Certified Ethical Hacker (CEH)

Exam CEH EC-Council Intermediate

Widely requested in job adverts, especially in government and defence contracting. Broad tooling coverage across the attack lifecycle.

16 courses · 161 sections · 754 lectures · 81 labs · ≈ 108 h of hands-on labs

All 81 CEH hands-on labs on one page →

Free to start: the free lessons and guides for this roadmap →

Free resources to get you started

Exam domains

Information Security and Ethical Hacking Overview — 6%
Reconnaissance Techniques — 17%
System Hacking Phases and Attack Techniques — 15%
Network and Perimeter Hacking — 24%
Web Application Hacking — 14%
Wireless Network Hacking — 5%
Mobile Platform, IoT, and OT Hacking — 10%
Cloud Computing — 5%
Cryptography — 5%

EC-Council's CEH v13 blueprint (v5.0). EC-Council rounds each domain, so the weights total 101%.

FreeCEH Exam Cheat Sheet

Try a free password security lab: Cracked in a second (~5 min) → A scripted simulation in your browser. No account needed.

The path

Start here →

Step 1 — Learn the CEH material

Cover the full attack lifecycle and its tooling.

15 courses · 153 sections · 730 lectures

Learn

CourseCertified Ethical Hacker (CEH) Training Bundle (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 15 courses · 730 lectures
- The Complete Nmap Ethical Hacking Course: Network Security Assessment (opens in a new tab)
  15 sections · 57 lectures
  1. Training Overview 2
  2. Introduction 4
  3. Cheat Sheet 1
  4. Installing Nmap and Cloud Labs 3
  5. Nmap Basics, Target Specification & Port States 5
  6. Nmap Discovery and Ping Scanning 5
  7. Nmap Scan Techniques 5
  8. Nmap Port Specification, Service, Version & OS Detection 4
  9. Nmap Scripting Engine (NSE) 6
  10. Nmap Performance, Firewall and IDS Evasion 4
  11. Nmap Output and Extras 4
  12. Zenmap 4
  13. How Criminal Black Hats Use Nmap with Hacking Infrastructures 2
  14. Wrap up 2
  15. Preview Lectures 6
- Learn Ethical Hacking From Scratch (opens in a new tab)
  27 sections · 146 lectures
  1. Training Overview 2
  2. 1. Course Introduction 3
  3. 2. Setting up a Hacking Lab 6
  4. 3. Linux Basics 3
  5. 4. Network Hacking 5
  6. 5. Network Hacking - Pre Connection Attacks 4
  7. 6. Network Hacking - Gaining Access - WEP Cracking 5
  8. 7. Network Hacking - Gaining Access - WPA / WPA2 Cracking 5
  9. 8. Network Hacking - Gaining Access - Security 2
  10. 9. Network Hacking - Post Connection Attacks 1
  11. 10. Network Hacking - Post-Connection Attacks - Information Gathering 5
  12. 11. Network Hacking - Post Connection Attacks - MITM Attacks 16
  13. 12. Network Hacking - Detection & Security 4
  14. 13. Gaining Access To Computers 1
  15. 14. Gaining Access - Server Side Attacks 9
  16. 15. Gaining Access - Client Side Attacks 6
  17. 16. Gaining Access - Client Side Attacks - Social Engineering 20
  18. 17. Gaining Access - Hacking Outside The Local Network 4
  19. 18. Post Exploitation 7
  20. 19. Website Hacking 2
  21. 20. Website Hacking - Information Gathering 7
  22. 21. Website Hacking - File Upload, Code Execution & File Inclusion Vulns 6
  23. 22. Website Hacking - SQL Injection Vulnerabilities 11
  24. 23. Website Hacking - Cross Site Scripting (XSS) Vulnerabilities 5
  25. 24. Website Hacking - Discovering Vulnerabilities Automatically 5
  26. 25. Bonus Section 1
  27. Audio Version of Training 1
- Learn Website Hacking / Penetration Testing From Scratch (opens in a new tab)
  21 sections · 103 lectures
  1. Training Overview 2
  2. Section 0: Course Introduction 1
  3. Section 1: Preparation - Creating a Hacking Lab 6
  4. Section 2. Preparation - Linux Basics 4
  5. Section 3. Website Basics 2
  6. Section 4. Information Gathering 9
  7. Section 5. File Upload Vulnerabilities 6
  8. Section 6. Code Execution Vulnerabilities 3
  9. Section 7. Local File Inclusion Vulnerabilities (LFI) 2
  10. Section 8. Remote File Inclusion Vulnerabilities (RFI) 4
  11. Section 9. SQL Injection Vulnerabilities 2
  12. Section 10. SQL Injection Vulnerabilities - SQLi In Login Pages 4
  13. Section 11. SQL injection Vulnerabilities - Extracting Data From The Database 4
  14. Section 12. SQL injection Vulnerabilities - Advanced Exploitation 11
  15. Section 13. XSS Vulnerabilities 6
  16. Section 14. XSS Vulnerabilities - Exploitation 14
  17. Section 15. Insecure Session Management 5
  18. Section 16. Brute Force & Dictionary Attacks 3
  19. Section 17. Discovering Vulnerabilities Automatically Using Owasp ZAP 2
  20. Section 18. Post Exploitation 12
  21. Audio Version of Training 1
- Start Using Wireshark to Hack like a Pro (opens in a new tab)
  12 sections · 39 lectures
  1. Course Overview 2
  2. Introduction 1
  3. Course Setup: First Steps of Protocol Analysis 3
  4. Network Communication at the Packet Level 4
