In Windows heap exploitation, what is the primary purpose of manipulating heap metadata?

To disable ASLR by changing the heap base address

To increase the stack size for more payload space

To achieve arbitrary write or code execution by corrupting chunk headers

To bypass DEP by marking the heap executable

A tester is building a ROP chain for a Windows 10 application with DEP enabled. The tester has a stack overflow that allows overwriting the return address. The application loads a non-ASLR module with a rich gadget set. The tester needs to call `VirtualProtect` to make the stack executable. Which sequence of ROP gadgets is most appropriate?

A `pop ret` gadget to set up arguments, followed by a call to `VirtualProtect`, then a `ret` gadget.

A `pop pop ret` gadget to set up arguments, followed by a call to `VirtualProtect`, then a `jmp esp` gadget.

A `jmp esp` gadget followed by a call to `VirtualProtect` and then shellcode.

A call to `VirtualProtect` using a hardcoded address from the non-ASLR module, then a `ret` to shellcode on the heap.

Which of the following is a common target for overwriting to gain execution control in a classic stack overflow?

The saved return address on the stack

The Global Descriptor Table (GDT)

The Process Environment Block (PEB)

Which technique is commonly used to bypass ASLR by predicting or leaking the base address of a loaded module?

Memory disclosure vulnerability

What is the fundamental building block of a Return-Oriented Programming (ROP) chain?

A block of shellcode placed on the stack

A sequence of instructions ending in a `ret` instruction

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 4

Windows Overflows and Execution Control GXPN Practice Questions (Page 3)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

9concepts

Questions 11–15

11foundation · easy
In Windows heap exploitation, what is the primary purpose of manipulating heap metadata?
Select an answer first
12expert · hard
A tester is building a ROP chain for a Windows 10 application with DEP enabled. The tester has a stack overflow that allows overwriting the return address. The application loads a non-ASLR module with a rich gadget set. The tester needs to call `VirtualProtect` to make the stack executable. Which sequence of ROP gadgets is most appropriate?
Select an answer first
13foundation · easy
Which of the following is a common target for overwriting to gain execution control in a classic stack overflow?
Select an answer first
14foundation · easy
Which technique is commonly used to bypass ASLR by predicting or leaking the base address of a loaded module?
Select an answer first
15foundation · easy
What is the fundamental building block of a Return-Oriented Programming (ROP) chain?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.