Exploiting Format String Vulnerabilities
Methodology for exploiting format string bugs where attacker-controlled data reaches...
Install
npx skills add xalgorix/xalgorix --skill exploiting-format-string-vulnerabilities -g -a claude-code -y- Repository
- xalgorix/xalgorix1.3k
- Category
- Security
- Updated
- 6d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,292 tokens
- Runs scripts
- No, instructions only
What it does
Methodology for exploiting format string bugs where attacker-controlled data reaches the format argument of printf-family functions, enabling stack/memory disclosure (info leaks for ASLR/PIE/canary defeat) and arbitrary write primitives (%n) to hijack control flow via GOT/.fini_array overwrites.
Exploiting Format String Vulnerabilities
When to Use
- During authorized binary/exploitation assessments when attacker input is passed as the first argument (the format)
to
printf,fprintf,sprintf,snprintf,vprintf,syslog, or similar. - When you need a memory-disclosure primitive to leak stack contents, a libc/PIE pointer, or a stack canary to defeat ASLR/PIE/canary protections.
- When you have an arbitrary-write primitive opportunity via
%n/%hnto overwrite a GOT entry,.fini_array, a saved return address, or a function pointer. - On Windows x64 services where a buggy
_snprintf(dst, len, attacker_fmt)call provides no varargs and conversions read pointers out of RCX/RDX/R8/R9 registers.
