# Exploiting Format String Vulnerabilities

Methodology for exploiting format string bugs where attacker-controlled data reaches...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill exploiting-format-string-vulnerabilities -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill exploiting-format-string-vulnerabilities -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill exploiting-format-string-vulnerabilities -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill exploiting-format-string-vulnerabilities -g -a gemini-cli -y`

## Description

Methodology for exploiting format string bugs where attacker-controlled data reaches the format argument of printf-family functions, enabling stack/memory disclosure (info leaks for ASLR/PIE/canary defeat) and arbitrary write primitives (%n) to hijack control flow via GOT/.fini_array overwrites.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Exploiting Format String Vulnerabilities

## When to Use

- During authorized binary/exploitation assessments when attacker input is passed as the **first argument** (the format)
  to `printf`, `fprintf`, `sprintf`, `snprintf`, `vprintf`, `syslog`, or similar.
- When you need a memory-disclosure primitive to leak stack contents, a libc/PIE pointer, or a stack canary to defeat
  ASLR/PIE/canary protections.
- When you have an arbitrary-write primitive opportunity via `%n`/`%hn` to overwrite a GOT entry, `.fini_array`, a saved
  return address, or a function pointer.
- On Windows x64 services where a buggy `_snprintf(dst, len, attacker_fmt)` call provides no varargs and conversions read
  pointers out of RCX/RDX/R8/R9 registers.

## Critical: Concepts/Steps Most Often Missed

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/binary-exploitation/exploiting-format-string-vulnerabilities/SKILL.md