Pwn Recon — checksec + Cyclic Offset — snippets

2026-08-06 bash checksec Binary Exploitation

Pwn Recon — checksec + Cyclic Offset

First moves against a pwn target: read the binary''s mitigations (NX/PIE/RELRO/canary), then pin the overflow offset with a De Bruijn pattern.

bash

# which mitigations are in play?
checksec --file=./<binary>

# find the exact offset to the saved return address
pwn cyclic 200            # generate a pattern, feed it to the crashing input
pwn cyclic -l 0x<value>   # look up the offset from the value that landed in RIP/EIP

used in: Ret2Win with Stack-Alignment Fix (CET/SHSTK)