Visit Apps Ved →

checksec

audit security features in ELF binaries

TLDR

Check security properties of a binary
$ checksec --file=[path/to/binary]
Check security properties with JSON output
$ checksec --file=[path/to/binary] --output=json
Check the running kernel's security features
$ checksec --kernel
Check security properties of a running process
$ checksec --proc [pid]
Scan all binaries in a directory
$ checksec --dir [path/to/directory]
Check all running processes
$ checksec --proc-all

SYNOPSIS

checksec [--file binary] [--dir directory] [--proc pid] [--kernel] [--output format]

DESCRIPTION

checksec audits security features enabled in compiled Linux executables (ELF files), the kernel, or running processes. It helps security researchers and administrators assess the exploitability posture of binaries by checking for common mitigations.Security properties checked:RELRO (Relocation Read-Only) - Protects GOT/PLT from being overwritten. Full RELRO marks these as read-only after dynamic linking.Stack Canary - Random value placed before return addresses to detect buffer overflows.NX (No eXecute) - Marks memory regions as non-executable, preventing code execution from stack/heap.PIE (Position Independent Executable) - Enables ASLR by allowing random base address loading.FORTIFY - Compile-time buffer overflow checks for common functions.

PARAMETERS

--file binary

Check security properties of specified binary
--dir directory
Scan all binaries in directory
--proc pid
Check running process by PID
--proc-all
Check all running processes
--kernel
Check kernel security features
--output format
Output format: cli, csv, json, xml
--fortify-file binary
Detailed fortify analysis

INSTALL

sudo dnf install checksec
sudo pacman -S checksec
sudo apk add checksec-rs
sudo zypper install checksec
brew install checksec
nix profile install nixpkgs#checksec

CAVEATS

Color-coded output indicates security status: green for enabled protections, red for missing. Red doesn't always indicate a vulnerability—distribution vendors may make intentional tradeoffs when compiling binaries.

HISTORY

Originally written by Tobias Klein at trapkit.de. The tool has been actively maintained and expanded, moving from Bash to Golang, with the current version maintained at github.com/slimm609/checksec.

SEE ALSO

readelf(1), objdump(1), file(1)

RESOURCES

Source code