Free Certified Ethical Hacker (CEH) Roadmap
Widely requested in job adverts, especially in government and defence contracting. Broad tooling coverage across the attack lifecycle.
7 steps · 145 free videos · 79 free reads
Create your free account to open all 2,396 free items
The 224 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.
Before you start
Read these first
The free roadmap
7 steps, in order
The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.
Start here →
Step 1 — Learn the CEH material
Cover the full attack lifecycle and its tooling.
🔒 The full roadmap adds here: 14 full courses (Membership)
- Course · Learn Ethical Hacking From Scratch · 🔒 Membership
- Course · Learn Website Hacking / Penetration Testing From Scratch · 🔒 Membership
- Course · Start Using Wireshark to Hack like a Pro · 🔒 Membership
- Course · Learn Network Hacking From Scratch (WiFi & Wired) · 🔒 Membership
- Course · Learn Social Engineering From Scratch · 🔒 Membership
- Course · Learn Hacking Using Android From Scratch · 🔒 Membership
- Course · Hands-on Penetration Testing Labs 1.0 · 🔒 Membership
- Course · Hands-on Penetration Testing Labs 2.0 · 🔒 Membership
- Course · Hands-on Penetration Testing Labs 3.0 · 🔒 Membership
- Course · Hands-on Penetration Testing Labs 4.0 · 🔒 Membership
- Course · Ethical Hacking - Capture the Flag Walkthroughs - v1 · 🔒 Membership
- Course · Ethical Hacking - Capture the Flag Walkthroughs - v2 · 🔒 Membership
- Course · Kali Linux Web App Pentesting Labs · 🔒 Membership
- Course · Reverse Engineering with Radare2 · 🔒 Membership
Try a free password security lab: Cracked in a second (~5 min) → A scripted simulation in your browser. No account needed.
Step 2 — Scanning and enumeration
Find hosts, services and weaknesses.
🔒 The full roadmap adds here: hands-on labs 1–18 of 81 (Membership)
- Lab 1 of 81 · Additional Scanning Options · 🔒 Membership
- Lab 2 of 81 · Automated Vulnerability Assessments · 🔒 Membership
- Lab 3 of 81 · Basics of Metasploit · 🔒 Membership
- Lab 4 of 81 · Core Impact Vulnerability Scan · 🔒 Membership
- Lab 5 of 81 · Creating Recommendations Based on Vulnerability Assessments · 🔒 Membership
- Lab 6 of 81 · Host Identification Scanning via Windows · 🔒 Membership
- Lab 7 of 81 · Host Identification Scanning with Linux · 🔒 Membership
- Lab 8 of 81 · Identifying System Vulnerabilities with OpenVAS · 🔒 Membership
- Lab 9 of 81 · Manual Vulnerability Assessment · 🔒 Membership
- Lab 10 of 81 · Nessus Scanning and Reporting · 🔒 Membership
- Lab 11 of 81 · Nessus Setup and Config · 🔒 Membership
- Lab 12 of 81 · Network Discovery · 🔒 Membership
- Lab 13 of 81 · Open Source Collection · 🔒 Membership
- Lab 14 of 81 · Scanning and Enumeration · 🔒 Membership
- Lab 15 of 81 · Scanning and Enumeration · 🔒 Membership
- Lab 16 of 81 · Scanning and Mapping Networks · 🔒 Membership
- Lab 17 of 81 · Scanning From Windows · 🔒 Membership
- Lab 18 of 81 · Vulnerability Scanner Set-up and Configuration · 🔒 Membership
Step 3 — Exploitation and post-exploitation
Gain access, escalate and persist.
