I have a CEH certification and attended the official training for it. The course material is sub-par in my opinion.
The CEH training has quite a lot of video material, which you can consider to be akin to a lecture over the topic. Positive about the video material was that it was spoken in consistent English with an understandable accent, so it should be easy to follow for non-native speakers. My only gripes with the video material is that the instructor seems to repeatedly try to "impress" the viewer with "cool hacker things", while not going into enough technical details to be useful.
The slides during the video and available separately are unimpressive at best and absolutely horrible at worst. There are slides, which I have shown to penetration testers with years and years of experience, and all I got from them was looks of confusion.
One slide in particular seemed to have been a conflation of two completely different attacks, which was completely non-sensical. Even the instructor was very confused by the slide and just handwaved it away (akin to "So yeah...and as you can see, then the attack succeeds")
For most of the slides, you already needed to have an understanding of the concept in question for the slide to make sense. And if knowing what Cross-Site Request Forgery is and how it works is a prerequisite to understanding a slide aimed to teach what Cross-Site Request Forgery is and how it works - then that slide is not very good.
The practice questions
EC Council offers a 50 question "CEH assessment", which you can find here. I went through a handful of questions, but I had to stop halfway through because I didn't want to subject myself to it any longer.
A some of questions involve "name dropping", such as talking about Spectre and Meltdown, which insinuate that CEH would go into details about these vulnerabilities, how they came to be and how they can be exploited - however, CEH is an entry level exam and not technical by any means. These questions are irrelevant at best and deceptive at worst.
Furthermore, EC Council loves to provide questions where none of the answers are correct, and you are supposed to find the least wrong answer. An example:
In the Permanent Denial-of-service, the attacker will uses the ‘Bricking a system’ method, in order to ________
- Send fraudulent hardware updates to the victims
- Launch a massive denial of service attacks and compromise websites
- Exploit weaknesses in programming source code
- Send malicious email attached to the victim
The correct answer is "3. Exploit a weakness in the programming source code". So the question claims that an attacker will permanently destroy a device, in order to exploit it. This makes no sense whatsoever. A lot of the questions are like this, and it's infuriating.
When the questions aren't nonsensical, they're questions about specific flags in specific programs, like "Which flag do you need to pass to
hping3 to send an ICMP packet?" - you know, the stuff you look up in 10 seconds in a man page. While tangentially related to "ethical hacking", it doesn't check whether or not the student understood anything, but only asks if they are able to remember meaningless details.
The exam is a multiple choice exam with 125 questions. It's advertised as lasting 4 hours, but I took my time and finished in 45 minutes and still passed easily. I'd say 1-2 hours is more realistic.
The exam question were more of the same really, but the amount of nonsensical questions was greatly reduced. There was one question which was completely unrelated to ethical hacking, and I assume that question was supposed to go to a different exam altogether.
Should you do the CEH? I would say, if you work for a company that has too much money to burn and requires you to have some certification, then go for the CEH. If you're a pentester, then the test should be a breeze for you. The only questions you need to study for are the "which flag do you use to..."-questions.
In any other case, don't go for it. Do the OSCP or Pentest+ instead.