  5. TCP/IP Foundation 4
  6. Starting your First Capture 3
  7. Working with Capture Files in Wireshark 4
  8. Analyzing Packet Captures 2
  9. Examining Protocol Communication 3
  10. Bonus Capture Files 4
  11. The Steps of Professional Hacking 8
  12. Audio Version of the Training 1
- Learn Network Hacking From Scratch (WiFi & Wired) (opens in a new tab)
  15 sections · 69 lectures
  1. Training Overview 2
  2. Section 0. 1
  3. Section 1. Preparation - Setting Up The Lab 8
  4. Section 2. Network Basics 4
  5. Section 3. Pre-Connection Attacks 4
  6. Section 4. Gaining Access 1
  7. Section 5. Gaining Access - WEP Cracking 6
  8. Section 6. Gaining Access - WPA/WPA2 Cracking 8
  9. Section 7. Gaining Access - Security & Mitigation 2
  10. Section 8. Post Connection Attacks 3
  11. Section 9. Post Connection Attacks - Information Gathering 3
  12. Section 10. Post Connections Attacks - Man In The Middle Attacks (MITM) 17
  13. Section 11. Post Connection Attacks - Gaining Full Control Over Devices On The Same Network 7
  14. Section 12. ARP Poisonning Detection & Security 2
  15. Audio Version of Training 1
- Learn Social Engineering From Scratch (opens in a new tab)
  21 sections · 113 lectures
  1. Training Overview 2
  2. Section 0. Introduction 3
  3. Section 1. Preparation - Creating a Penetration Testing Lab 6
  4. Section 2. Preparation - Linux Basics 3
  5. Section 3. Information Gathering 1
  6. Section 4. Information Gathering - Gathering Info About A Company/Website 5
  7. Section 5. Information Gathering - Gathering Info About A Person 4
  8. Section 6. Windows Malware 3
  9. Section 7. Windows Malware - Generating Undetectable Backdoors 9
  10. Section 8. Windows Malware - Spying 6
  11. Section 9. Windows Malware - Enhancing Malware 3
  12. Section 10. Windows Malware - Creating Trojans 8
  13. Section 11. Apple Mac OS Malware 8
  14. Section 12. Linux Malware 10
  15. Section 13. Delivery Methods 17
  16. Section 14. Using The Above Attacks Outside The Local Network 4
  17. Section 15. Post Exploitation 2
  18. Section 16. Post Exploitation - Meterpreter 8
  19. Section 17. Post Exploitation - Empire 6
  20. Section 18. Security 4
  21. Audio Version of Training 1
- Learn Hacking Using Android From Scratch (opens in a new tab)
  12 sections · 46 lectures
  1. Section 1. Introduction 1
  2. Section 2. Termux Basic Operations 6
  3. Section 3. Installing Kali Linux As Virtual Machine (Optional) 2
  4. Section 4. Network Scanning 5
  5. Section 5. Social Engineering Attacks 2
  6. Section 6. Spying > MITM Method 1 - Bad USB Attack 4
  7. Section 7. Spying > MITM Method 2 - ARP Poisonning 5
  8. Section 8. Using The Above Attacks Outside The Local Network 4
  9. Section 9. How to Be Safe From Above Attacks 2
  10. Exploitation 9
  11. Section 11. Exploitation - Rubber Ducky Scripts 4
  12. Section 12. Detecting Malicious Files 2
- Hands-on Penetration Testing Labs 1.0 (opens in a new tab)
  2 sections · 20 lectures
  1. Training Overview 2
  2. Hands-on Labs 18
- Hands-on Penetration Testing Labs 2.0 (opens in a new tab)
  2 sections · 19 lectures
  1. Training Overview 2
  2. Introduction 17
- Hands-on Penetration Testing Labs 3.0 (opens in a new tab)
  2 sections · 17 lectures
  1. Training Overview 2
  2. Introduction 15
- Hands-on Penetration Testing Labs 4.0 (opens in a new tab)
  2 sections · 16 lectures
  1. Training Overview 2
  2. Section 1: Introduction 14
- Ethical Hacking - Capture the Flag Walkthroughs - v1 (opens in a new tab)
  8 sections · 19 lectures
  1. Training Overview 2
  2. Section 1: Course Overview 1
  3. Section 2: Building Your Virtual Lab Environment Using VirtualBox 1
  4. Section 3: CTF - Easy Beginner Level - Basic Pentest 3
  5. Section 4: CTF - Beginner to Intermediate Level - DeRPnStiNK 3
  6. Section 5: CTF - Beginner to Intermediate level - Stapler 4
  7. Section 6: CTF - Intermediate level - Mr. Robot 4
  8. Audio Version of Training 1
- Ethical Hacking - Capture the Flag Walkthroughs - v2 (opens in a new tab)
  8 sections · 21 lectures
  1. Training Overview 2
  2. Section 2: Building Your Virtual Lab Environment Using VirtualBox 2
  3. Section 3: Troubleshooting VirtualBox 2
  4. Section 4: Capture the Flag Walkthrough - Toppo 3
  5. Section 5: Capture the Flag Walkthrough – Lampiao 4
  6. Section 6: Capture the Flag Walkthrough - DC-1 4
  7. Section 7: Capture the Flag Walkthrough - SickOS 1.1 3
  8. Audio Version of Training 1
- Kali Linux Web App Pentesting Labs (opens in a new tab)
  2 sections · 27 lectures
  1. Training Overview 2
  2. Web App Pentesting Labs 25
- Reverse Engineering with Radare2 (opens in a new tab)
  4 sections · 18 lectures
  1. Training Overview 2
  2. Preparation 6
  3. Reversing with Radare2 9
  4. What is next? 1

