binary-reconnaissance

amattas's avatarfrom amattas

Initial reconnaissance on binaries including checksec, file analysis, strings, and symbols. First step for any new target.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 26, 2025
[Security Operations]

When & Why to Use This Skill

This Claude skill automates the essential first steps of binary analysis and reverse engineering. It streamlines the reconnaissance process by performing automated security mitigation checks (NX, PIE, Canary, RELRO), symbol extraction, and string analysis, allowing security researchers and developers to quickly identify potential vulnerabilities and exploit primitives in compiled executables.

Use Cases

  • Security Auditing: Automatically evaluate compiled binaries for missing security protections to ensure software meets modern hardening standards.
  • Vulnerability Research: Rapidly identify dangerous function calls (like system or execve) and writable memory segments to pinpoint potential exploit vectors.
  • CTF & Reverse Engineering: Accelerate the discovery of hidden flags, 'win' functions, and program logic during security competitions or initial malware triage.
  • Exploit Development: Determine required bypass techniques, such as ROP or ret2libc, by analyzing a target's memory protections and symbol table.
namebinary-reconnaissance
descriptionInitial reconnaissance on binaries including checksec, file analysis, strings, and symbols. First step for any new target.

Binary Reconnaissance

First-look analysis of any new binary target. Run these checks before deeper analysis.

Checklist

  1. File type: file target
  2. Security mitigations: checksec target
  3. Symbols: nm target or readelf -s target
  4. Strings: strings target | grep -i flag\|win\|shell
  5. Disassembly: objdump -M intel -d target > target.asm

Checksec Interpretation

Protection Enabled Disabled Bypass
NX Can't execute shellcode on stack Shellcode works ROP, ret2libc
Canary Stack smash detected No protection Leak canary, brute force
PIE Addresses randomized Fixed addresses Leak code address
RELRO GOT protected GOT writable Can't use GOT overwrite

Quick Wins to Look For

  • Functions named win, get_flag, shell, backdoor
  • Strings containing flag, /bin/sh, cat flag
  • system() or execve() in PLT
  • No canary + no PIE = likely simple overflow

Output

Produce context/binary-info.md using the template.