyze Web Applications |
| ▪ Analyze Web Applications | o Website Mirroring |
| o Identify Entry Points for User Input | o Website Mirroring with AI |
| o Identify Server-Side Technologies | o Website Mirroring using Httrack with AI |
| o Identify Server-Side Functionality | o Identify Entry Points for User Input |
| o Identify Files and Directories | o Identify Server-Side Technologies |
| o Identify Web Application Vulnerabilities | o Identify Server Side Technologies using AI |
| o Map the Attack Surface | o Identify Server-Side Functionality |
| ▪ Bypass Client-side Controls | o Identify Files and Directories |
| o Attack Hidden Form Fields | o Identify Files and Directories with AI |
| o Attack Browser Extensions | o Identify Web Application Vulnerabilities |
| CEHv12 | CEHv13 |
|---|---|
| • Attack Google Chrome Browser Extensions | o Identify Web Application Vulnerabilities with AI |
| o Perform Source Code Review | ▪ Bypass Client-side Controls |
| o Evade XSS Filters | o Attack Hidden Form Fields |
| ▪ Attack Authentication Mechanism | o Attack Browser Extensions |
| o Design and Implementation Flaws in Authentication Mechanism | o Attack Google Chrome Browser Extensions |
| o Username Enumeration | o Perform Source Code Review |
| o Password Attacks: Password Functionality Exploits | ▪ Attack Authentication Mechanism |
| o Password Attacks: Password Guessing and Brute-forcing | o Design Flaws in Authentication Mechanism |
| o Password Attacks: Attack Password Reset Mechanism | o Implementation Flaws in Authentication Mechanism |
| o Session Attacks: Session ID Prediction/Brute-forcing | o Username Enumeration |
| o Cookie Exploitation: Cookie Poisoning | o Password Attacks: Password Functionality Exploits |
| o Bypass Authentication: Bypass SAML-based SSO | o Password Attacks: Brute-forcing |
| ▪ Attack Authorization Schemes | o Password Attacks: Attack Password Reset Mechanism |
| o Authorization Attack: HTTP Request Tampering | o Session Attacks: Session ID Prediction/Brute-forcing |
| o Authorization Attack: Cookie Parameter Tampering | o Cookie Exploitation: Cookie Poisoning |
| ▪ Attack Access Controls | o Bypass Authentication: Bypass SAML-based SSO |
| ▪ Attack Session Management Mechanism | o Bypass Authentication: Bypass Rate Limit |
| o Attacking Session Token Generation Mechanism | o Bypass Authentication: Bypass Multi-Factor Authentication |
| o Attacking Session Tokens Handling Mechanism: Session Token Sniffing | ▪ Attack Authorization Schemes |
| ▪ Perform Injection/Input Validation Attacks | o Authorization Attack |
| o Perform Local File Inclusion (LFI) | o HTTP Request Tampering |
| ▪ Attack Application Logic Flaws | o Cookie Parameter Tampering |
| ▪ Attack Shared Environments | ▪ Attack Access Controls |
| ▪ Attack Database Connectivity | o Exploiting Insecure Access Controls |
| o Connection String Injection | o Access Controls Attack Methods |
| o Connection String Parameter Pollution (CSPP) Attacks | ▪ Attack Session Management Mechanism |
| o Connection Pool DoS | o Session Management Attack |
| ▪ Attack Web Application Client | o Attacking Session Token Generation Mechanism |
| ▪ Attack Web Services | o Attacking Session Tokens Handling Mechanism: Session Token Sniffing |
| o Web Services Probing Attacks | o Manipulating WebSocket Traffic |
| o Web Service Attacks: SOAP Injection | ▪ Perform Injection/Input Validation Attacks |