The CEH Training Bundle is StationX's collection of general hacking courses. It is not official EC-Council training and does not follow the CEH blueprint module by module; the steps below map it to the blueprint.

Free resources

Step 2 — Scanning and enumeration

Find hosts, services and weaknesses.

18 labs

Learn

CourseCovered in Certified Ethical Hacker (CEH) Training Bundle (opens in a new tab)opens on courses.stationx.net — scanning and enumeration modules 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 15 courses · 730 lectures — for this step:
- The Complete Nmap Ethical Hacking Course: Network Security Assessment (opens in a new tab)
  15 sections · 57 lectures
  1. Training Overview 2
  2. Introduction 4
  3. Cheat Sheet 1
  4. Installing Nmap and Cloud Labs 3
  5. Nmap Basics, Target Specification & Port States 5
  6. Nmap Discovery and Ping Scanning 5
  7. Nmap Scan Techniques 5
  8. Nmap Port Specification, Service, Version & OS Detection 4
  9. Nmap Scripting Engine (NSE) 6
  10. Nmap Performance, Firewall and IDS Evasion 4
  11. Nmap Output and Extras 4
  12. Zenmap 4
  13. How Criminal Black Hats Use Nmap with Hacking Infrastructures 2
  14. Wrap up 2
  15. Preview Lectures 6

