CEH v13 Modules Explained: What the 20 Modules Teach

The CEH v13 syllabus has 20 modules. The list looks long, but it follows the order an attacker works in, which makes it easier to learn than it seems. Here is each module in plain English, with something concrete to practice. EC-Council says the program covers more than 550 attack techniques across 221 hands-on labs and five phases of ethical hacking (EC-Council's CEH page, read November 5, 2026). Practice only on systems you own or have written permission to test; our guide on whether ethical hacking is legal in India explains why.

Modules 1 to 5: Find the Target and Map It

• 1. Introduction to Ethical Hacking: the vocabulary, the attack lifecycle and the rules of permission and scope.
• 2. Footprinting and Reconnaissance: collecting public information about a target before touching it. Start with our OSINT guide.
• 3. Scanning Networks: finding live hosts and open ports with tools such as nmap.
• 4. Enumeration: pulling usernames, shares and service details from what the scan found.
• 5. Vulnerability Analysis: matching what you found to known weaknesses; see Nessus for beginners and CVSS scores explained.

Modules 6 to 8: Get in, and Watch the Traffic

• 6. System Hacking: gaining access, escalating privileges and covering tracks; our privilege escalation guide and password cracking guide are good companions.
• 7. Malware Threats: how malware works and how it is analyzed; see malware analysis for beginners.
• 8. Sniffing: capturing and reading network traffic. Practice in Wireshark.

Modules 9 to 12: People, Availability and Evasion

• 9. Social Engineering: manipulating people rather than machines; start with how to analyze a phishing email.
• 10. Denial-of-Service: how services are knocked offline and how defenders absorb it. Study the concept; do not run it against anything you do not own.
• 11. Session Hijacking: stealing or abusing an active login session.
• 12. Evading IDS, Firewalls and Honeypots: how attackers slip past defenses, and how defenders detect them.

Modules 13 to 15: Servers and Web Applications

• 13. Hacking Web Servers: weaknesses in how servers are set up and patched.
• 14. Hacking Web Applications: the classic web flaws; read OWASP Top 10 for beginners and try Burp Suite.
• 15. SQL Injection: tricking an application into running attacker-written database queries; see SQL injection explained.

If web security is where you want to specialize, the next step is WAHS or our Application Security course.

Modules 16 to 20: Wireless, Mobile, IoT, Cloud and Crypto

• 16. Hacking Wireless Networks: Wi-Fi encryption and the attacks against weak set-ups.
• 17. Hacking Mobile Platforms: threats to Android and iOS devices and apps.
• 18. IoT and OT Hacking: connected devices and industrial systems, where patching is often hard.
• 19. Cloud Computing: shared-responsibility and misconfiguration problems.
• 20. Cryptography: encryption, hashing and signing, and how they are broken when used badly.

What the AI Additions Mean

EC-Council says CEH v13 adds AI-powered techniques and tools, and that students receive an AI activation key for use inside the official CEH labs. In practice, that means learning to use AI assistants to speed up reconnaissance, analysis and reporting, while still checking every result yourself. An assistant can be confidently wrong, and a wrong finding in a report costs you credibility. For the security of AI systems themselves, see prompt injection explained.

How to Use This List

Do not read all 20 modules once and stop. Learn them in blocks, build a small lab and do something in every block. Then use the exam format and timing on the CEH v13 exam guide to plan your revision.