CEH v13 (312-50) Study Guide: All 20 Modules, and What's New for AI
Last updated October 24, 2026
CEH is structured differently from most IT certifications: instead of a handful of weighted domains, the official courseware breaks the material into 20 modules that walk through an attack from reconnaissance to covering tracks, then branch into web, wireless, mobile, cloud, and IoT targets. CEH v13 also folded in AI content for the first time — both AI as an attack surface and AI as a tool attackers now use. Here's what the 20 modules actually cover and where candidates lose points.
The five phases that structure the whole exam
Before the modules branch into specific attack surfaces, CEH is built around five phases that describe any engagement from start to finish, and a large share of exam questions are really testing whether you know which phase a described action belongs to:
- 1. Reconnaissance — passive and active information gathering (footprinting, OSINT, search-engine dorking) before touching the target directly.
- 2. Scanning — identifying live hosts, open ports, and services (SYN scans, TCP/IP stack fingerprinting) to map the attack surface.
- 3. Gaining Access — exploiting a vulnerability to get a foothold, covered across System Hacking, Web Applications, SQL Injection, and the wireless/mobile/IoT modules.
- 4. Maintaining Access — privilege escalation, pivoting, and persistence once inside.
- 5. Covering Tracks — log manipulation and anti-forensic techniques, tested mainly for recognition rather than execution.
A classic CEH trap is a question that describes an action correctly but asks which phase it belongs to — for example, distinguishing passive reconnaissance (reviewing public records and cached search results, which never touches the target) from active reconnaissance (an ARP sweep or port scan, which does).
The 20 modules, grouped by what they actually test
- Foundational and recon modules — Introduction to Ethical Hacking, Footprinting and Reconnaissance, Scanning Networks, Enumeration, Vulnerability Analysis. These set up the "legal and authorized" framing CEH insists on, then teach the information-gathering techniques used before any exploitation.
- Access and persistence modules — System Hacking, Malware Threats, Sniffing, Social Engineering, Denial-of-Service, Session Hijacking, Evading IDS/Firewalls/Honeypots. This is the heart of the exam: privilege escalation techniques (like a world-writable script run by a root cron job), credential attacks (pass-the-hash vs. password cracking), and the human-factor side of social engineering.
- Target-specific modules — Hacking Web Servers, Hacking Web Applications, SQL Injection, Hacking Wireless Networks, Hacking Mobile Platforms, IoT and OT Hacking, Cloud Computing. Web Applications and SQL Injection carry heavy question volume here — expect to distinguish XSS from XXE from SSRF by the specific behavior described, and to know the SQL injection subtypes (error-based, blind boolean, time-based, out-of-band) by how each one exfiltrates data.
- Cryptography — the final module, covering symmetric vs. asymmetric encryption, hashing and salting, and common cryptographic design flaws like a hardcoded key shared across every installation.
What's new in v13: AI as both target and tool
CEH v13 is the first version to meaningfully incorporate AI-specific content, and it shows up in two distinct ways. First, AI systems themselves as a target: a SOC assistant or internal chatbot with weak prompt and data-access controls can be manipulated into disclosing case notes or credentials it shouldn't — a confidentiality failure that didn't exist as exam content before AI assistants became common in security operations. Second, AI as an attacker's tool: AI-generated phishing content can be personalized at scale using public information (executive interviews, LinkedIn bios), making social-engineering questions in this version noticeably more about process controls (verification procedures, awareness training) than about spotting a poorly written email.
How long should you study
Candidates with hands-on security or networking experience (a year or more doing pentesting-adjacent work, or holding Security+ already) typically need eight to twelve weeks of focused review, since much of the terminology is already familiar. Candidates newer to offensive security concepts often need three to four months, because CEH assumes comfort with networking fundamentals (ports, protocols, the OSI model) as a prerequisite rather than teaching them from scratch.
Where candidates lose points
- Mixing up similar-sounding attack techniques. Pass-the-hash vs. password cracking, or error-based vs. blind SQL injection, are exactly the kind of near-identical pairs CEH tests by describing a specific behavior and asking which technique matches it.
- Misclassifying passive vs. active reconnaissance. Any technique that sends traffic to or interacts with the target — even something as simple as an ARP sweep — is active, not passive, regardless of how low-key it feels.
- Treating the five phases as a checklist instead of a lens. A single scenario can be read as belonging to different phases depending on what the attacker's goal is in that moment; candidates who memorize phase definitions without practicing phase-identification questions get tripped up by this.
- Underestimating the web application and SQL injection modules. Together they carry some of the heaviest question volume in the whole bank, and candidates who focus their study time on the more "hacker movie" topics (wireless, mobile) often under-prepare for this denser, more technical material.
Why full-rationale practice questions help
CEH's wrong answers are rarely nonsensical — a question about privilege escalation will offer a plausible-sounding distractor involving a misconfigured service that sounds dangerous but isn't actually exploitable the way described. Practicing with a rationale that explains why each of the other three options fails, not just which letter is correct, is what builds the judgment needed to tell a real vulnerability from a red herring on exam day.
Certified Ethical Hacker (CEH) v13 2026 Updated Practice Questions & Answers - 1200 Original Questions with Full Rationales — $39.99, instant PDF download with full rationale on every answer.
View the practice questions →If you're mapping out a broader security path
CEH sits alongside Security+ and CySA+ on most offensive/defensive security career paths, and candidates often pair it with a more managerial certification as they move into leadership: