EC-Council CEH v13 · CompTIA PenTest+
Think like an attacker — legally. This ethical hacking and penetration testing course follows the EC-Council CEH v13 methodology from reconnaissance through exploitation to professional report writing, aligned to both EC-Council CEH v13 and CompTIA PenTest+ (PT0-003). Run real attacks in a controlled, browser-based lab using Kali Linux, Metasploit, Burp Suite, Nmap, Hydra and Aircrack-ng — the same toolkit used by professional pen testers across South Africa. Available live online or hybrid (Midrand campus).
Passive OSINT: Maltego, Shodan, theHarvester, WHOIS, Google dorks. Active scanning: Nmap host discovery, port scanning, OS fingerprinting, service enumeration. Vulnerability scanning with Nessus, OpenVAS and Nikto, and validating findings. Modifying Python, Bash and PowerShell recon scripts. Lab: full recon against a target lab environment.
Metasploit framework architecture, modules and payloads. Exploiting known CVEs against Metasploitable2. Password attacks: Hydra brute-force, John the Ripper, pass-the-hash. Malware types and analysis basics. Privilege escalation on Linux (SUID, sudo misconfig) and Windows (token impersonation, unquoted service paths — Windows labs run on TryHackMe).
OWASP Top 10 hands-on: SQL injection (manual + sqlmap), XSS (reflected/stored/DOM), CSRF, IDOR, file inclusion (LFI/RFI), broken authentication. Burp Suite: proxy, repeater, intruder, scanner. Sniffing, session hijacking, denial-of-service concepts and IDS/firewall evasion. Lab: attack DVWA, WebGoat and Juice Shop in your browser lab.
WPA2/WPA3-PSK cracking, evil twin AP setup, deauthentication attacks, Bluetooth vulnerabilities. Android and iOS attack surface, IoT and OT threats. Cloud attacks: container escapes, metadata service abuse, IAM misconfiguration. Social engineering methodology: phishing, pretexting, vishing. All wireless labs run in your browser—no USB adapter needed.
Post-exploitation: persistence, lateral movement, pivoting basics, covering tracks. AI attacks: prompt injection and model manipulation. Cryptography review. Professional pen test report writing: executive summary, findings, CVSS scoring, remediation recommendations. CEH v13 and PenTest+ exam-objective review, mock exams, and module capstone assessment.
Taught by Arnold — Code College founder, lead trainer and practitioner with 20+ years of developer and security training experience. Live sessions, not pre-recorded videos — recordings are available for catch-up.
Every topic has a corresponding lab exercise on Code College’s private lab server, opened in your browser — nothing to install. Windows privilege-escalation labs run on TryHackMe. You build, break and defend real systems — building a portfolio of lab evidence from day one.
Join 100% live online from anywhere in South Africa, or hybrid — one or two days a week at our Midrand campus and the rest live online. Both options deliver the same experience. Full-time face-to-face classes are available on request.
Earn the “Ethical Hacker” Code College Digital Badge on passing the module assessment — immediately shareable to LinkedIn. Stack badges toward the full bootcamp certificate.
Yes — all practical work is performed in isolated, intentionally vulnerable lab environments on Code College’s private, isolated lab server (opened in your browser) or on legal platforms like TryHackMe. The module includes a professional ethics session covering computer crimes legislation in South Africa (ECTA, Cybercrimes Act 2020) and the boundaries of lawful security testing.
All wireless hacking labs run in your browser on Code College’s private lab server. No Wi-Fi adapter, no local tools, no hardware needed. You get a simulated wireless environment that behaves exactly like real WPA2/WPA3 networks, allowing you to practice reconnaissance, password cracking, and packet injection attacks without special hardware.
The EC-Council Certified Ethical Hacker v13 is a globally recognised offensive security certification. The exam is 125 multiple-choice questions over 4 hours. This module maps to all 20 CEH v13 domains. The exam voucher is purchased separately from EC-Council (about R15,500–R19,500, depending on whether you write online or at a test centre), and you must first be approved through EC-Council’s eligibility application — see the exam-cost question below.
Absolutely. Understanding offensive techniques makes you a significantly better defender. SOC analysts and incident responders with Module 3 knowledge understand attacker behaviour at a level that improves detection quality and investigation speed. Many blue team professionals hold both CEH and CySA+.
The CEH v13 exam (312-50) voucher costs US$950 (about R15,500) for EC-Council’s remote-proctored exam, or US$1,199 (about R19,500) to write at a Pearson VUE test centre in Johannesburg.
Module 3 is CEH v13-aligned training. It is not official EC-Council courseware, and Code College is not an EC-Council Accredited Training Centre. To write CEH, you apply to EC-Council through its eligibility application: you need at least two years of verifiable information security work experience, and you pay a US$100 (about R1,600) non-refundable application fee. EC-Council contacts the references you list to verify your experience.
The CEH Practical exam (US$550, about R9,000) has the same eligibility rules.
Already working in IT security? Apply for eligibility during the module, and you can write soon after you finish. New to the field? See the next question.
Not straight away. Module 3 gives you the knowledge and hands-on skills CEH tests, but EC-Council requires two years of verifiable information security experience before it will approve you to write. Most of our career changers write CompTIA PenTest+ at the end of Module 3 (it has no eligibility requirement), start in a junior SOC, vulnerability assessment or IT security role, and write CEH once they qualify.
CompTIA PenTest+ (PT0-003) is a vendor-neutral penetration testing certification covering engagement management, reconnaissance and enumeration, vulnerability discovery, attacks and exploits, and post-exploitation. The exam has a maximum of 90 multiple-choice and performance-based questions in 165 minutes, with a pass mark of 750 on a 100–900 scale.
Yes, you can write it straight away. There is no mandatory prerequisite. CompTIA recommends Network+ and Security+ level knowledge and 3–4 years of pen testing experience, but this is guidance, not an entry requirement. The voucher costs about R5,900 (US$360 at CompTIA’s South African list price; discounted vouchers are available from local resellers) and can be written online or at a test centre.
Entry-level pen testers earn R300,000–R600,000 per year. Mid-level professionals with 2–5 years’ experience earn R700,000–R1.2M. Senior pen testers and red team leads earn R1.2M–R2M+. Demand is growing as POPIA’s security safeguards push South African companies toward regular security testing of their systems.
Module 3 Fee (Required): R12,000
Optional Premium Subscriptions (not required):
TOTAL SCENARIOS:
Third-party prices are in US dollars and converted at roughly R16.30/US$ (September 2026); rand amounts will move with the exchange rate.
Enrol in this ethical hacking course as a standalone module or as part of the full Cybersecurity Bootcamp. Live online or hybrid at our Midrand campus in Johannesburg.