checksec
Go-based utility for checking executable hardening properties including RELRO, stack canaries, NX bits, PIE, and FORTIFY_SOURCE.
Technical Architecture & Overview
Checksec is a Go-based utility (a rewrite of the original Tobias Klein checksec.sh) that inspects compiled ELF executables, shared libraries, and running processes to verify compiler security mitigations. It reports on Stack Canaries, No-Execute (NX), Position Independent Executables (PIE), Read-Only Relocations (RELRO), and Fortify Source protections.
Targeted Technical Use Cases
Verifying that third-party packages and production binary releases include required compiler mitigations.
Evaluation & Trade-offs
Core Strengths
- +Fast inspection across individual files, whole directories, or running process IDs.
- +Outputs JSON, XML, and YAML for automated CI/CD build verification.
- +Flags missing binary protections across software dependencies.
Trade-Offs & Limitations
- -Evaluates binary headers and compile flags rather than runtime logic flaws.
- -Focuses primarily on ELF binaries on Unix-based systems.
Defensive Security Application
Auditing production builds to guarantee that memory safety mitigations are active before software deployment.
Frequently Asked Questions
What is checksec?→
Checksec is a Go-based utility (a rewrite of the original Tobias Klein checksec.sh) that inspects compiled ELF executables, shared libraries, and running processes to verify compiler security mitigations. It reports on Stack Canaries, No-Execute (NX), Position Independent Executables (PIE), Read-Only Relocations (RELRO), and Fortify Source protections.
What is checksec used for?→
Verifying that third-party packages and production binary releases include required compiler mitigations.
What are the strengths of checksec?→
- +Fast inspection across individual files, whole directories, or running process IDs.
- +Outputs JSON, XML, and YAML for automated CI/CD build verification.
- +Flags missing binary protections across software dependencies.
What are the limitations of checksec?→
- +Evaluates binary headers and compile flags rather than runtime logic flaws.
- +Focuses primarily on ELF binaries on Unix-based systems.
How is checksec used defensively?→
Auditing production builds to guarantee that memory safety mitigations are active before software deployment.