Practise

LabsEthical Hacking Fundamentals — 18 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Additional Scanning OptionsDuration: 1 h
- Automated Vulnerability AssessmentsDuration: 1 h
- Basics of MetasploitDuration: 2 h
- Core Impact Vulnerability ScanDuration: 2 h
- Creating Recommendations Based on Vulnerability AssessmentsDuration: 1 h
- Host Identification Scanning via WindowsDuration: 1 h
- Host Identification Scanning with LinuxDuration: 1 h
- Identifying System Vulnerabilities with OpenVASDuration: 2 h
- Manual Vulnerability AssessmentDuration: 1 h
- Nessus Scanning and ReportingDuration: 3 h
- Nessus Setup and ConfigDuration: 3 h
- Network DiscoveryDuration: 2 h
- Open Source CollectionDuration: 2 h
- Scanning and EnumerationDuration: 3 h
- Scanning and Enumeration (2026)Duration: 2 h
- Scanning and Mapping NetworksDuration: 2 h
- Scanning From WindowsDuration: 1 h
- Vulnerability Scanner Set-up and ConfigurationDuration: 1 h

Free resources

Step 3 — Exploitation and post-exploitation

Gain access, escalate and persist.

26 labs

Learn

CourseCovered in Certified Ethical Hacker (CEH) Training Bundle (opens in a new tab)opens on courses.stationx.net — system hacking and post-exploitation modules 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 15 courses · 730 lectures — for this step:
- Learn Ethical Hacking From Scratch (opens in a new tab)
  27 sections · 146 lectures
  1. Training Overview 2
  2. 1. Course Introduction 3
  3. 2. Setting up a Hacking Lab 6
  4. 3. Linux Basics 3
  5. 4. Network Hacking 5
  6. 5. Network Hacking - Pre Connection Attacks 4
  7. 6. Network Hacking - Gaining Access - WEP Cracking 5
  8. 7. Network Hacking - Gaining Access - WPA / WPA2 Cracking 5
  9. 8. Network Hacking - Gaining Access - Security 2
  10. 9. Network Hacking - Post Connection Attacks 1
  11. 10. Network Hacking - Post-Connection Attacks - Information Gathering 5
  12. 11. Network Hacking - Post Connection Attacks - MITM Attacks 16
  13. 12. Network Hacking - Detection & Security 4
  14. 13. Gaining Access To Computers 1
  15. 14. Gaining Access - Server Side Attacks 9
  16. 15. Gaining Access - Client Side Attacks 6
  17. 16. Gaining Access - Client Side Attacks - Social Engineering 20
  18. 17. Gaining Access - Hacking Outside The Local Network 4
  19. 18. Post Exploitation 7
  20. 19. Website Hacking 2
  21. 20. Website Hacking - Information Gathering 7
  22. 21. Website Hacking - File Upload, Code Execution & File Inclusion Vulns 6
  23. 22. Website Hacking - SQL Injection Vulnerabilities 11
  24. 23. Website Hacking - Cross Site Scripting (XSS) Vulnerabilities 5
  25. 24. Website Hacking - Discovering Vulnerabilities Automatically 5
  26. 25. Bonus Section 1
  27. Audio Version of Training 1
- Hands-on Penetration Testing Labs 1.0 (opens in a new tab)
  2 sections · 20 lectures
  1. Training Overview 2
  2. Hands-on Labs 18
- Hands-on Penetration Testing Labs 2.0 (opens in a new tab)
  2 sections · 19 lectures
  1. Training Overview 2
  2. Introduction 17
- Hands-on Penetration Testing Labs 3.0 (opens in a new tab)
  2 sections · 17 lectures
  1. Training Overview 2
  2. Introduction 15
- Hands-on Penetration Testing Labs 4.0 (opens in a new tab)
  2 sections · 16 lectures
  1. Training Overview 2
  2. Section 1: Introduction 14
- Ethical Hacking - Capture the Flag Walkthroughs - v1 (opens in a new tab)
  8 sections · 19 lectures
  1. Training Overview 2
  2. Section 1: Course Overview 1
  3. Section 2: Building Your Virtual Lab Environment Using VirtualBox 1
  4. Section 3: CTF - Easy Beginner Level - Basic Pentest 3
  5. Section 4: CTF - Beginner to Intermediate Level - DeRPnStiNK 3
  6. Section 5: CTF - Beginner to Intermediate level - Stapler 4
  7. Section 6: CTF - Intermediate level - Mr. Robot 4
  8. Audio Version of Training 1
- Ethical Hacking - Capture the Flag Walkthroughs - v2 (opens in a new tab)
  8 sections · 21 lectures
  1. Training Overview 2
  2. Section 2: Building Your Virtual Lab Environment Using VirtualBox 2
  3. Section 3: Troubleshooting VirtualBox 2
  4. Section 4: Capture the Flag Walkthrough - Toppo 3
  5. Section 5: Capture the Flag Walkthrough – Lampiao 4
  6. Section 6: Capture the Flag Walkthrough - DC-1 4
  7. Section 7: Capture the Flag Walkthrough - SickOS 1.1 3
  8. Audio Version of Training 1

