ETHICAL HACKING PRACTITIONER (S-EHP) VERSION 2017
Exam Preparation Guide Ethical Hacking Practitioner
SECO-Institute provides the official Cyber Security & Governance courseware to accredited training
centres where students are trained by accredited instructors. Students can take their exams at an
accredited exam centre or directly at the SECO-Institute. Attending an official certification course is
not a prerequisite for taking an exam. Upon successful completion of a certification exam (with a
passing score of 60%), students can claim their certification title at the SECO-Institute, whereupon
they will receive a title and a digital badge.
The Ethical Hacking Practitioner certificate demonstrates that candidates have acquired a comprehensive
overview of all the aspects of Ethical Hacking. The S-EHP (Ethical Hacking Practitioner) certificate is part of
the SECO-Institute’s Ethical Hacking track. The practitioner level is followed by the S-EHE (Ethical Hacking
Expert) and the S-CEHL (Certified Ethical Hacking Leader) certification courses.
Target audience(s):
- Ethical Hacker
Examination type
Computer-based
- 10 Multiple choice: 3 points per question - 5 Open questions: 8 points per question - 1 Case study: 30 points per case
Time allotted for examination
120 minutes
Examination details
- Pass mark: 60% (out of 100)
- Open book/notes: no
- Electronic equipment permitted: no
- The Rules and Regulations for SECO-Institute examinations apply to this exam.
Exam requirements
The following table lists the topics of the course by module (exam requirements).
Ethical Hacking Practitioner
Learning
objective(s)
• Understand penetration tests; types, process and reporting • Know the basics of cyber law and hacking ethics • Learn reconnaissance skills and the use of port scanning and vulnerability
scanning for intelligence gathering • Learn about social engineering, phishing and reporting • Understand basic networking, including TCP/IP, DNS, DHCP, ARP and WiFI and
how these can be abused • Learn how scanning tools such as NMAP and Nessus work • Learn about firewalls and honeypots • Understand network security, including SSL and VPNs • Gain knowledge about encryption, Public Key Infrastructure, hashing and how to
crack and secure hashes • Learn about web applications and protocols • Understand different web application vulnerabilities based on OWASP • Use of MITM proxies such as Burp Suite and OWASP Zap • Learn about databases and how to attack them and using web shells • Use Metasploit to exploit vulnerabilities and perform actions on a compromised
system • Learn about client-side attacks such as file-type exploitation and drive-by
downloads • Know how to escalate privileges on a system and how to do move from system
to system • Understand how rootkits and buffer overflows work • Overview of countermeasures against buffer overflows (DEP, ASLR) and
Advanced buffer overflows (ROP) • Learn more about exploit payloads and how to build .exes
Course modules • Module 1: Introduction • Module 2: Reconnaissance • Module 3: Infrastructure • Module 4: Web Applications • Module 5: Systems and Applications • Module 6: Exploit Development
Required prior
knowledge
• S-EHF – Ethical Hacking Foundation
Bloom-levels x Know x Understand x Apply Analyse Create
Module 1: Introduction
Learning objective(s)
• Understand the processes involved in doing a penetration test • Discern the types of penetration test • Report on a penetration test • Know the basics of cyber law • Be able to discuss the ethics of hacking
Topics • Penetration Testing o Understanding the penetration testing process
▪ Scope, Boundaries, legal waiver o The different types of Penetration test
▪ -Blackbox, Graybox, Whitebox (code review) o Testing guidelines
▪ OWASP testing guide, NIST, SANS, NCSC, Digid o Reporting on a penetration test
▪ Classification of vulnerabilities using CVSS ▪ Logging findings, gathering evidence ▪ Clearly describing problems
• Law in Cyberspace o Basics of Cybercrime laws o What to do with data breaches
▪ Personally Identifiable Information • Hacking Ethics
o What does ethics concern? o What to do with your vulnerabilities
▪ Elements of disclosure ▪ -What is a good use? Selling, saving, reporting?
