PASSED! EC-Council’s Certified Ethical Hacker (Practical)
What is EC-Council’s CEH Practical?
It is a 6 hours practical exam built to exacting specifications by subject matter experts in the Ethical Hacking field. Professionals that possess the CEH credential are able to sit for the exam that will test their limits in unearthing vulnerabilities across major operating systems, databases, and networks. To those who meet and exceed the skills level set, they will earn the new industry required certification — the CEH Practical certification (“Certified Ethical Hacker Master: CEH Master: EC-Council”).
What is expected from you when you take the CEH Practical exam?
- Demonstrate the understanding of attack vectors.
- Perform network scanning to identify live and vulnerable machines in a network.
- Perform OS banner grabbing, service, and user enumeration.
- Perform system hacking, steganography, steganalysis attacks, and cover tracks.
- Identify and use viruses, computer worms, and malware to exploit systems.
- Perform packet sniffing.
- Conduct a variety of web server and web application attacks including directory traversal, parameter tampering, XSS, etc.
- Perform SQL injection attacks.
- Perform different types of cryptography attacks.
- Perform vulnerability analysis to identify security loopholes (“Certified Ethical Hacker Master: CEH Master: EC-Council”).
Is this different from the CEH Exam?
The CEH Exam also known as ANSI is a multiple-choice exam consist of 125 questions and a time duration of 4 hours to complete and is a closed-book test. The CEH Practical is a hands-on exam consist of 20 challenges, a time duration of 6 hours, delivered through EC-Council’s Aspen — iLabs environment and is an open-book (open internet) test.
My journey to achieving CEH (Master)
EC-Council’s Certified Ethical Hacker program often gets a bad rap from the infosec community. I have read posts saying to skip CEH and do the OSCP because it is the gold standard when it comes to Pentesting certification. I agree that OSCP gets more credibility, but I also think CEH ANSI is a good foundational step to someone who wants to get a crack in the cybersecurity field. I personally like that I had to memorize a lot of cybersecurity terms, definitions, jargon, and theories. Having knowledge of cybersecurity, in general, is a great start. It makes it easy to understand ethical hackers’ walkthrough write-ups when pawning/rooting a machine, and even a simple chat with infosec community members.
I am not going to talk about how I passed the CEH ANSI Exam. This write-up is about the process I had to go through before sitting the CEH Practical and some information that might be beneficial to others who want to take the CEH Practical exam and be a CEH Master.
First, you must successfully pass the CEH ANSI multiple-choice exam. Once you have completed the ANSI exam, you can move on to take the CEH Practical Exam. You will then have to purchase the CEH Practical Exam through EC-Council’s Store (https://iclass.eccouncil.org).
After your purchase of the CEH Practical Exam and activating it, you will receive an email from EC-Council and the CEH Practical will be added to your Aspen dashboard. Once you have activated the CEH Practical Exam, you will have 364 days to take the hands-on test.
To schedule your test:
- Login to the Aspen portal.
2. Click Exam under the CEH Practical:
3. Click Schedule Exam:
4. You will then be redirected to the site https://proctor.examspecialists.com
5. Click Register to create an account:
6. You will receive a confirmation email for your registration to Exam Specialists:
7. When you first log in to your Exam Specialists account, an Adobe Flash Player Settings prompt pops up:
8. You will then be asked to test your equipment to make sure that there will be no compatibility or technical issues when you take the test:
9. Click Schedule Session and choose EC-Council in the “Certification Provider” dropdown and Certified Ethical Hacker (Practical) in the “Select your exam” dropdown:
10. You will then be prompted to pick the date and time you want to take the test (in this example, I used December 17, 2019):
11. After you have picked the date and time, you will get a confirmation on screen that your reservation was completed and also a separate email confirmation:
The waiting game starts for your CEH Practical Exam.
