Certified Ethical Hacker (CEH) Web, Application, and Database Hacking Syllabus

Web, Application, and Database Hacking syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Web, Application, and Database Hacking in Certified Ethical Hacker (CEH), not a summary of it.

1. 1

   Hacking Web Servers

   4 topics

   • Web Server Concepts and Architecture
     • Web server components and security issues
   • Web Server Attacks
     • DNS server hijacking and defacement
     • Directory traversal and HTTP response splitting
     • Server misconfiguration exploits
   • Web Server Attack Methodology
     • Information gathering and vulnerability scanning
   • Patch Management and Countermeasures
2. 2

   Hacking Web Applications

   5 topics

   • Web Application Concepts and OWASP Top 10
     • Web app architecture and attack surface
     • OWASP Top 10 vulnerabilities
   • Authentication and Authorization Attacks
     • Broken authentication and session management
     • Insecure direct object references and access control
   • Injection and Input Validation Attacks
     • Command injection and LDAP injection
     • Cross-site scripting (stored, reflected, DOM)
     • Cross-site request forgery (CSRF)
   • API, Webhook, and Web Shell Attacks
     • API vulnerabilities and OWASP API Top 10
     • Web shell deployment
   • Web Application Countermeasures
     • Input validation, WAF, secure coding
3. 3

   SQL Injection

   4 topics

   • SQL Injection Concepts
     • Injection points and impact
   • Types of SQL Injection
     • In-band: error-based and union-based
     • Blind: boolean-based and time-based
     • Out-of-band injection
   • SQL Injection Methodology and Tools
     • Detection and exploitation with sqlmap
     • Database fingerprinting and data extraction
   • Countermeasures
     • Parameterized queries and stored procedures

Web, Application, and Database Hacking flashcards for Certified Ethical Hacker (CEH)

24 of 52 cards from the Web, Application, and Database Hacking deck — real questions with worked answers.

1. What are the three core functions of a web server in the client-server model?

   It stores website files, processes incoming HTTP/HTTPS requests, and delivers (serves) the requested web content/responses back to clients (browsers).

2. In a typical web server architecture, what is the role of the document root?

   The document root is the top-level directory on the server's file system from which the web server serves files to clients; requested URLs map to files under this directory.

3. Name three of the most widely used web server software products.

   Apache HTTP Server, Microsoft Internet Information Services (IIS), and Nginx (others include LiteSpeed and Google Web Server).

4. What is the difference between a web server and an application server?

   A web server primarily serves static content and handles HTTP requests, while an application server runs business logic and dynamically generates content (often via the web server as a front end).

5. Which two HTTP request methods are most commonly targeted, and what is a key difference between them?

   GET and POST. GET appends parameters to the URL (visible, cacheable, length-limited), while POST sends parameters in the request body (used for larger/sensitive data submissions).

6. What is server-side scripting, and give two example technologies.

   Code executed on the server to generate dynamic content before sending it to the client. Examples: PHP, ASP.NET, JSP, Python, or Node.js.

7. What is 'directory browsing' (directory listing) and why is it a web server risk?

   When a directory has no index file and the server is configured to display its contents, attackers can enumerate files and folders, exposing sensitive files. It should be disabled.

8. List four common causes (root reasons) of web server vulnerabilities.

   Improper/default configuration, default accounts and passwords, unpatched software/known bugs, unnecessary services/open ports, and verbose error messages or default content left in place.

9. What is a DNS server hijacking attack against a web server's availability?

   The attacker compromises DNS settings to redirect users to a malicious server instead of the legitimate web server, enabling phishing or content interception.

10. Describe a directory traversal (path traversal) attack.

    An attacker uses sequences like ../ in input to navigate outside the web root and access restricted files (e.g., /etc/passwd), exploiting insufficient input validation.

11. What is website defacement?

    An attack that alters the visual appearance or content of a website, typically by exploiting vulnerabilities to replace pages, often for hacktivism or to demonstrate compromise.

12. What is an HTTP response splitting attack?

    An attacker injects CR/LF (carriage return/line feed) characters into a response header, splitting it into multiple responses to enable cache poisoning, XSS, or redirection.

13. What is web cache poisoning?

    An attack that forces a web cache to store and serve malicious or incorrect content to users, often combined with HTTP response splitting or manipulated cache keys.

14. What is a web server misconfiguration attack and one example?

    Exploiting insecure server settings such as enabled directory listing, default credentials, verbose error messages, unnecessary HTTP methods (e.g., PUT/DELETE), or remote admin interfaces left open.

15. What are the ordered phases of the Web Server Attack Methodology in CEH?

    1) Information gathering, 2) Web server footprinting/banner grabbing, 3) Website mirroring, 4) Vulnerability scanning, 5) Session hijacking, and 6) Web server password cracking/hacking.

16. What is web server footprinting (banner grabbing) and which tools are used?

    Gathering server details such as server software, version, and OS by reading HTTP banners. Tools: Netcraft, Telnet, ID Serve, httprecon, and Nmap (with -sV).

17. What is website mirroring in the attack methodology and why is it done?

    Copying an entire website locally (e.g., with HTTrack or Wget) to analyze its structure, links, and source code offline for vulnerabilities without repeatedly hitting the live server.

18. Name two automated tools used to scan web servers for known vulnerabilities.

    Nikto and Acunetix (others include OpenVAS, Nessus, and WPScan for WordPress).

19. What is patch management?

    The process of identifying, acquiring, testing, and installing software updates (patches) to fix vulnerabilities and bugs, keeping systems secure and up to date.

20. What is a hotfix versus a patch?

    A hotfix is a single, often urgent update addressing a specific issue (sometimes for one customer), while a patch is a more formally packaged, tested fix or set of fixes released for broader deployment.

21. List three key web server hardening countermeasures.

    Disable unnecessary services/ports, remove default accounts and sample files, apply patches promptly, disable directory listing, use TLS/HTTPS, and run the server with least-privilege accounts.

22. Why should detailed error messages be disabled on production web servers?

    Verbose errors can leak server versions, file paths, stack traces, and database details that help attackers fingerprint the system and craft targeted exploits.

23. What is the OWASP Top 10?

    A regularly updated, consensus list published by OWASP of the ten most critical web application security risks, used as an awareness and prioritization standard.

24. In the OWASP Top 10 (2021), what is the #1 ranked risk?

    A01: Broken Access Control.

See more Web, Application, and Database Hacking flashcards →

Planning Web, Application, and Database Hacking for Certified Ethical Hacker (CEH)

Web, Application, and Database Hacking (Certified Ethical Hacker (CEH)) FAQ