🔒 The full roadmap adds here: hands-on labs 19–43 of 81 (14 labs in Membership · 11 labs in Infrastructure Labs)
- Lab 19 of 81 · Client-Side Exploitation with Social Engineering · 🔒 Membership
- Lab 20 of 81 · Cybersecurity Testing with Core Impact · 🔒 Membership
- Lab 21 of 81 · Evasive Maneuvers and Post Exploitation · 🔒 Membership
- Lab 22 of 81 · Intro To Linux - Backing Up, Compression, and Scheduling · 🔒 Membership
- Lab 23 of 81 · Intro to Linux - Routing and SSH Tunnels · 🔒 Membership
- Lab 24 of 81 · Linux Exploitation · 🔒 Membership
- Lab 25 of 81 · Network Miner · 🔒 Membership
- Lab 26 of 81 · Open Source Password Cracking · 🔒 Membership
- Lab 27 of 81 · Pentesting & Network Exploitation - Linux Target Analysis Labs · 🔒 Membership
- Lab 28 of 81 · Pentesting & Network Exploitation: DMZ Exploitation · 🔒 Membership
- Lab 29 of 81 · Pentesting & Network Exploitation: LAN Exploitation · 🔒 Membership
- Lab 30 of 81 · Pentesting & Network Exploitation: Windows Target Analysis Labs · 🔒 Membership
- Lab 31 of 81 · Post Exploitation and Pivoting · 🔒 Membership
- Lab 32 of 81 · Windows Exploitation · 🔒 Membership
- Lab 33 of 81 · Perform Open System Intelligence (OSINT) Gathering [Guided] · 🔒 Infrastructure Labs
- Lab 34 of 81 · Exploit Common Windows Flaws [Guided] · 🔒 Infrastructure Labs
- Lab 35 of 81 · Gain Remote Access to a Windows System [Guided] · 🔒 Infrastructure Labs
- Lab 36 of 81 · Perform Post-Exploit Activities [Guided] · 🔒 Infrastructure Labs
- Lab 37 of 81 · Exploit Flawed Code [Guided] · 🔒 Infrastructure Labs
- Lab 38 of 81 · Discover and Exploit Targets by Using Metasploit [Guided] · 🔒 Infrastructure Labs
- Lab 39 of 81 · Schedule and Perform Network Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
- Lab 40 of 81 · Can You Find Flaws with OSINT and Vulnerability Scanning? [Advanced] · 🔒 Infrastructure Labs
- Lab 41 of 81 · Can You Exploit Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 42 of 81 · Can You Exploit Windows with Metasploit and Code Analysis? [Advanced] · 🔒 Infrastructure Labs
- Lab 43 of 81 · Can You Perform Open-source Intelligence (OSINT)-Gathering Operations? [Expert] · 🔒 Infrastructure Labs
Step 4 — Network and perimeter attacks
Sniffing, man-in-the-middle, social engineering, denial of service, session hijacking and slipping past IDS and firewalls: the largest CEH domain, 24%.
🔒 The full roadmap adds here: hands-on labs 44–54 of 81 (Infrastructure Labs)
- Lab 44 of 81 · Perform Open Source Intelligence [Guided] · 🔒 Infrastructure Labs
- Lab 45 of 81 · Execute Network Reconnaissance [Guided] · 🔒 Infrastructure Labs
- Lab 46 of 81 · Perform Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
- Lab 47 of 81 · Monitor Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
- Lab 48 of 81 · Intercept and Obtain Passwords [Guided] · 🔒 Infrastructure Labs
- Lab 49 of 81 · Perform DOS Attacks [Guided] · 🔒 Infrastructure Labs
- Lab 50 of 81 · Perform an Attacker-in-the-Middle (AitM) Exploitation [Guided] · 🔒 Infrastructure Labs
- Lab 51 of 81 · Can You Perform OSINT and Host Discovery? [Advanced] · 🔒 Infrastructure Labs
- Lab 52 of 81 · Can You Explore Vulnerabilities in Systems, Network Traffic, and Passwords? [Advanced] · 🔒 Infrastructure Labs
- Lab 53 of 81 · Can You Perform DOS and AitM Attacks? [Advanced] · 🔒 Infrastructure Labs
- Lab 54 of 81 · Can You Perform OSINT by Using recon-ng, Perform Scans with Nmap & GSA, and Perform AitM Attacks? [Expert] · 🔒 Infrastructure Labs
Step 5 — Web and application attacks
Attack the layer most breaches come through.