| o Web Service Attacks: SOAPAction Spoofing | o Injection Attacks/Input Validation Attacks |
| o Web Service Attacks: WS-Address Spoofing | o Perform Local File Inclusion (LFI) |
| o Web Service Attacks: XML Injection | ▪ Attack Application Logic Flaws |
| o Web Services Parsing Attacks | ▪ Attack Shared Environments |
| o Web Service Attack Tools | ▪ Attack Database Connectivity |
| ▪ Additional Web Application Hacking Tools | o Connection String Injection |
| o TIDoS-Framework | o Connection String Parameter Pollution (CSPP) Attacks |
Tiếp tục sánh nội dung CEH v12 vs CEH v13 :
| CEHv12 | CEHv13 |
|---|---|
| Web API, Webhooks, and Web Shell | o Connection Pool DoS |
| ▪ What is Web API? | ▪ Attack Web Application Client |
| o Web Services APIs | ▪ Attack Web Services |
| ▪ What are Webhooks? | o Web Services Probing Attacks |
| ▪ OWASP Top 10 API Security Risks | o Web Service Attacks: SOAP Injection |
| ▪ API Vulnerabilities | o Web Service Attacks: SOAPAction Spoofing |
| ▪ Web API Hacking Methodology | o Web Service Attacks: WS-Address Spoofing |
| o Identify the Target | o Web Service Attacks: XML Injection |
| o Detect Security Standards | o Web Services Parsing Attacks |
| o Identify the Attack Surface | o Web Service Attack Tools |
| • Analyze Web API Requests and Responses | ▪ Additional Web Application Hacking Tools |
| o Launch Attacks | ▪ Create and Run Custom Scripts to Automate Web Application Hacking Tasks With AI |
| • Fuzzing and Invalid Input Attacks | Web API and Webhooks |
| • Malicious Input Attacks | ▪ Web API |
| • Injection Attacks | o Web Service APIs |
| • Exploiting Insecure Configurations | ▪ Webhooks |
| • Login/ Credential Stuffing Attacks | ▪ OWASP Top 10 API Security Risks |
| • API DDoS Attacks | ▪ Webhooks Security Risks |
| • Authorization Attacks on API: OAuth Attacks | ▪ API Vulnerabilities |
| ✓ SSRF using Dynamic Client Registration endpoint | ▪ Web API Hacking Methodology |
| ✓ WebFinger User Enumeration | o Identify the Target |
| ✓ Exploit Flawed Scope Validation | o Detect Security Standards |
| • Other Techniques to Hack an API | o API Enumeration |
| o REST API Vulnerability Scanning | o Identify the Attack Surface |
| o Bypassing IDOR via Parameter Pollution | o Launch Attacks |
| ▪ Web Shells | • Other Techniques to Hack an API |
| o Web Shell Tools | o REST API Vulnerability Scanning |
| ▪ How to Prevent Installation of a Web Shell | o Bypassing IDOR via Parameter Pollution |
| ▪ Web Shell Detection Tools | ▪ Secure API Architecture |
| ▪ Secure API Architecture | ▪ API Security Risks and Solutions |
| o Implementing Layered Security in an API | ▪ Best Practices for API Security |
| ▪ API Security Risks and Solutions | ▪ Best Practices for Securing Webhooks |
| ▪ Best Practices for API Security | Web Application Security |
| ▪ Best Practices for Securing Webhooks | ▪ Web Application Security Testing |
| Web Application Security | ▪ Web Application Fuzz Testing |
| ▪ Web Application Security Testing | ▪ Web Application Fuzz Testing with AI |
| ▪ Web Application Fuzz Testing | ▪ AI-Powered Fuzz Testing |
| ▪ Source Code Review | ▪ AI-Powered Static Application Security Testing (SAST) |
| ▪ Encoding Schemes | ▪ AI-Powered Dynamic Application Security Testing (DAST) |
| ▪ Whitelisting vs. Blacklisting Applications | ▪ Source Code Review |
| o Application Whitelisting and Blacklisting Tools | ▪ Encoding Schemes |
One thought on “So Sánh CEH v12 vs CEH v13 Phần 2”