Practise

LabsPentesting and Network Exploitation — 15 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Basics of MetasploitDuration: 2 h
- Client-Side Exploitation with Social EngineeringDuration: 1 h
- Cybersecurity Testing with Core ImpactDuration: 1 h
- Evasive Maneuvers and Post ExploitationDuration: 1 h
- Intro To Linux - Backing Up, Compression, and SchedulingDuration: 1 h
- Intro to Linux - Routing and SSH TunnelsDuration: 2 h
- Linux ExploitationDuration: 1 h
- Network MinerDuration: 1 h
- Open Source Password CrackingDuration: 1 h
- Pentesting & Network Exploitation - Linux Target Analysis LabsDuration: 2 h
- Pentesting & Network Exploitation: DMZ ExploitationDuration: 1 h
- Pentesting & Network Exploitation: LAN ExploitationDuration: 2 h
- Pentesting & Network Exploitation: Windows Target Analysis LabsDuration: 1 h
- Post Exploitation and PivotingDuration: 2 h
- Windows ExploitationDuration: 2 h
Infra LabsOperating System Exploits — 11 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Perform Open System Intelligence (OSINT) GatheringLevel: GuidedDuration: 30 min
- Exploit Common Windows FlawsLevel: GuidedDuration: 30 min
- Gain Remote Access to a Windows SystemLevel: GuidedDuration: 30 min
- Perform Post-Exploit ActivitiesLevel: GuidedDuration: 30 min
- Exploit Flawed CodeLevel: GuidedDuration: 30 min
- Discover and Exploit Targets by Using MetasploitLevel: GuidedDuration: 30 min
- Schedule and Perform Network Vulnerability ScansLevel: GuidedDuration: 30 min
- Can You Find Flaws with OSINT and Vulnerability Scanning?Level: AdvancedDuration: 45 min
- Can You Exploit Windows?Level: AdvancedDuration: 45 min
- Can You Exploit Windows with Metasploit and Code Analysis?Level: AdvancedDuration: 45 min
- Can You Perform Open-source Intelligence (OSINT)-Gathering Operations?Level: ExpertDuration: 1 h

Free resources

Step 4 — Network and perimeter attacks

Sniffing, man-in-the-middle, social engineering, denial of service, session hijacking and slipping past IDS and firewalls: the largest CEH domain, 24%.

11 labs

Learn

CourseCovered in Certified Ethical Hacker (CEH) Training Bundle (opens in a new tab)opens on courses.stationx.net — network, sniffing and social engineering courses 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 15 courses · 730 lectures — for this step:
- Start Using Wireshark to Hack like a Pro (opens in a new tab)
  12 sections · 39 lectures
  1. Course Overview 2
  2. Introduction 1
  3. Course Setup: First Steps of Protocol Analysis 3
  4. Network Communication at the Packet Level 4
  5. TCP/IP Foundation 4
  6. Starting your First Capture 3
  7. Working with Capture Files in Wireshark 4
  8. Analyzing Packet Captures 2
  9. Examining Protocol Communication 3
  10. Bonus Capture Files 4
  11. The Steps of Professional Hacking 8
  12. Audio Version of the Training 1
- Learn Network Hacking From Scratch (WiFi & Wired) (opens in a new tab)
  15 sections · 69 lectures
  1. Training Overview 2
  2. Section 0. 1
  3. Section 1. Preparation - Setting Up The Lab 8
  4. Section 2. Network Basics 4
  5. Section 3. Pre-Connection Attacks 4
  6. Section 4. Gaining Access 1
  7. Section 5. Gaining Access - WEP Cracking 6
  8. Section 6. Gaining Access - WPA/WPA2 Cracking 8
  9. Section 7. Gaining Access - Security & Mitigation 2
  10. Section 8. Post Connection Attacks 3
  11. Section 9. Post Connection Attacks - Information Gathering 3
  12. Section 10. Post Connections Attacks - Man In The Middle Attacks (MITM) 17
  13. Section 11. Post Connection Attacks - Gaining Full Control Over Devices On The Same Network 7
  14. Section 12. ARP Poisonning Detection & Security 2
  15. Audio Version of Training 1
- Learn Social Engineering From Scratch (opens in a new tab)
  21 sections · 113 lectures
  1. Training Overview 2
  2. Section 0. Introduction 3
  3. Section 1. Preparation - Creating a Penetration Testing Lab 6
  4. Section 2. Preparation - Linux Basics 3
  5. Section 3. Information Gathering 1
  6. Section 4. Information Gathering - Gathering Info About A Company/Website 5
  7. Section 5. Information Gathering - Gathering Info About A Person 4
  8. Section 6. Windows Malware 3
  9. Section 7. Windows Malware - Generating Undetectable Backdoors 9
  10. Section 8. Windows Malware - Spying 6
  11. Section 9. Windows Malware - Enhancing Malware 3
  12. Section 10. Windows Malware - Creating Trojans 8
  13. Section 11. Apple Mac OS Malware 8
  14. Section 12. Linux Malware 10
  15. Section 13. Delivery Methods 17
  16. Section 14. Using The Above Attacks Outside The Local Network 4
  17. Section 15. Post Exploitation 2
  18. Section 16. Post Exploitation - Meterpreter 8
  19. Section 17. Post Exploitation - Empire 6
  20. Section 18. Security 4
  21. Audio Version of Training 1

