checksec Literacy

checksec and readelf summarize NX, canary, PIE, RELRO — run on YOUR $PWN_LAB toys; defenders gate releases on green rows.

15 min+40 XP3 quiz

Module progress3 of 5

Visual · pwn_checksec_literacy

checksec literacy. $PWN_LAB only. Original Cyberlium.

Opening

One checksec line answers 'did we ship hardening?' — run it on every toy release build.

checksec (pwntools script or packaged equivalent) prints NX, canary, PIE, RELRO for ELF binaries. readelf -l confirms GNU_STACK flags; readelf -d shows BIND_NOW. Cyberlium uses checksec as literacy gate — not as a bypass checklist. Run on YOUR toy secure build at $PWN_LAB; archive screenshot or text in chmod 600 notes. Next: Protections Lab.

1. Reading checksec output (named)

NX enabled, Canary found, PIE enabled, Full RELRO — target row for secure toy. Missing canary or No PIE flags weak builds — document intentionally for contrast builds inside lab only.

Paste exact checksec text with toy sha256 and build command — reproducible verification.

Command guide

Try these commands — Reading checksec output (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

checksec.sh — https://github.com/slimm609/checksec.sh (NX/PIE/Canary/RELRO table) readelf -l — https://man7.org/linux/man-pages/man1/readelf.1.html (if checksec missing) pwn.college — https://pwn.college/ (protection awareness in authorized labs)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

pipx install checksec.py  # or: sudo apt install checksec
sudo apt install binutils

macOS:

Command — copy this

pipx install checksec.py
brew install binutils

Windows: Use WSL: pipx install checksec.py Use WSL binutils

═══ LINUX / macOS ═══

Command — copy this

export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
if command -v checksec >/dev/null 2>&1; then
  checksec --file="$LAB_PWN/bin/bof_noprotect"
  checksec --file="$LAB_PWN/bin/bof_pie_relro"
else
  echo 'checksec not installed — readelf fallback for NX/RELRO literacy'
  readelf -l "$LAB_PWN/bin/bof_noprotect" | grep GNU_STACK
  readelf -l "$LAB_PWN/bin/bof_pie_relro" | grep -E 'GNU_STACK|GNU_RELRO'
  readelf -d "$LAB_PWN/bin/bof_pie_relro" | grep BIND_NOW
fi

Primary tools to practice this lesson: checksec, readelf. Reference sites: checksec.sh (https://github.com/slimm609/checksec.sh); readelf -l (https://man7.org/linux/man-pages/man1/readelf.1.html); pwn.college (https://pwn.college/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. CLI alternatives

readelf -W -l binary | grep GNU_STACK — RWE vs RW. objdump -x shows DYNAMIC and security properties on some targets.

CI pipelines can fail builds when checksec regresses — defender automation habit.

3. Literacy ≠ bypass hunting

Forbidden: 'checksec says no canary — here is exploit.' Allowed: 'checksec missing canary — rebuild with -fstack-protector-strong and retest.'

Ship: checksec transcript for secure toy + one-line interpretation per flag. Next: Protections Lab.

4. What you ship: checksec transcript for $PWN_LAB

Full checksec output for secure toy build with sha256 and gcc line. Interpret NX/Canary/PIE/RELRO. NO bypass notes. chmod 600.

5. What you record before the next lesson

Date. checksec transcript. $PWN_LAB named. File t24-m04-l03-checksec-literacy.txt chmod 600.

6. Wrong vs right: weaponized exploits vs memory-safety literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong
Use checksec only to pick exploitation targets on production. Skip archiving build command.
Right
Archive checksec output with interpretation for YOUR secure toy. Next: Protections Lab.

Mission: run checksec on secure toy

1) Paste checksec output. 2) Interpret four flags in one sentence each. 3) Log gcc command and sha256. 4) chmod 600.

Stuck? Ask Cyberlium AI Mentor

Green checksec row is a release gate — not a trophy for attackers.

Knowledge Check

APPLY: checksec literacy means:

Multiple choice

Knowledge Check

APPLY: True or False: Full RELRO in checksec indicates stronger GOT hardening than Partial.

True or False

Knowledge Check

APPLY: Missing stack canary in checksec suggests:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP