or: what I was thinking in a closed room in Bangalore, 6 hours of hacking ahead of me
I’ve never sat a 6-hour exam before.
College exams were three hours, pen and paper, you walk out. But 6 hours on a terminal, proctored, with 20 practical challenges waiting? That’s not an exam. That’s a small battle.
The room was closed. Bangalore traffic bled through the window anyway—horns, autos, a dog somewhere. And I sat there, staring at the login screen, repeating one thing:
Maximum effort.
Stupid, but it worked. Not “I will pass.” Not “I am a great hacker.” Just: whatever happens, put everything in. If I fail, I fail having given it all.
That’s the headspace I want to start with. Not confidence. Not a checklist. Just honesty about why I—a SOC analyst, a defender—decided to take an offensive certification.
The elephant in the room#
CEH gets side-eye in infosec. “It’s multiple choice.” “It’s an HR checkbox.” “It doesn’t make you a real hacker.”
Some of that is fair. The written exam tests theory more than hands-on skill. But CEH Practical is different. Fully hands-on. 20 challenges. 6 hours. A live environment. Break in, find flags, move laterally, crack passwords, hide data. I scored 16/20. Decent. Not legendary. Enough.
But I’m not writing about the score. I’m writing about what the exam forced me to face.
As a SOC analyst, I’ve spent years looking at attacks from the outside. Logs. Alerts. pcaps. I know what an nmap scan looks like in Splunk, or how a brute-force attack floods Event ID 4625. I know the footprints. But I rarely walk in the shoes.
CEH Practical made me do the walking.
The series promise: two sides of the wire#
Most CEH guides are attacker playbooks—useful, but missing what happens on the other end. This series will be different.
Every post: attacker terminal and SOC signal. I’ll show commands (nmap, hydra, sqlmap, steghide) and then what those actions generate in a SIEM. What’s loud. What’s quiet. What slips through.
Eight posts. This intro, six deep-dives into the CEH Practical domains (recon, scanning, credential attacks, exploitation, web attacks, stego/crypto), and a final debrief of the 6 hours—what was hard, what my SOC background helped with, where I overthought.
600–900 words each. Code blocks. Tools used. No filler.
Why bother?#
Because understanding both sides doesn’t just make you a better hacker. It makes you a sharper defender. The best SOC analysts think like attackers—not out of malice, but because they can anticipate. They know what’s easy to hide and what’s hard. When an alert matters, and when it’s noise.
That’s the muscle I wanted to build. If you’re a defender wondering whether CEH Practical is worth it, or studying for it and want the SIEM layer nobody writes about, I think you’ll find this useful.
Let’s begin.
Maximum effort.
