CEH Free Labs - Amr Abdel Hamide

Overview#

This collection is organized to help you practice the CEH curriculum hands-on. Each section is mapped to its CEH module, and the labs inside each section progress from fundamentals to more advanced topics. Every link opens the lab directly.


Total labs	120
TryHackMe	99
PortSwigger Web Security Academy	21
Sections	16

Note: TryHackMe occasionally moves rooms between free and paid. If you find a lab that is locked, let me know and I will update the list.

Section Map#

#	Section	CEH Module	Labs
01	Reconnaissance & OSINT	Module 02 - Footprinting and Reconnaissance	7
02	Scanning & Enumeration (Nmap)	Module 03 & 04 - Scanning Networks / Enumeration	6
03	Vulnerability Assessment	Module 05 - Vulnerability Analysis	3
04	Networking & Protocols	Foundation - Networking Fundamentals	6
05	Web Fundamentals	Foundation - Web Fundamentals	8
06	Web Hacking & OWASP	Module 13 & 14 - Hacking Web Servers / Web Applications	8
07	SQL Injection	Module 15 - SQL Injection	24
08	Burp Suite	Module 14 - Hacking Web Applications (Tooling)	5
09	Exploitation & Metasploit	Module 06 - System Hacking	3
10	Privilege Escalation	Module 06 - System Hacking	6
11	Packet Analysis & IDS	Module 08 & 12 - Sniffing / Evading IDS, Firewalls & Honeypots	10
12	Malware & Reverse Engineering	Module 07 - Malware Threats	10
13	Cryptography	Module 20 - Cryptography	4
14	CTF & Practice Machines	Practice - End-to-End Application	9
15	Cloud	Module 19 - Cloud Computing	7
16	Wireless & IoT	Module 16 & 18 - Hacking Wireless Networks / IoT & OT	4

Suggested Learning Path#

Foundations: Networking & Protocols → Web Fundamentals
Information gathering and scanning: Recon & OSINT → Scanning (Nmap) → Vulnerability Assessment
Web: Web Hacking & OWASP → Burp Suite → SQL Injection
Exploitation: Metasploit → Privilege Escalation
Defense and analysis: Packet Analysis & IDS → Malware & RE → Cryptography
End-to-end practice: CTF & Practice Machines
Additional topics: Cloud → Wireless & IoT

01. Reconnaissance & OSINT#

CEH Module: Module 02 - Footprinting and Reconnaissance
Labs: 7

The first phase of any engagement: gathering information about the target, either passively or through direct interaction, using OSINT techniques, Google Dorks, and Shodan.

#	Lab	Platform
1	Passive Reconnaissance	TryHackMe
2	Active Reconnaissance	TryHackMe
3	Shodan.io	TryHackMe
4	Google Dorking	TryHackMe
5	Web OSINT	TryHackMe
6	Searchlight OSINT	TryHackMe
7	Red Team Recon	TryHackMe

02. Scanning & Enumeration (Nmap)#

CEH Module: Module 03 & 04 - Scanning Networks / Enumeration
Labs: 6

Discovering live hosts, scanning ports and services, and going deeper with Nmap and RustScan.

#	Lab	Platform
1	Nmap: Live Host Discovery	TryHackMe
2	Nmap: Basic Port Scans	TryHackMe
3	Nmap: Advanced Port Scans	TryHackMe
4	Further Nmap	TryHackMe
5	Nmap	TryHackMe
6	RustScan	TryHackMe

03. Vulnerability Assessment#

CEH Module: Module 05 - Vulnerability Analysis
Labs: 3

Automated vulnerability scanning with tools such as OpenVAS and Nessus, and how to interpret their results.

#	Lab	Platform
1	Vulnerability Scanner Overview	TryHackMe
2	OpenVAS	TryHackMe
3	Nessus	TryHackMe

04. Networking & Protocols#

CEH Module: Foundation - Networking Fundamentals
Labs: 6

The foundation you need before attempting any attack: networking concepts, core protocols, and network security.

#	Lab	Platform
1	Networking Concepts	TryHackMe
2	Networking Essentials	TryHackMe
3	Networking Core Protocols	TryHackMe
4	Network Security Protocols	TryHackMe
5	Network Security Essentials	TryHackMe
6	Layer 2	TryHackMe

05. Web Fundamentals#

CEH Module: Foundation - Web Fundamentals
Labs: 8

How websites actually work: HTTP, DNS, and JavaScript. Understand the technology before you attack it.

