format-string-exploitation
This skill covers format string exploitation from vulnerability identification through advanced attack chains. Learn to read stack memory with %p, perform arbitrary writes using %n variants, leak canaries and ASLR offsets, and overwrite GOT entries or hooks for code execution. Includes pwntools automation and blind exploitation techniques.
Format String Exploitation teaches stack reading, memory writes, and GOT overwrites via format string vulnerabilities.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Format String Exploitation teaches stack reading, memory writes, and GOT overwrites via format string vulnerabilities. This skill covers format string exploitation from vulnerability identification through advanced attack chains. Learn to read stack memory with %p, perform arbitrary writes using %n variants, leak canaries and ASLR offsets, and overwrite GOT entries or hooks for code execution. Includes pwntools automation and blind exploitation techniques.
Use it when
- format-string-exploitation teaches exploitation by first mapping the stack layout to find target addresses.
- Yes.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/format-string-exploitation · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is format string exploitation tutorial material in this skill?
format-string-exploitation covers the complete attack surface: identifying vulnerable printf calls, reading stack memory with %p to leak canaries and ASLR offsets, performing arbitrary writes via %n and %hn variants, and chaining attacks to overwrite GOT entries or hooks. The skill progresses from basic memory leaks through advanced code-execution payloads, with pwntools automation and blind exploitation techniques for hardened targets.
How can I exploit printf format string vulnerabilities?
format-string-exploitation teaches exploitation by first mapping the stack layout to find target addresses, then using format specifiers like %p to leak memory contents and %n to write arbitrary values. You'll learn to craft payloads that overwrite function pointers, GOT entries, or __malloc_hook, and automate the process with pwntools fmtstr_payload to handle offset calculation and payload generation.
Can format-string-exploitation help me leak canary and ASLR addresses?
Yes. format-string-exploitation demonstrates memory leak techniques using %p to read stack values, identifying canary positions and leaked libc pointers to calculate ASLR offsets and PIE base addresses. These leaks defeat protections and enable reliable code execution by revealing runtime memory layout before launching the write phase of the exploit.
What are %n arbitrary write exploit techniques covered here?
format-string-exploitation details %n (4-byte write), %hn (2-byte write), and %hhn (1-byte write) variants for precise memory modification. You'll learn to chain writes across multiple format string invocations, use short-write techniques to minimize payload size, and leverage pwntools to automate offset discovery and payload construction for reliable arbitrary writes.
Does this skill cover format string GOT overwrite methods?
Yes. format-string-exploitation teaches GOT overwrite attacks by leaking libc addresses to calculate function offsets, then using %n writes to redirect function pointers to system() or gadget chains. The skill includes both direct overwrites and multi-stage attacks that bypass mitigations like FORTIFY_SOURCE and partial RELRO.
How does format-string-exploitation handle blind format string exploitation?
format-string-exploitation covers blind exploitation where you cannot observe output: using out-of-band channels (DNS, HTTP), timing side-channels, or crash-based inference to confirm writes. Techniques include writing to predictable memory locations, leveraging error messages, and using pwntools to automate payload generation when direct feedback is unavailable.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Format String Exploitation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, __malloc_hook overwrite, pointer chain exploitation, blind format string, FORTIFY_SOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after format string.
0. RELATED ROUTING
- stack-overflow-and-rop — combine format string leak with stack overflow for full exploit
- binary-protection-bypass — format string is the primary canary/PIE/ASLR leak method
- arbitrary-write-to-rce — convert format string write primitive
(truncated - see the full file via the links below)
File tree — 1 file
skills/format-string-exploitation/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn format string exploitation techniques for CTF and security research”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Master the identification and circumvention of modern binary protections including ASLR, PIE, NX/DEP, stack canaries, RELRO, FORTIFY_SOURCE, CET, and MTE. This playbook pairs each protection mechanism with its bypass methods and required primitives, drawing from real-world exploitation and CTF techniques. Learn information leaks, ROP chains, ret2libc, and alternative targeting strategies when standard approaches are blocked.
CTF Binary Exploitation guides you through discovering and exploiting memory corruption vulnerabilities to read flags. Learn to analyze data flow, identify unsafe APIs, map memory layouts, and chain exploitation primitives—from buffer overflows to ROP chains—adapting core concepts to any pwn challenge.
Stack Overflow & ROP covers advanced control-flow hijacking via return address overwrite on Linux userland binaries. Learn buffer overflow fundamentals, libc leaking strategies, ROP gadget selection, ret2csu for multi-argument calls, ret2dlresolve for blind resolution, SROP for register control, and stack pivoting under constraints. Includes tool comparisons and real-world exploitation patterns.
Learn to exploit heap vulnerabilities in glibc's ptmalloc2 allocator, from use-after-free and double-free to overflow and off-by-one attacks. This playbook covers bin structures, leak methods, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies.
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.
This skill covers advanced V8 and Chrome exploitation methods, including JIT type confusion, incorrect bounds elimination, and pointer compression bypass. Learn to build addrof and fakeobj primitives, corrupt ArrayBuffer backing stores, and leverage WASM RWX pages for renderer RCE and sandbox escape.
More skills exploit-development (MIT) · Exploit Dev Expert (unlicensed) · reverse-engineering (MIT)