checksec.sh

No entries match these filters. Clear filters

1. docs update Sep 10, 2026 · issue 070

   checksec.sh gains --exploit for static mitigation-obstruction analysis with tiered verdicts, CI gating, and machine-readable output⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Gate CI on any technique being fully unobstructed — fail the pipeline if any verdict comes back VIABLE.
   copy

   $ checksec file ./target --exploit --fail-if=exploit.viable

   Get machine-readable exploitability verdicts to feed into downstream tooling or a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. — verdicts appear under the exploitability key with tier names as strings.
   copy

   $ checksec file ./target --exploit -o json

   Triage a specific high-risk technique in CI — fail only if GOT-overwrite is open at tier REQUIRES-LEAK or higher.
   copy

   $ checksec file ./target --exploit --fail-if=exploit.technique=got-overwrite

   • Adds --exploit flag to append a static mitigation-obstruction section to the default table, reporting which memory-corruption techniques (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ stack-bof-overwrite, ret2libc, got-overwrite, shellcode-injection, format-string, ret2plt, ret2dlresolve) the binary's posture fails to block, with tier labels VIABLE, LIKELY, REQUIRES-LEAK, REQUIRES-INPUT-CONTROL, ENABLER, or BLOCKED.
   • Adds --chain flag (implies --exploit) to assemble a labelled hypothesis exploit chain — a control-flow-hijack step plus compatible payload step — from VIABLE verdicts, always marked hypothesis.
   • Adds --fail-if=exploit.viable and --fail-if=exploit.technique=<rule-id> predicates (used with --exploit) for CI gating on exploitability tier.
   • Adds -o json output mode for --exploit results, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. verdicts under each report's exploitability key with tiers serialized as their string names (e.g. "VIABLE").
   • Adds -o llm output mode for --exploit results, producing a grounded, paste-into-an-LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. report with verdicts inline.

   +1 more show less

   • Each --exploit output line follows the format TIER rule-id technique citations, with a trailing Bar: line synthesizing overall attacker cost.

   6 details in Everything

2. docs update Sep 10, 2026 · issue 070

   checksec.sh gains -o llm output mode that emits self-grounding Markdown reports for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. analysis, with optional --exploit verdicts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Audit a binary and get a paste-ready LLM report with exploitability verdicts for each missing mitigation.
   copy

   $ checksec file ./app -o llm --exploit

   Scan an entire directory of binaries; the knowledge block is emitted only once, keeping token cost flat regardless of target count.
   copy

   $ checksec dir ./bins -o llm

   Use -o llm with your own prompt by stripping the built-in grounding directive via --llm-no-preamble.
   copy

   $ checksec file ./app -o llm --llm-no-preamble

   • Adds -o llm output format that emits a self-grounding Markdown report — including a grounding directive, a per-check knowledge block with fix guidance, and terse per-target result rows — designed to be pasted directly into an LLM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --llm-no-preamble flag to suppress the grounding directive when supplying a custom prompt.
   • Adds --exploit flag (usable with -o llm) to include inline static exploitability verdicts labelled VIABLE per attack technique, with a barrier description.
   • The -o llm mode is supported across file, dir, proc, procAll, and kernel modes; for multi-target scans (dir, procAll) the knowledge block is emitted once per run to keep grounding cost flat.

   4 details in Everything

3. docs update Sep 10, 2026 · issue 070

   checksec.sh gains --exploit exploitability reasoning, --chain hypothesis chains, -o llm LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-ready output, and CI gating predicates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Scan a directory of binaries and produce a grounded LLM-ready report with attack-technique verdicts for pasting into an LLM assistant.
   copy

   $ checksec --exploit -o llm --dir=./bins

   • Adds --exploit flag to append exploitability reasoning on top of raw checks, reporting which memory-corruption techniques (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ stack-bof-overwrite, ret2plt, got-overwrite) the binary's mitigation posture fails to obstruct, with tier verdicts (VIABLE, LIKELY, REQUIRES-LEAK, REQUIRES-INPUT-CONTROL, ENABLER, BLOCKED) and supporting citations (imports, relocations, segment permissions).
   • Adds --chain flag to include a labelled hypothesis exploit chain in the exploitability output (implies --exploit).
   • Adds -o llm output format rendering a self-grounding Markdown report — including finding meanings, fixes, and a grounding directive — designed to be pasted directly into LLM assistants such as Claude or ChatGPT.
   • Adds exploit.viable and exploit.technique=<id> CI gating predicates that cause checksec to exit non-zero when any technique reaches the VIABLE tier or a specific named technique (e.g. got-overwrite) reaches REQUIRES-LEAK or higher.