🔒 The full roadmap adds here: hands-on labs 55–67 of 81 (Membership)
- Lab 55 of 81 · OWASP Top Ten 2025 - A01 Broken Access Controls · 🔒 Membership
- Lab 56 of 81 · OWASP Top Ten 2025 - A02 Security Misconfiguration · 🔒 Membership
- Lab 57 of 81 · OWASP Top Ten 2025 - A03 Software Supply Chain Failures · 🔒 Membership
- Lab 58 of 81 · OWASP Top Ten 2025 - A04 Cryptographic Failures · 🔒 Membership
- Lab 59 of 81 · OWASP Top Ten 2025 - A05 Injection · 🔒 Membership
- Lab 60 of 81 · OWASP Top Ten 2025 - A06 Insecure Design · 🔒 Membership
- Lab 61 of 81 · OWASP Top Ten 2025 - A07 Authentication Failures · 🔒 Membership
- Lab 62 of 81 · OWASP Top Ten 2025 - A08 Software or Data Integrity Failures · 🔒 Membership
- Lab 63 of 81 · OWASP Top Ten 2025 - A09 Security Logging & Alerting Failures · 🔒 Membership
- Lab 64 of 81 · OWASP Top Ten 2025 - A10 Mishandling of Exceptional Conditions · 🔒 Membership
- Lab 65 of 81 · OWASP Top Ten 2025 - Capstone · 🔒 Membership
- Lab 66 of 81 · OWASP Top Ten 2025 - Capstone (pt.1) · 🔒 Membership
- Lab 67 of 81 · OWASP Top Ten 2025 - Capstone (pt.2) · 🔒 Membership
Step 6 — Wireless, mobile, IoT and OT
Crack Wi-Fi, attack Android devices and understand IoT and OT targets: 15% of the exam together.
Step 7 — Cloud computing and cryptography
Cloud threats and attacks, and how ciphers, hashes and PKI are broken: 10% of the exam together.
🔒 The full roadmap adds here: 1 full course · hands-on labs 68–81 of 81 (Membership)
- Course · Encryption Academy: Introduction to Encryption · 🔒 Membership
- Lab 68 of 81 · Cryptography: Attacking Classic Ciphers · 🔒 Membership
- Lab 69 of 81 · Cryptography: Breaking Repeated Key XOR Cipher · 🔒 Membership
- Lab 70 of 81 · Cryptography: Breaking Weak RSA Keys · 🔒 Membership
- Lab 71 of 81 · Cryptography: Decrypting Files With a Dictionary Attack · 🔒 Membership
- Lab 72 of 81 · Cryptography: Forging Digital Signatures · 🔒 Membership
- Lab 73 of 81 · Cryptography: Forging MACs With Side Channels · 🔒 Membership
- Lab 74 of 81 · Cryptography: Hidden Veracrypt Containers · 🔒 Membership
- Lab 75 of 81 · Cryptography: Man In the Middle Attack · 🔒 Membership
- Lab 76 of 81 · Cryptography: Password Cracking · 🔒 Membership
- Lab 77 of 81 · Cryptography: Setting Up HTTPS in Windows and Linux · 🔒 Membership
- Lab 78 of 81 · Cryptography: Setting Up Two Factor Authentication · 🔒 Membership
- Lab 79 of 81 · Cryptography: Steganography · 🔒 Membership
- Lab 80 of 81 · Cryptography: Using GPG for Encryption and Key Management · 🔒 Membership
- Lab 81 of 81 · Cryptography: Using the OpenSSL CLI Tool · 🔒 Membership
Exam and next steps
Before the exam
Do it hands-on
The full Certified Ethical Hacker (CEH) roadmap
The same steps with every course and the hands-on labs, and your progress tracked.
The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytimeAdvanced
AI-Driven Security Engineering
Become the Cyber Security Expert the AI Era Needs.
StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”
Explore the AI Master’s →Create your free account to open all 2,396 free items
The 224 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.