Certified Ethical Hacker (CEH)
Exam CEH EC-Council Intermediate
Widely requested in job adverts, especially in government and defence contracting. Broad tooling coverage across the attack lifecycle.
Free resources
The path
Step 1 — Learn the CEH material
Cover the full attack lifecycle and its tooling.
1 course
Learn
- CourseCertified Ethical Hacker (CEH) Training Bundle 🔒 StationX Unlimited
1 section · 0 lectures
- First Section 0
Free resources
Step 2 — Scanning and enumeration
Find hosts, services and weaknesses.
29 labs
Learn
- CourseCovered in Certified Ethical Hacker (CEH) Training Bundle — scanning and enumeration modules 🔒 StationX Unlimited
Practise
- LabsEthical Hacking Fundamentals — 18 labs 🔒 StationX Unlimited
- Additional Scanning Options
- Automated Vulnerability Assessments
- Basics of Metasploit
- Core Impact Vulnerability Scan
- Creating Recommendations Based on Vulnerability Assessments
- Host Identification Scanning via Windows
- Host Identification Scanning with Linux
- Identifying System Vulnerabilities with OpenVAS
- Manual Vulnerability Assessment
- Nessus Scanning and Reporting
- Nessus Setup and Config
- Network Discovery
- Open Source Collection
- Scanning From Windows
- Scanning and Enumeration
- Scanning and Enumeration (2026)
- Scanning and Mapping Networks
- Vulnerability Scanner Set-up and Configuration
- Labs+Introduction to Ethical Hacking — 11 labs 🔒 StationX Labs+
- Can You Explore Vulnerabilities in Systems, Network Traffic, and Passwords? [Advanced]
- Can You Perform DOS and AitM Attacks? [Advanced]
- Can You Perform OSINT and Host Discovery? [Advanced]
- Can You Perform OSINT by Using recon-ng, Perform Scans with Nmap & GSA, and Perform AitM Attacks? [Expert]
- Execute Network Reconnaissance [Guided]
- Intercept and Obtain Passwords [Guided]
- Monitor Network Traffic by Using Wireshark [Guided]
- Perform DOS Attacks [Guided]
- Perform Open Source Intelligence [Guided]
- Perform Vulnerability Scans [Guided]
- Perform an Attacker-in-the-Middle (AitM) Exploitation [Guided]
Free resources
Step 3 — Exploitation and post-exploitation
Gain access, escalate and persist.
26 labs
Learn
- CourseCovered in Certified Ethical Hacker (CEH) Training Bundle — system hacking and post-exploitation modules 🔒 StationX Unlimited
Practise
- Labs+Operating System Exploits — 11 labs 🔒 StationX Labs+
- Can You Exploit Windows with Metasploit and Code Analysis? [Advanced]
- Can You Exploit Windows? [Advanced]
- Can You Find Flaws with OSINT and Vulnerability Scanning? [Advanced]
- Can You Perform Open-source Intelligence (OSINT)-Gathering Operations? [Expert]
- Discover and Exploit Targets by Using Metasploit [Guided]
- Exploit Common Windows Flaws [Guided]
- Exploit Flawed Code [Guided]
- Gain Remote Access to a Windows System [Guided]
- Perform Open System Intelligence (OSINT) Gathering [Guided]
- Perform Post-Exploit Activities [Guided]
- Schedule and Perform Network Vulnerability Scans [Guided]
- LabsPentesting and Network Exploitation — 15 labs 🔒 StationX Unlimited
- Basics of Metasploit
- Client-Side Exploitation with Social Engineering
- Cybersecurity Testing with Core Impact
- Evasive Maneuvers and Post Exploitation
- Intro To Linux - Backing Up, Compression, and Scheduling
- Intro to Linux - Routing and SSH Tunnels
- Linux Exploitation
- Network Miner
- Open Source Password Cracking
- Pentesting & Network Exploitation - Linux Target Analysis Labs
- Pentesting & Network Exploitation: DMZ Exploitation
- Pentesting & Network Exploitation: LAN Exploitation
- Pentesting & Network Exploitation: Windows Target Analysis Labs
- Post Exploitation and Pivoting
- Windows Exploitation
Step 4 — Web and application attacks
Attack the layer most breaches come through.
27 labs
Learn
- CourseCovered in Certified Ethical Hacker (CEH) Training Bundle — web and application hacking modules 🔒 StationX Unlimited
Practise
- LabsIntroduction To OWASP Top Ten — 13 labs 🔒 StationX Unlimited
- OWASP Top Ten 2025 - A01 Broken Access Controls
- OWASP Top Ten 2025 - A02 Security Misconfiguration
- OWASP Top Ten 2025 - A03 Software Supply Chain Failures
- OWASP Top Ten 2025 - A04 Cryptographic Failures
- OWASP Top Ten 2025 - A05 Injection
- OWASP Top Ten 2025 - A06 Insecure Design
- OWASP Top Ten 2025 - A07 Authentication Failures
- OWASP Top Ten 2025 - A08 Software or Data Integrity Failures
- OWASP Top Ten 2025 - A09 Security Logging & Alerting Failures
- OWASP Top Ten 2025 - A10 Mishandling of Exceptional Conditions
- OWASP Top Ten 2025 - Capstone
- OWASP Top Ten 2025 - Capstone (pt.1)
- OWASP Top Ten 2025 - Capstone (pt.2)
- LabsAdvanced Web Application Exploitation — 14 labs 🔒 StationX Unlimited
- Web 201 - Lab 1: Recon Tools
- Web 201 - Lab 2.1: Detecting and Exploiting Hard to Find SQL injections
- Web 201 - Lab 2.2: Advanced Sqlmap
- Web 201 - Lab 2.3: Manual Blind SQL Injection
- Web 201 - Lab 2.4: NoSQL Injection
- Web 201 - Lab 3.1: Cross Site Scripting Filter Evasion
- Web 201 - Lab 3.2: Exploiting Misconfigured CORS
- Web 201 - Lab 4: Advanced OS Command Injection
- Web 201 - Lab 5: Advanced Local File Inclusion
- Web 201 - Lab 6: Advanced CSRF
- Web 201 - Lab 7.1: XXE to Obtain Arbitrary Files
- Web 201 - Lab 7.2: Out of Band XXE Attacks
- Web 201 - Lab 8: Server Side Request Forgery
- Web 201 - Lab 9: Insecure Deserialization in Python and Java
Free resources
Before the exam
Where this leads
- CompTIA PenTest+ (v3) — Intermediate
- Offensive Security Certified Professional (OSCP) — Advanced
- FreeCertified Ethical Hacker Jobs
- FreeCEH vs OSCP — your next rung