   4 details in Everything

4. docs update Sep 10, 2026 · issue 070

   checksec.sh adds --exploit exploitability reasoning and -o llm Markdown output for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-assisted analysis⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds --exploit flag to reason about which attack techniques the mitigation posture fails to obstruct, with evidence-cited, honest tiers that never claim exploitable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds -o llm output format that emits a self-grounding Markdown report designed to be pasted into an LLM assistant so it reasons from tool output rather than from memory.

   2 details in Everything

5. 3.2.0 Jun 17, 2026 · release notes

   checksec.sh 3.2.0 adds SafeStack, sanitizer, RISC-V CFI, W^X, and stack-clash detection plus a CI gate and parallel scanning.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.0 https://github.com/slimm609/checksec.sh.git
   # already have the repo? check out this version:
   $ git checkout 3.2.0

   └──▷ TRY IT
   Suppress advisory warnings and check a binary for the new sanitizer, SafeStack, and W^X properties.
   copy

   $ checksec --file=/usr/bin/target --no-warnings

   • Adds SafeStack detection for ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. binaries.
   • Extends CFI hardening detection to i386 CET and RISC-V Zicfilp/Zicfiss (landing pads and shadow stack) for RV32 and RV64.
   • Detects sanitizer instrumentation (ASAN, UBSAN, MSAN, TSAN, LSAN) via compiler-rt symbol prefix scan.
   • Adds Selfrando detection via the .txtrp section.
   • New W^X segment check (SeparateCode) asserts no PT_LOAD segment is simultaneously writable and executable.

   +6 more show less

   • Adds stack-clash protection detection via annobin .gnu.build.attributes notes (authoritative on RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence./Fedora/CentOS toolchains).
   • New RPATH/RUNPATH inspection classifies each entry as bad (relative/empty/world-writable), warning ($ORIGIN or nonexistent), or safe (absolute).
   • Adds annobin-based FORTIFY and GLIBCXX assertion detection.
   • New --fail-if CI gate exits non-zero when a required check is not in a good state.
   • Adds parallel directory scanning (RunListChecksParallel) over a bounded worker pool (default GOMAXPROCS).
   • Adds --no-warnings and --color flags; warnings now include filename context.

   11 details in Everything

6. 3.2.0 Jun 17, 2026 · issue 014

   checksec 3.2.0 adds SafeStack, sanitizer, W^X, Selfrando, and stack-clash detection plus a --fail-if CI gate and CSV output.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.0 https://github.com/slimm609/checksec.git
   # already have the repo? check out this version:
   $ git checkout 3.2.0

   └──▷ TRY IT
   Gate a CI pipeline on RELRO, canary, and PIE — fail the build if any binary in a directory is missing these hardening properties.
   copy

   $ checksec dir ./build/bin --recursive --fail-if relro,canary,pie

   Audit a single binary for the full new check suite (SafeStack, sanitizers, W^X, stack-clash) and emit machine-readable CSV for ingestion into a spreadsheet or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
   copy

   $ checksec file /usr/bin/myapp --output csv

   Run a clean, warning-free scan of a directory with forced color off — useful in log-heavy CI environments where ANSI codes break parsers.
   copy

   $ checksec dir /opt/app --recursive --no-warnings --color never --output json

   • Adds SafeStack detection for ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. binaries by scanning for the __safestack_init symbol.
   • Extends CFI hardening detection to i386 CET and RISC-V Zicfilp/Zicfiss (landing pads and shadow stack), covering both RV32 and RV64.
   • New sanitizer detection (ASAN, UBSAN, MSAN, TSAN, LSAN) via compiler-rt symbol prefix scan.
   • New Selfrando detection via the .txtrp ELF section.
   • New W^X segment check (SeparateCode): flags any PT_LOAD segment that is both writable and executable.