Practise

Infra LabsIntroduction to Ethical Hacking — 11 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Perform Open Source IntelligenceLevel: GuidedDuration: 45 min
- Execute Network ReconnaissanceLevel: GuidedDuration: 30 min
- Perform Vulnerability ScansLevel: GuidedDuration: 30 min
- Monitor Network Traffic by Using WiresharkLevel: GuidedDuration: 45 min
- Intercept and Obtain PasswordsLevel: GuidedDuration: 30 min
- Perform DOS AttacksLevel: GuidedDuration: 30 min
- Perform an Attacker-in-the-Middle (AitM) ExploitationLevel: GuidedDuration: 30 min
- Can You Perform OSINT and Host Discovery?Level: AdvancedDuration: 30 min
- Can You Explore Vulnerabilities in Systems, Network Traffic, and Passwords?Level: AdvancedDuration: 45 min
- Can You Perform DOS and AitM Attacks?Level: AdvancedDuration: 45 min
- Can You Perform OSINT by Using recon-ng, Perform Scans with Nmap & GSA, and Perform AitM Attacks?Level: ExpertDuration: 1 h

Free resources

Step 5 — Web and application attacks

Attack the layer most breaches come through.

13 labs

Learn

CourseCovered in Certified Ethical Hacker (CEH) Training Bundle (opens in a new tab)opens on courses.stationx.net — web and application hacking modules 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 15 courses · 730 lectures — for this step:
- Learn Website Hacking / Penetration Testing From Scratch (opens in a new tab)
  21 sections · 103 lectures
  1. Training Overview 2
  2. Section 0: Course Introduction 1
  3. Section 1: Preparation - Creating a Hacking Lab 6
  4. Section 2. Preparation - Linux Basics 4
  5. Section 3. Website Basics 2
  6. Section 4. Information Gathering 9
  7. Section 5. File Upload Vulnerabilities 6
  8. Section 6. Code Execution Vulnerabilities 3
  9. Section 7. Local File Inclusion Vulnerabilities (LFI) 2
  10. Section 8. Remote File Inclusion Vulnerabilities (RFI) 4
  11. Section 9. SQL Injection Vulnerabilities 2
  12. Section 10. SQL Injection Vulnerabilities - SQLi In Login Pages 4
  13. Section 11. SQL injection Vulnerabilities - Extracting Data From The Database 4
  14. Section 12. SQL injection Vulnerabilities - Advanced Exploitation 11
  15. Section 13. XSS Vulnerabilities 6
  16. Section 14. XSS Vulnerabilities - Exploitation 14
  17. Section 15. Insecure Session Management 5
  18. Section 16. Brute Force & Dictionary Attacks 3
  19. Section 17. Discovering Vulnerabilities Automatically Using Owasp ZAP 2
  20. Section 18. Post Exploitation 12
  21. Audio Version of Training 1
- Kali Linux Web App Pentesting Labs (opens in a new tab)
  2 sections · 27 lectures
  1. Training Overview 2
  2. Web App Pentesting Labs 25