o Ethics and Cyber Warfare
Module 2: Reconnaissance
Learning objective(s)
• Gain knowledge about intelligence gathering o Gain knowledge about Open Source Intelligence (OSINT) o Gain knowledge about WHOIS and DNS enumeration
• Gain knowledge about Reconnaissance o Gain basic knowledge about port scanning o Gain basic knowledge about service identification and fingerprinting
Topics • Intelligence Gathering o OSINT
▪ Using search operators in Google and using the GHDB ▪ Using Shodan.io ▪ Using Social Media ▪ Using theHarvester
o WHOIS lookups ▪ What is WHOIS ▪ Use WHOIS online through a browser ▪ Use WHOIS in a terminal environment using ‘whois’ ▪ Using robtex.com in a combined research action
o DNS lookups and enumeration ▪ Use DNS lookup online through a browser on different websites
▪ Forward and Reverse DNS lookup using ‘dig’ ▪ Perform DNS enumeration using DNSenum.pl and fierce.pl
• Reconnaissance o Manual port scanning and automated port scanning (Nmap) o Reading and interpreting scan results o Port probing using netcat o Port probing encrypted services
Module 3: Infrastructure
Learning objective(s)
• Learn the basics of TCP/IP • Understand basic network protocols such as DNS, DHCP, ARP • Know the workings of WiFi and how it can be abused • Understand how scanning tools such as Nmap work
Topics • Internet protocol suite o Overview of the TCP/IP model o Introduction to the Internet Protocol
▪ IPv4 and IPv6 o Understanding TCP
▪ Three way handshake, TCP features (Reliable, ordered, error-checked), as a pipe
o Understanding UDP ▪ Connectionless, no guarantees, less latency
o Wireshark Exercise ▪ -Monitor your network interface and test some applications
o Find at least one application using TCP and one using UDP o Identify the three-way handshake
• Basic network protocols o Understanding how the Domain Name System works
▪ Authoritative name servers, caching, root servers ▪ DNS Spoofing / Cache poisoning attack ▪ A short introduction to DNSSEC
o Understanding DHCP (Dynamic Host Configuration Protocol) ▪ Purpose of DHCP, how the protocol works ▪ Attacks on DHCP: Rogue DHCP server, DHCP lease takeover,
Starvation o Understanding ARP (Address Resolution Protocol)
▪ ARP spoofing attack • WiFi
o Understanding wireless protocols ▪ -WEP / WPA
o How does an evil access point work o How to crack WPA
Module 4: Web applications
Learning objective(s)
• Basic understanding of HTTP methods such as GET, POST, etc. • Basic understanding of web application architecture: front-end, application,
database, server, etc. • OWASP • Exploring web application testing tools • Cross-Site Scripting • Authentication • Using MITM proxies such as Burp Suite and OWASP Zap • Databases (theoretical) • SQL Injection attacks • Web shells • Third party libraries / CMS
Topics • HTTP in general o Understanding HTTP methods such as GET, POST o Understanding HTTP Headers such as Host, User-Agent (request and
response headers), Cookies • Webapp Infrastructure
o Understanding the infrastructure of a web application • OWASP
o OWASP Testing Guide • Webapp testing Tools
o Exploring a web application. Locate applications, folders and files using a directory bruteforcer like ‘dirb’ or ‘dirbuster’, robots.txt, .htaccess
o Web application vulnerability testing (extended) ▪ Using Nikto as a lightweight scanner for web applications ▪ Using more automated tools such as ‘w3af’ or ‘vega’ to scan a
target, which creates a stepping stone to more specific scanners such as ‘wpscan’
• Cross-Site Scripting o Basic understanding of XSS attacks and Session Hijacking o Generate a proof-of-concept (PoC) XSS on a vulnerable web application o Browser Exploitation Framework (BeEF) o Use a more sophisticated attack from within BeEF to attack clients
• Authentication o Understanding different authentication methods such as http auth,
login Attacking several different authentication methods o Brute-force HTTP authentication o Brute-force HTML-based login forms o Use the previously generated XSS to steal a session cookie and perform
session hijacking forms, sessions, etc. • MITM Proxies
o Exploring Burp Suite o Using different functions within Burp to attack a web application o Exploring OWASP Zap o Using different functions within Zap to attack a web application
• Databases o A theoretical explanation about databases and how they are used
• SQL Injection attacks o Understanding SQLi attacks: how and why do they work? o Manually exploiting an SQLi vulnerability to gather credentials for a web
application
o Automating SQL Injection attacks o SQLmap o Taking SQLi further o Using SQLi to upload a web shell
• Web Shells o Exploring functions of a web shell
• Third party libraries / CMS o Understanding the risks of using external dependencies
