A stack canary is a random value placed between the buffer and the saved return address. Which of the following is a common method to bypass a stack canary?

Leaking the canary value through an information disclosure

Using a partial overwrite of the return address

Using a ROP chain to call mprotect

Overwriting the GOT entry of the canary check function

Which of the following is a key characteristic of a ROP gadget?

It is a sequence of system calls

It is always located in the heap

It contains a 'jmp' instruction to a register

It ends with a 'ret' instruction

When combining multiple mitigation bypasses, what is the typical order of steps in a modern Linux exploit?

Leak a memory address, calculate base addresses, then build a ROP chain

Brute-force the canary, then brute-force ASLR

Execute shellcode on the stack, then disable ASLR

Overwrite the GOT, then leak a canary

A tester is exploiting a stack overflow in a binary that has a stack canary and ASLR enabled. The tester has a format string vulnerability that can leak arbitrary memory. Which sequence of actions is most efficient to bypass both protections?

Use the format string to overwrite the GOT entry of a function with system, and then trigger a call to that function.

Brute-force the canary and use a partial overwrite for the return address, avoiding the need for a binary base leak.

Leak the canary from the stack, then use a separate leak to determine the binary base, and finally craft a ROP chain.

Overwrite the canary with a known value and use ret2plt to call system.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 2Objective 1

Bypassing Linux Exploit Mitigations GXPN Practice Questions (Page 3)

Part of the Exploit Mitigation Bypass Techniques domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 3–6 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

9concepts

Questions 11–15

11foundation · easy
A stack canary is a random value placed between the buffer and the saved return address. Which of the following is a common method to bypass a stack canary?
Select an answer first
12foundation · easy
Which of the following is a key characteristic of a ROP gadget?
Select an answer first
13foundation · easy
When combining multiple mitigation bypasses, what is the typical order of steps in a modern Linux exploit?
Select an answer first
14expert · hard
A tester is exploiting a stack overflow in a binary that has a stack canary and ASLR enabled. The tester has a format string vulnerability that can leak arbitrary memory. Which sequence of actions is most efficient to bypass both protections?
Select an answer first
15foundation · easy
When a binary is compiled with Partial RELRO, which of the following sections remains writable and is a common target for exploitation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.