How to become a certified ethical hacker

Certified ethical hackers get paid to break into computers. If this sounds fun to you, then it is probably a career path that you should seriously consider.

Hacking originated in the 1960s when early computer users started building their hardware and writing free code to run on them. It was a great era in computing history.

However, the Internet brought malicious hackers to light. The type that loves to plunder and steal from less savvy computer users. Those who write and distribute malware, or even steal CPU time to mine cryptocurrencies.

To counter this trend, the term “ethical hacker” has come to define that upstanding type of hacker. The one that defends the network from malicious intruders. The computer expert that companies like to keep on their payroll.

This guide shows you how to become such an ethical hacker.

What is Ethical Hacking?

The term ‘hacker’ or ‘hacking’ has become so negative in recent times, given the rise of malicious hackers over the Internet. But computer hacking started as an intellectual endeavor during the 1960s and 1970s.

The goal of hacking back then was neither Bitcoin ransoms nor theft of sensitive information. Hacking was a way to show your intellectual superiority. To solve a problem that no one else could solve. And the best reward was bragging rights.

As the Internet expands, more businesses than ever are going online every day. And given the limited computer knowledge of most business people, organizations are willing to employ good hackers of the old sort to protect their digital infrastructure from attacks.

Those old types of hackers, the ones with good intentions, who love to solve problems for problems’ sake, and who value honor over money, are called ethical hackers. The work they do in protecting organizations is called ethical hacking.

Why choose ethical hacking

The information security field offers many advantages for the ethical hacker, and this includes both financial rewards and the ability to help make the world a better place.

Salaries of certified hackers average $90,000 per year. With top professionals earning well over $100,000. And freelancers earning up to $40,000 or more, per project.

In addition to working for an organization and earning well, you can also develop your security outfit or system, and either sell or give it out for free.

The market for certified ethical hackers continues to grow and the firms seeking to employ top talent, include prestigious organizations from the armed forces to global conglomerates. Another advantage here is that a CEH certificate can help you to land more juicy positions in these organizations.

The EC Council & CEH Certificate

The EC Council is the oldest organization that is concerned with matters regarding ethical hacking. They offer the Certified Ethical Hacker (CEH) certification, which is highly regarded by firms looking to employ information security experts.

The EC Council also hosts the code of ethics, which is the guideline that all security experts must adhere to, to be considered an ethical hacker.

This code forbids acts such as selling personal information without client consent, using illegal software and systems, bribery, double billing, purposefully compromising an organization’s systems, and other activities that may be considered unethical or immoral.

EC-Council stands for the International Council of Electronic Commerce Consultants. It is an American organization headquartered in Albuquerque, New Mexico. The organization started the CEH program in 2003 and has since certified over 230,000 professionals from 145 countries.

Background & Requirements

There are a few requirements to becoming a certified ethical hacker. And they are as follows:

Criminal records – The EC-Council’s code of ethics condemns having a criminal record. Plus, many firms will conduct extensive background checks before offering you an Infosec position.
2-year Industry Experience – This is only necessary if you wish to take the CEH exam without taking the CEH course.
3-year Certificate Duration – The CEH certificate is valid for 3 years, after which you have to retake the exam.
Exam fee – $1,199. This is the cost of taking the examination.
Annual renewal fee – The EC-Council charges an $80 annual renewal fee.

How to become a certified Ethical Hacker (CEH)

It is expected that you take the Certified Ethical Hacker course first, before going for the exam. But if you wish to take the exam directly, you will need to provide a 2-year industry experience proof.

The course offers 6 months of online access and teaches you all the skills you need to become a competent hacker. And when you are done learning, then it is time to take the exam.

The Examination

The current version of the EC-Council’s examination comes with 125 multi-choice questions. It costs $1,199 and has a 4-hour limit.

The CEH focuses on the latest malware and other computer threats, such as IoT hacking and the latest tools in the market. Below is a list of topics you can expect.

Scanning networks
Sniffing
Footprinting and reconnaissance
Avoiding IDS, firewalls, and honeypots
Malware threats
Cryptography
Session hijacking
Hacking web servers and applications
Social engineering
SQL injection
Denial of service
Hacking wireless networks
Cloud servers

Other certifications

Although the EC-Council is the oldest, there are still other ethical hacking organizations. Some offer just training, while others include certificates. But while their certifications might not be as recognized as the CEH certificate, it is still worthwhile to know them and what they offer.

They are:

GIAC GPEN – GIAC is another organization that offers popular training and certifications for hackers. There are many to choose from, but the GPEN is a popular one.

GIAC stands for Global Information Assurance Certification, while GPEN stands for GIAC Penetration tester. It costs $2,400 and there are no course requirements. So, you just need to register for the exam if you already know your stuff.

The exam is available online and lasts for 3 hours. It includes up to 115 questions and has a 75% minimum passing score.
CREST – The CREST organization also offers penetration testing courses and certifications. It is recognized in many countries and has a code of conduct similar to EC-Council’s code of ethics.
Offensive Security OSCP – Offensive Security is the developer of Kali Linux, the hacker OS of choice. They offer a pen-testing course based on Kali and the highly respected Offensive Security Certified Professional (OSCP) certificate from $999. This certificate is respected because you have to earn it, not just buy it.

Popular Tools of the trade

An ethical hacker uses the same tools that malicious hackers operate with. The only difference is that the ethical hacker maintains good conduct.

So, here are the most popular tools out there to get your feet wet. Most are free, including the Kali Linux OS. So, there should be no excuses not to try them out.

Kali Linux – A Linux OS designed specifically for pen testing and hacking. It comes pre-installed with most of the tools below.
Nmap – Port scanner and mapper. Flexible and versatile.
Wireshark – Excellent packet sniffer or network protocol analyzer. Very popular.
Metasploit – Best platform for launching penetration testing or hacking attacks.
Aircrack-ng – Detects, sniffs, and helps you crack WiFi networks.
Hashcat – The world’s fastest password cracker.
John the Ripper – Powerful dictionary-based password cracker
Sqlmap – Automates SQL injections and database attacks
Ettercap – Packet sniffer for man in the middle attacks
Burp Suite – Online vulnerability scanner and penetration package
Netsparker – Online vulnerability scanner
Acunetix – Detects 7,000+ web vulnerabilities, but is a little pricey

Conclusion

We have reached the end of this guide to becoming a certified ethical hacker and you have seen the advantages of getting certified, the process of doing it, and the other available options.

Where you go from here, however, is up to you. But keep in mind that most ethical hacking positions prefer candidates with accredited certifications.