CEH v13 Syllabus Explained: Modules, Domains, and What You Learn
Short answer: The CEH v13 syllabus is built around 20 modules that walk you through the full ethical hacking lifecycle, from reconnaissance to covering tracks, and now integrates AI into every phase. You validate the knowledge in a 125-question, 4-hour exam (code 312-50), and you can prove hands-on skill in a separate 6-hour practical exam. EC-Council organizes the whole program around four stages: Learn, Certify, Engage, Compete.
TL;DR: CEH v13 maps the entire attack lifecycle across 20 modules, blends 50% theory with 50% hands-on labs, and now weaves AI through every phase — making it one of the most employer-recognized credentials in security analyst and SOC hiring.
Key Takeaways - CEH v13 covers 20 modules and roughly 550 attack techniques, taught 50% theory and 50% hands-on. - The knowledge exam is 125 multiple-choice questions over 4 hours; the optional CEH Practical is 6 hours, 20 live challenges. - v13's headline change is AI woven through all five hacking phases, not bolted on as a single module. - There is no mandatory prerequisite if you take official training; self-study candidates need 2 years of security experience plus an eligibility application.
What the CEH v13 syllabus actually covers
The Certified Ethical Hacker program teaches you to think and act like an attacker so you can defend systems legally and with authorization. According to EC-Council's CEH learning framework, v13 spans 20 modules, 550 attack techniques, 220+ hands-on labs, and exposure to 3,500+ tools used by real-world attackers and defenders.
The modules follow the natural order of an engagement. You start with the foundations and footprinting, move through scanning and gaining access, then escalate, maintain access, and finally cover tracks, before closing with specialized domains like cloud, IoT, and cryptography.
The 20 modules at a glance
- Introduction to Ethical Hacking
- Footprinting and Reconnaissance
- Scanning Networks
- Enumeration
- Vulnerability Analysis
- System Hacking
- Malware Threats
- Sniffing
- Social Engineering
- Denial-of-Service
- Session Hijacking
- Evading IDS, Firewalls, and Honeypots
- Hacking Web Servers
- Hacking Web Applications
- SQL Injection
- Hacking Wireless Networks
- Hacking Mobile Platforms
- IoT and OT Hacking
- Cloud Computing
- Cryptography
Each module pairs concept with practice. EC-Council splits the official course roughly 50/50 between knowledge and hands-on labs, which is why the curriculum lists hundreds of guided exercises rather than lectures alone.
CEH v13 by the numbers
| CEH v13 element | Count |
|---|---|
| Modules | 20 |
| Hands-on labs | 220+ |
| Attack techniques | 550 |
| Tools covered | 3,500+ |
Source: EC-Council CEH Learning Framework (2024–25).
What changed in v13: AI across every phase
EC-Council released CEH v13 on 23 September 2024, and the defining update is artificial intelligence integrated across the five phases of hacking rather than isolated in one chapter. In practice, that means you learn to use AI to accelerate reconnaissance, automate parts of scanning and analysis, and understand how attackers weaponize AI, as well as how defenders counter it. EC-Council markets v13 directly as an "AI-powered" ethical hacking course on its CEH program page.
If you trained on an earlier version, the module order will feel familiar. The difference is the lens: each phase now asks how AI changes both the attack and the defense.
The CEH exam format
CEH separates what you know from what you can do with two different exams.
The knowledge exam (312-50)
- 125 multiple-choice questions
- 4-hour time limit
- Exam code 312-50
EC-Council does not publish a single fixed pass mark. Per EC-Council, the cut score varies by exam form, roughly in the 60–85% range, because different question sets are calibrated for difficulty. Treat "aim for 80%+ in practice tests" as a safer target than chasing one number.
The CEH Practical exam
The optional CEH Practical is where you prove real skill: 6 hours, 20 challenges on live virtual machines and networks, not multiple-choice recall. Pass both the knowledge exam and the practical and you earn the CEH Master designation. The CEH practical exam preparation guide breaks down how to get ready.
The four-phase framework: Learn, Certify, Engage, Compete
EC-Council wraps the syllabus in a progression designed to move you from classroom to real engagement:
- Learn — the 20 modules and 220+ labs.
- Certify — the knowledge exam, and optionally the practical.
- Engage — a simulated, four-phase real-world ethical hacking engagement.
- Compete — ongoing global CTF-style contests to keep skills sharp.
This structure is deliberate. Certifications lose value when they test memory alone, so the Engage and Compete stages push you to apply the syllabus under realistic conditions.
Do you need prerequisites?
No hard prerequisite applies if you take official training. According to EC-Council, you qualify for the exam by either:
- Completing official EC-Council CEH training, or
- Demonstrating at least 2 years of information security work experience and submitting an eligibility application with a non-refundable USD $100 fee.
Beginners almost always take the training route. If you are starting from zero, it helps to build Linux and networking fundamentals first, which is why many learners pair CEH prep with foundational practice. The guide on how to start ethical hacking with no experience shows where to begin.
Is CEH v13 worth studying?
If your goal is a broad, employer-recognized foundation across the whole attack surface, the v13 syllabus delivers exactly that: structured coverage of 20 domains, hundreds of labs, and a credential widely referenced in job descriptions and government frameworks. According to CyberSeek's hiring heat map — a NICE/CompTIA initiative tracking real US job postings — CEH appears in over 8,000 active US job listings annually, making it one of the most-requested certifications in security analyst and SOC roles. If you want to go narrow and deep on manual exploitation instead, the CEH vs OSCP breakdown compares the two before you commit.
Want to work through all 20 modules with guided labs and exam-focused practice? ThreatBlock's CEH v13 training course maps directly to the official syllabus.
Frequently asked questions
How many modules are in CEH v13? CEH v13 has 20 modules covering roughly 550 attack techniques, with 220+ hands-on labs and exposure to 3,500+ tools.
What is the CEH v13 exam format? The knowledge exam (code 312-50) is 125 multiple-choice questions over 4 hours. An optional CEH Practical adds a 6-hour, 20-challenge hands-on exam.
Do you need prerequisites for CEH v13? No prerequisite applies if you complete official training. Self-study candidates need at least 2 years of information security experience plus an eligibility application and a USD $100 fee.
What changed in CEH v13? The defining update is artificial intelligence integrated across all five phases of hacking, rather than isolated in a single module.
About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with hands-on experience in penetration testing and red teaming. Read more on the author page · Editorial policy.