Next, are the steps when your scheduled CEH Practical Exam arrives:
1. Login to https://proctor.examspecialists.com
2. There is a big countdown timer with options to Reschedule, Cancel, or Start the exam:
3. Nothing happens when clicking the Start Exam not until the timer says zero to the last second.
4. After clicking Start Exam, I was prompted to download and install GoTo Webinar.
5. Then I was automatically connected to the proctor.
6. (I had a hard time understanding the proctor ☹) The proctor checked the audio first, then I had to show a valid identification card through the webcam. I was then asked to show my surroundings using the webcam. There will be two sets of instructions that the proctor will send you through the Webinar chat and you are required to type your answer I agree to both of them. You are also required to provide them with your phone number (I am guessing so they have an easy way to get ahold of you when needed especially if there is a technical difficulty). You are required to share your screen with the proctor. This is where I had my first gripe. I use multiple monitors and I have already set up my notes to a specific monitor and other helpful resources to other monitors. The proctor told me that I am only allowed to use a single screen. If you are using a laptop then that laptop screen is the only screen allowed, or you can choose to use an external monitor but you have to close the lid of your laptop. I wish they would have included that information ahead of time than knowing about it just before I was going to take the exam. I was asked to disconnect the monitors, and not just to power them down.
7. The proctor then asked me to log in to my Aspen account.
8. Once logged in, I had to click Launch Exam:
9. The proctor had to take control of my computer to enter their credentials as a proctor to start the test. Funny story here is that I have Okta extension on my browser and after the proctor entered her credentials, Okta prompted me if I want to save the credentials. I could have done it, but I did not. It was just funny.
10. After the proctor logged in, a browser window popped up saying that it is preparing the virtual environment that I will be using to take the test.
11. Once the virtual machines were up and running, the proctor asked me to remove my headsets and completely disconnect them from my machine. Hacking begins!!!!!!!
I was only allowed 2 5-minute bathroom breaks for the entire 6 hours. Bathroom breaks had to be approved by the proctor. Here’s another gripe I have. From the time I sent the first GoTo Webinar chat message that I need to take a break, the proctor took 4 minutes to respond. Those 4 minutes felt so much longer. I had to send multiple chat messages and also waving at the camera hoping to get the proctor’s attention. And during the test, there was a message that popped up that made me nervous, because I didn’t want all the work I have done to go to waste. This was the message:
Luckily, nothing happened, and I continued with the test.
With 2 hours to spare from my allotted 6 hours to finish the test, I was able to confidently provide the answers to all 20 challenges. This time, I was thinking that I don’t need a high score, 14 is good to pass the test. I then remember some posts on social media who took the CEH Practical, one person said he got the required 14 points and passed, and another person posted he got 19 points. I just really need 14 and 19 would be a far reach. After I hit submit, a confirmation box came up asking if I am sure to close and save the lab. I hit Yes, and then I reached out to the proctor. This time there was another 4 minutes wait until I got a response from the proctor. At first, I thought I messed up something because the proctor asked me “So, what was your score, did you see it?” When I hit the submit and confirmation button my browser window automatically closed and I didn’t see any score. I started to feel hot and sweating thinking that I missed the opportunity to see the results of my test. The proctor then asked me to go back to my Aspen account and click on the CEH Exam Status. As soon as I clicked it, the proctor in a rather surprising tone “Oh, you got 20?” I was thinking, I got 20??????? I didn’t expect to get all the challenges correct. The proctor then congratulated me and I was told that was the end of our session and I can exit the GoTo Webinar.
In conclusion, I thought that was a good foundational hands-on measure of a person’s ethical hacking knowledge on how to use common penetration testing tools as well as think through the issues on how to overcome obstacles and defenses to successfully achieve the goals of data exfiltration, packet sniffing, network and system penetration, web vulnerabilities exploitation, and others. I don’t regret taking the CEH Practical exam, it actually helped with my confidence and made me challenged myself to do other Penetration Testing exercises such as Vulnhub, HacktheBox, or the industry-leading OSCP.
Good luck to anyone who is planning to take the CEH Practical Exam. It is going to be fun 😊
Resources:
Certified Ethical Hacker Master: CEH Master: EC-Council. (n.d.). Retrieved from https://www.eccouncil.org/programs/certified-ethical-hacker-ceh-master/.