Practise

LabsIntroduction To OWASP Top Ten — 13 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- OWASP Top Ten 2025 - A01 Broken Access ControlsDuration: 1 h
- OWASP Top Ten 2025 - A02 Security MisconfigurationDuration: 1 h
- OWASP Top Ten 2025 - A03 Software Supply Chain FailuresDuration: 1 h
- OWASP Top Ten 2025 - A04 Cryptographic FailuresDuration: 1 h
- OWASP Top Ten 2025 - A05 InjectionDuration: 1 h
- OWASP Top Ten 2025 - A06 Insecure DesignDuration: 1 h
- OWASP Top Ten 2025 - A07 Authentication FailuresDuration: 1 h
- OWASP Top Ten 2025 - A08 Software or Data Integrity FailuresDuration: 1 h
- OWASP Top Ten 2025 - A09 Security Logging & Alerting FailuresDuration: 1 h
- OWASP Top Ten 2025 - A10 Mishandling of Exceptional ConditionsDuration: 1 h
- OWASP Top Ten 2025 - CapstoneDuration: 3 h
- OWASP Top Ten 2025 - Capstone (pt.1)Duration: 1 h 30 min
- OWASP Top Ten 2025 - Capstone (pt.2)Duration: 1 h 30 min

Free resources

Step 6 — Wireless, mobile, IoT and OT

Crack Wi-Fi, attack Android devices and understand IoT and OT targets: 15% of the exam together.

Learn

CourseCovered in Certified Ethical Hacker (CEH) Training Bundle (opens in a new tab)opens on courses.stationx.net — Wi-Fi and Android hacking courses 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Bundle · 15 courses · 730 lectures — for this step:
- Learn Network Hacking From Scratch (WiFi & Wired) (opens in a new tab)
  15 sections · 69 lectures
  1. Training Overview 2
  2. Section 0. 1
  3. Section 1. Preparation - Setting Up The Lab 8
  4. Section 2. Network Basics 4
  5. Section 3. Pre-Connection Attacks 4
  6. Section 4. Gaining Access 1
  7. Section 5. Gaining Access - WEP Cracking 6
  8. Section 6. Gaining Access - WPA/WPA2 Cracking 8
  9. Section 7. Gaining Access - Security & Mitigation 2
  10. Section 8. Post Connection Attacks 3
  11. Section 9. Post Connection Attacks - Information Gathering 3
  12. Section 10. Post Connections Attacks - Man In The Middle Attacks (MITM) 17
  13. Section 11. Post Connection Attacks - Gaining Full Control Over Devices On The Same Network 7
  14. Section 12. ARP Poisonning Detection & Security 2
  15. Audio Version of Training 1
- Learn Hacking Using Android From Scratch (opens in a new tab)
  12 sections · 46 lectures
  1. Section 1. Introduction 1
  2. Section 2. Termux Basic Operations 6
  3. Section 3. Installing Kali Linux As Virtual Machine (Optional) 2
  4. Section 4. Network Scanning 5
  5. Section 5. Social Engineering Attacks 2
  6. Section 6. Spying > MITM Method 1 - Bad USB Attack 4
  7. Section 7. Spying > MITM Method 2 - ARP Poisonning 5
  8. Section 8. Using The Above Attacks Outside The Local Network 4
  9. Section 9. How to Be Safe From Above Attacks 2
  10. Exploitation 9
  11. Section 11. Exploitation - Rubber Ducky Scripts 4
  12. Section 12. Detecting Malicious Files 2

No wireless, mobile, IoT or OT labs exist yet, and no course covers IoT or OT hacking; the free guides below cover the IoT basics.

Free resources

FreeHow to Hack WiFi With Kali Linux
FreeHow to Use Aircrack-ng
FreeEvil Twin WiFi Attack
Free video5 Wi-Fi Attacks (and the 1 WPA3 Doesn't Stop)
FreeIoT Security Challenges

Step 7 — Cloud computing and cryptography

Cloud threats and attacks, and how ciphers, hashes and PKI are broken: 10% of the exam together.

1 course · 8 sections · 24 lectures · 14 labs

Learn

CourseEncryption Academy: Introduction to Encryption (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
8 sections · 24 lectures
1. Training Overview 2
2. Introduction 3
3. Confidential of Data 3
4. Integrity of Data 3
5. Authenticity with a digital Certificate 4
6. Password-based Authentication 5
7. Conclusion and Bonus 3
8. Audio Version of the Training 1