#	Lab	Platform
1	Web Fundamentals	TryHackMe
2	Web Application Basics	TryHackMe
3	Web App Security 101	TryHackMe
4	JavaScript Essentials	TryHackMe
5	How Websites Work	TryHackMe
6	HTTP in Detail	TryHackMe
7	DNS in Detail	TryHackMe
8	Putting It All Together	TryHackMe

06. Web Hacking & OWASP#

CEH Module: Module 13 & 14 - Hacking Web Servers / Web Applications
Labs: 8

Hands-on practice with the OWASP Top 10: content discovery, authentication bypass, file upload flaws, and command injection.

#	Lab	Platform
1	OWASP Top 10 - 2021	TryHackMe
2	OWASP Juice Shop	TryHackMe
3	Walking An Application	TryHackMe
4	Content Discovery	TryHackMe
5	Authentication Bypass	TryHackMe
6	Subdomain Enumeration	TryHackMe
7	OS Command Injection	TryHackMe
8	Upload Vulnerabilities	TryHackMe

07. SQL Injection#

CEH Module: Module 15 - SQL Injection
Labs: 24

From the basics to Blind, Out-of-Band, and NoSQL injection. This section is split between TryHackMe and the PortSwigger Web Security Academy. Start with TryHackMe to build the foundation, then work through PortSwigger in order.

TryHackMe#

#	Lab	Platform
1	SQL Fundamentals	TryHackMe
2	Advanced SQL Injection	TryHackMe
3	SQL Injection Lab	TryHackMe

PortSwigger - Basic#

#	Lab	Level
1	SQL injection vulnerability in WHERE clause allowing retrieval of hidden data	Apprentice
2	SQL injection vulnerability allowing login bypass	Apprentice

PortSwigger - Examining the Database#

#	Lab	Level
1	Querying the database type and version on Oracle	Practitioner
2	Querying the database type and version on MySQL and Microsoft	Practitioner
3	Listing the database contents on non-Oracle databases	Practitioner
4	Listing the database contents on Oracle	Practitioner

PortSwigger - UNION Attacks#

#	Lab	Level
1	UNION attack: determining the number of columns	Practitioner
2	UNION attack: finding a column containing text	Practitioner
3	UNION attack: retrieving data from other tables	Practitioner
4	UNION attack: retrieving multiple values in a single column	Practitioner

#	Lab	Level
1	Blind SQLi with conditional responses	Practitioner
2	Blind SQLi with conditional errors	Practitioner
3	Visible error-based SQLi	Practitioner
4	Blind SQLi with time delays and information retrieval	Practitioner
5	Blind SQLi with out-of-band interaction	Practitioner
6	Blind SQLi with out-of-band data exfiltration	Practitioner

PortSwigger - Filter Bypass#

#	Lab	Level
1	SQLi with filter bypass via XML encoding	Practitioner

PortSwigger - NoSQL Injection#

#	Lab	Level
1	Detecting NoSQL injection	Apprentice
2	Exploiting NoSQL operator injection to bypass authentication	Practitioner
3	Exploiting NoSQL injection to extract data	Practitioner
4	Exploiting NoSQL operator injection to extract unknown fields	Expert

08. Burp Suite#

CEH Module: Module 14 - Hacking Web Applications (Tooling)
Labs: 5

The core tool for any web pentester: Proxy, Repeater, Intruder, and extensions.

#	Lab	Platform
1	Burp Suite: The Basics	TryHackMe
2	Burp Suite: Repeater	TryHackMe
3	Burp Suite: Intruder	TryHackMe
4	Burp Suite: Other Modules	TryHackMe
5	Burp Suite: Extensions	TryHackMe

09. Exploitation & Metasploit#

CEH Module: Module 06 - System Hacking
Labs: 3

Exploiting vulnerabilities with Metasploit and working with Meterpreter post-exploitation.

#	Lab	Platform
1	Metasploit: Introduction	TryHackMe
2	Metasploit: Exploitation	TryHackMe
3	Metasploit: Meterpreter	TryHackMe

10. Privilege Escalation#

CEH Module: Module 06 - System Hacking
Labs: 6

Escalating privileges on Linux and Windows, bypassing UAC, and establishing persistence.

