Which of the following is a common technique to bypass CFI?

Overwriting the return address on the stack

Data-only attacks that do not alter control flow

Using a ROP chain with gadgets from the binary

Using a GOT overwrite to redirect a function call

An attacker has a stack buffer overflow in a program compiled with all standard mitigations: ASLR, NX, stack canaries, and Full RELRO. They have a format string vulnerability that can leak arbitrary memory. Which of the following is the most efficient first step to exploit this vulnerability?

Place shellcode on the stack and jump to it

Overwrite the GOT entry of a function

Brute-force the canary and ASLR

Leak a stack canary and a libc address

When a binary is compiled as PIE, what is the primary challenge for an attacker?

The base address of the executable is randomized

The canary is placed before the return address

A tester is exploiting a stack overflow in a binary with a stack canary and ASLR enabled. The tester has a way to leak the canary value. Which additional information is needed to build a reliable ROP chain?

The address of the stack buffer that will hold the ROP chain.

The address of a libc function or the binary base address.

The address of the GOT entry for a function that will be called after the overflow.

The value of the stack canary, which is already leaked.

An attacker has a buffer overflow vulnerability but ASLR is enabled. They do not have a way to leak a memory address. Which technique could still allow them to redirect execution to a function within the same binary?

Brute-forcing the 32-bit ASLR entropy

Ret2libc with a hardcoded libc base

Partial overwrite of the return address

Using a ROP chain with addresses from the heap

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 2Objective 1

Bypassing Linux Exploit Mitigations GXPN Practice Questions (Page 2)

Part of the Exploit Mitigation Bypass Techniques domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 3–6 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

9concepts

Questions 6–10

6foundation · easy
Which of the following is a common technique to bypass CFI?
Select an answer first
7foundation · easy
An attacker has a stack buffer overflow in a program compiled with all standard mitigations: ASLR, NX, stack canaries, and Full RELRO. They have a format string vulnerability that can leak arbitrary memory. Which of the following is the most efficient first step to exploit this vulnerability?
Select an answer first
8foundation · easy
When a binary is compiled as PIE, what is the primary challenge for an attacker?
Select an answer first
9application · medium
A tester is exploiting a stack overflow in a binary with a stack canary and ASLR enabled. The tester has a way to leak the canary value. Which additional information is needed to build a reliable ROP chain?
Select an answer first
10foundation · easy
An attacker has a buffer overflow vulnerability but ASLR is enabled. They do not have a way to leak a memory address. Which technique could still allow them to redirect execution to a function within the same binary?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.