domains / families / security / format-string-exploitation

format-string-exploitation

separate

Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.

When to use

• arbitrary stack reads
• arbitrary memory writes
• GOT/hook overwrites
• canary/libc/PIE leaks
• blind format string
• FORTIFY_SOURCE bypass
• 64-bit null byte handling
• pwntools automation

Skill page

Source