Linux#

#	Lab	Platform
1	Linux Privilege Escalation	TryHackMe
2	Common Linux Privesc	TryHackMe
3	Linux PrivEsc	TryHackMe

Windows#

#	Lab	Platform
1	Windows PrivEsc	TryHackMe
2	Bypassing UAC	TryHackMe
3	Windows Local Persistence	TryHackMe

11. Packet Analysis & IDS#

CEH Module: Module 08 & 12 - Sniffing / Evading IDS, Firewalls & Honeypots
Labs: 10

Traffic analysis with Wireshark, Tcpdump, and TShark, plus intrusion detection systems such as Snort and Zeek and how they are evaded.

#	Lab	Platform
1	Wireshark 101	TryHackMe
2	Wireshark: The Basics	TryHackMe
3	Wireshark: Packet Operations	TryHackMe
4	Tcpdump	TryHackMe
5	TShark: The Basics	TryHackMe
6	Snort	TryHackMe
7	Snort Challenge 1	TryHackMe
8	IDS Fundamentals	TryHackMe
9	IDS Evasion	TryHackMe
10	Zeek	TryHackMe

12. Malware & Reverse Engineering#

CEH Module: Module 07 - Malware Threats
Labs: 10

From the history of malware to static and dynamic analysis and anti-reverse-engineering techniques.

#	Lab	Platform
1	History of Malware	TryHackMe
2	Malware Introductory	TryHackMe
3	Basic Malware RE	TryHackMe
4	REMnux v2	TryHackMe
5	Basic Dynamic Analysis	TryHackMe
6	Advanced Dynamic Analysis	TryHackMe
7	Static Analysis	TryHackMe
8	Advanced Static Analysis	TryHackMe
9	Anti-Reverse Engineering	TryHackMe
10	MalDoc	TryHackMe

13. Cryptography#

CEH Module: Module 20 - Cryptography
Labs: 4

Cryptography fundamentals, common encryption types, and cracking hashes.

#	Lab	Platform
1	Cryptography for Dummies	TryHackMe
2	Encryption - Crypto 101	TryHackMe
3	Crack The Hash	TryHackMe
4	Crack The Hash Level 2	TryHackMe

14. CTF & Practice Machines#

CEH Module: Practice - End-to-End Application
Labs: 9

Full machines where you apply everything you have learned: recon, exploitation, and privilege escalation. Best tackled after finishing the previous sections.

#	Machine	OS	Difficulty	Platform
1	Vulnversity	Linux	Easy	TryHackMe
2	Basic Pentesting	Linux	Easy	TryHackMe
3	Steel Mountain	Windows	Easy	TryHackMe
4	Kenobi	Linux	Easy	TryHackMe
5	RootMe	Linux	Easy	TryHackMe
6	Pickle Rick	Linux	Easy	TryHackMe
7	Simple CTF	Linux	Easy	TryHackMe
8	Lazy Admin	Linux	Easy	TryHackMe
9	Ignite	Linux	Easy	TryHackMe

15. Cloud#

CEH Module: Module 19 - Cloud Computing
Labs: 7

Cloud security fundamentals, AWS, Infrastructure as Code, and VPC attacks.

#	Lab	Platform
1	Introduction to Cloud Security	TryHackMe
2	Cloud 101 (AWS)	TryHackMe
3	Cloud-based IaC	TryHackMe
4	Azure DevSecOps	TryHackMe
5	Attacking and Defending VPCs	TryHackMe
6	Eyes Wide Shut	TryHackMe
7	Can You GA	TryHackMe

16. Wireless & IoT#

CEH Module: Module 16 & 18 - Hacking Wireless Networks / IoT & OT
Labs: 4

Attacking wireless networks, printers, and IoT devices.

#	Lab	Platform
1	WiFi Hacking 101	TryHackMe
2	Printer Hacking 101	TryHackMe
3	IoT Intro	TryHackMe
4	Royal Router	TryHackMe

Tips for Getting the Most Out of These Labs#

Take notes on every lab: the tool, the command, and the idea behind it, so you can come back to them later.
Avoid walkthroughs until you have genuinely tried on your own.
Repeat labs a few days later without looking at the solution. This is what makes the knowledge stick.
Map each lab to its CEH module to reinforce your exam preparation.

These labs are for learning and practice in authorized environments only. Never test any technique on systems you do not own or have explicit permission to test.