{"enrichment":{"faq":[{"a":"format-string-exploitation covers the complete attack surface: identifying vulnerable printf calls, reading stack memory with %p to leak canaries and ASLR offsets, performing arbitrary writes via %n and %hn variants, and chaining attacks to overwrite GOT entries or hooks. The skill progresses from basic memory leaks through advanced code-execution payloads, with pwntools automation and blind exploitation techniques for hardened targets.","q":"What is format string exploitation tutorial material in this skill?"},{"a":"format-string-exploitation teaches exploitation by first mapping the stack layout to find target addresses, then using format specifiers like %p to leak memory contents and %n to write arbitrary values. You'll learn to craft payloads that overwrite function pointers, GOT entries, or __malloc_hook, and automate the process with pwntools fmtstr_payload to handle offset calculation and payload generation.","q":"How can I exploit printf format string vulnerabilities?"},{"a":"Yes. format-string-exploitation demonstrates memory leak techniques using %p to read stack values, identifying canary positions and leaked libc pointers to calculate ASLR offsets and PIE base addresses. These leaks defeat protections and enable reliable code execution by revealing runtime memory layout before launching the write phase of the exploit.","q":"Can format-string-exploitation help me leak canary and ASLR addresses?"},{"a":"format-string-exploitation details %n (4-byte write), %hn (2-byte write), and %hhn (1-byte write) variants for precise memory modification. You'll learn to chain writes across multiple format string invocations, use short-write techniques to minimize payload size, and leverage pwntools to automate offset discovery and payload construction for reliable arbitrary writes.","q":"What are %n arbitrary write exploit techniques covered here?"},{"a":"Yes. format-string-exploitation teaches GOT overwrite attacks by leaking libc addresses to calculate function offsets, then using %n writes to redirect function pointers to system() or gadget chains. The skill includes both direct overwrites and multi-stage attacks that bypass mitigations like FORTIFY_SOURCE and partial RELRO.","q":"Does this skill cover format string GOT overwrite methods?"},{"a":"format-string-exploitation covers blind exploitation where you cannot observe output: using out-of-band channels (DNS, HTTP), timing side-channels, or crash-based inference to confirm writes. Techniques include writing to predictable memory locations, leveraging error messages, and using pwntools to automate payload generation when direct feedback is unavailable.","q":"How does format-string-exploitation handle blind format string exploitation?"}],"shadow_tags":["memory-disclosure","arbitrary-write-primitive","got-hijacking","code-execution-chain","binary-pwning","leak-and-exploit","stack-manipulation","aslr-bypass","libc-exploitation","ctf-techniques"],"summary_rewrite":"This skill covers format string exploitation from vulnerability identification through advanced attack chains. Learn to read stack memory with %p, perform arbitrary writes using %n variants, leak canaries and ASLR offsets, and overwrite GOT entries or hooks for code execution. Includes pwntools automation and blind exploitation techniques."},"files":[{"bytes":11243,"path":"skills/format-string-exploitation/SKILL.md","sha256":"62893048bdbf7620ff89936f74dcb926db98d3637dfa7091c52af833dd301d3b","url":"https://skillfed.io/files/yaklang/hack-skills/format-string-exploitation/67ec517d/SKILL.md"}],"id":"yaklang/hack-skills/format-string-exploitation","links":{"html":"https://skillfed.io/yaklang/hack-skills/format-string-exploitation","md":"https://skillfed.io/yaklang/hack-skills/format-string-exploitation.md","repo":"https://github.com/yaklang/hack-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":196,"language":"CSS","last_updated":"2026-06-16","license":"MIT","name":"format-string-exploitation","publisher":"yaklang","stars":1480},"relations":{"similar":[{"id":"yaklang/hack-skills/arbitrary-write-to-rce"},{"id":"yaklang/hack-skills/binary-protection-bypass"},{"id":"yaklang/hack-skills/stack-overflow-and-rop"},{"id":"cyberkaida/reverse-engineering-assistant/ctf-pwn"},{"id":"yaklang/hack-skills/heap-exploitation"},{"id":"ljagiello/ctf-skills/ctf-pwn"},{"id":"yaklang/hack-skills/browser-exploitation-v8"},{"id":"duck4nh/antigravity-kit/exploit-dev-expert"},{"id":"hypnguyen1209/offensive-claude/exploit-development"},{"id":"mohitmishra786/low-level-dev-skills/reverse-engineering"}]},"slug":{"owner":"yaklang","repo":"hack-skills","skill":"format-string-exploitation"},"version":"67ec517d"}