Module 5: Systems and applications
Learning objective(s)
• Using Metasploit to exploit vulnerabilities and perform actions on a compromised system
• Client-side attacks such as file-type exploitation and drive-by downloads • Pivoting / Lateral Movement
Topics • Metasploit o Understanding, updating and starting Metasploit (and postgresql) o Auxiliary modules o Use auxiliary modules to gather information about target systems o Exploit modules o Exploit a vulnerable target that was found using an auxiliary module o Payload modules o Explore and try different payloads o Post-exploitation modules o Explore the functions of some post-exploitation modules or the ‘run’
command in Meterpreter • Client-side attacks
o Malicious file-type payloads o Create an evil .pdf or .xls file containing a payload
• Pivoting / Lateral movement o Understanding pivoting and lateral movement in general o Tunnel a session through a target to attack another machine
Module 6: Exploit development
Learning objective(s)
• Understand how Buffer Overflow exploits work • Finding a simple Buffer Overflow • Using Fuzzing • Creating an exploit from a Buffer Overflow • Overview of countermeasures (DEP, ASLR) and Advanced buffer overflows (ROP)
Topics • Buffer Overflow Exploits o Theoretical explanation of buffer overflow vulnerabilities
• Exploit Development o Using fuzzing techniques to crash an application and analyze this using a
debugger • Advanced buffer overflows
o Overview of different techniques such as DEP, ASLR, ROP, Egghunting • Payloads
o An extended look at different payloads within the Metasploit Framework or maybe pre-written shellcode from exploit-db
• Malicious executables
How to book your exam?
All our exams are delivered through an online examination system called ProcterU. To enrol for an exam,
go to: https://go.proctoru.com/
Make sure you are fully prepared. Use the ProctorU Preparation checklist to assess whether you are ready
to take the exam.
If you are a new user, select Test Taker. Select "SECO-Institute" as the institution and fill in all the
necessary information. See the instructions for more information. Once you have scheduled your exam,
you will be asked to pay the exam fee. If you have an exam voucher, please fill in the access code.
Our online examination system allows you to book your exam and take it at any place convenient to you.
Do you prefer your kitchen table, your home desk or your office? Would you rather take a test in the day
or at night? It is up to you!
System requirements
To ensure the quality and security of the examination, you will have to meet specific requirements
regarding your computer configuration, your exam environment and your behaviour during the exam.
Click here to see the requirements.
The exam will be taken with special proctor software. To enable webcam and audio recording during the
exam, you have to install software that monitors your activities.
Your exam will be recorded through your webcam and microphone. The recordings will be reviewed by
multiple proctors after you have completed the exam. The proctors will check if you comply with all the
requirements for the examination.
Results
If no non-conformities are detected by the proctors, you will receive the final result by email one month
after you complete the test. The email will also contain information on how to claim your certificate and
digital badge as well as how to use your title.
o Create an .exe file using a payload from the Metasploit Framework • Privilege escalation
o Explain privilege escalation o administrative access to the target that was exploited using the
techniques above
Certification Title
Upon successful completion of an exam, students can claim their S-EHP title at the SECO-Institute. Each
certification level requires a certain number of Continuing Professional Education (CPE) hours over an
annual and a three-year-period. This requirement must be met in order to retain a certification.
Practitioner certifications require a minimum of 20 CPE credits yearly (60 in the three-year certification
cycle).
Digital badges
SECO-Institute and digital badge provider Acclaim have partnered to
provide certification holders with a digital badge of their SECO-Institute
certification. Digital badges can be used in email signatures as well as on
personal websites, social media sites such as LinkedIn and Twitter, and
electronic copies of resumes. Digital badges help certification holders
convey employers, potential employers and interested parties the skills
they have acquired to earn and maintain a specialised certification.
Claim your title at: https://www.seco-institute.org/claim-your-title
Top Related