   +6 more show less

   • New stack-clash protection detection via annobin .gnu.build.attributes notes (authoritative on RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence./Fedora/CentOS; reports Unknown otherwise).
   • New RPATH/RUNPATH entry classifier: rates each entry as bad (relative/empty/world-writable), warning ($ORIGIN/nonexistent), or info (safe absolute).
   • New annobin-based FORTIFY/GLIBCXX assertion detection.
   • New --fail-if flag: exits non-zero when any specified check (comma-separated keys, e.g. relro,canary,pie) is not in a good state — enables use as a CI gate.
   • Parallel directory scanning (RunListChecksParallel) over a bounded worker pool (default GOMAXPROCS), reducing open syscalls on a recursive /usr/bin scan from ~18k to ~2k.
   • New --no-warnings flag suppresses warning output; new --color flag controls colorized output (auto, always, never); warnings now include filename context.

   11 details in Everything

7. 3.1.0 Dec 21, 2025 · release notes

   checksec.sh 3.1.0 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration./BTI and x86 SHSTK/IBT checks, BIND_NOW detection via DT_FLAGS_1, kernel module support, and header suppression.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.0 https://github.com/slimm609/checksec.sh.git
   # already have the repo? check out this version:
   $ git checkout 3.1.0

   └──▷ TRY IT
   Suppress headers and banners when piping checksec output into a parser or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion script.
   copy

   $ checksec --file=/usr/bin/sshd --disable-headers-banners

   Check a kernel module for security properties (e.g., RELRO, stack canary) alongside regular binaries.
   copy

   $ checksec --file=/lib/modules/$(uname -r)/kernel/drivers/net/tun.ko

   • Adds ARM PAC/BTI and x86 SHSTK/IBT (CET) detection for file-level security checks.
   • Detects BIND_NOW via DT_FLAGS_1 (DF_1_NOW) in addition to the legacy DF_BIND_NOW flag, improving RELRO full-binding detection accuracy.
   • Supports checking kernel modules (.ko files) as targets.
   • Supports binaries with no sections (e.g., stripped or static binaries).
   • New flag to disable headers and banners in output, enabling cleaner scripted/automated use.

   +3 more show less

   • Redirects warnings to stderr, separating diagnostic output from structured results.
   • Improved command usage descriptions and built-in examples in the CLI help output.
   • Adds package formats (RPM, DEB, etc.) via goreleaser for easier installation.

   8 details in Everything

8. 2.7.1 Jun 9, 2024 · release notes

   Adds cosign keyless signature verification capability to checksec.sh binary checks

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.7.1 https://github.com/slimm609/checksec.git
   # already have the repo? check out this version:
   $ git checkout 2.7.1

   • Adds cosign keyless signature support for verifying the integrity of binaries and scripts

   1 detail in Everything

9. 2.2.0 May 27, 2020 · release notes

   checksec.sh 2.2.0 adds selfrando checks and improves core dump analysis.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.2.0 https://github.com/slimm609/checksec.git
   # already have the repo? check out this version:
   $ git checkout 2.2.0

   └──▷ TRY IT
   Scan a binary to check for SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. forced randomness protections and core dump settings.
   copy

   $ checksec.sh --file=/path/to/binary

   • Adds selfrando checks to detect SELinux forced randomness protections.
   • Improves core dump checks for better accuracy.
   • Runs readelf in wide mode for enhanced output.

   3 details in Everything

10. 2.0.0 Jul 24, 2019 · release notes

    checksec.sh 2.0 adds MUSL support in a rewrite of the CLI and JSON output fixes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.0 https://github.com/slimm609/checksec.git
    # already have the repo? check out this version:
    $ git checkout 2.0.0

    • Adds MUSL support to the tool
    • Switches --proc option to use pgrep for process checks

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tool no longer supports short options; only long options (e.g., --proc, --proc-all) are available.