format-string-exploitation

1# SKILL: Format String Exploitation — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, __malloc_hook overwrite, pointer chain exploitation, blind format string, FORTIFY_SOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after format string.
4 
5## 0. RELATED ROUTING
6 
7- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — combine format string leak with stack overflow for full exploit
8- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — format string is the primary canary/PIE/ASLR leak method
9- [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md) — convert format string write primitive to code execution targets
10- [heap-exploitation](../heap-exploitation/SKILL.md) — heap address leak via format string for heap exploitation
11 
12---
13 
14## 1. VULNERABILITY IDENTIFICATION
15 
16### Vulnerable Pattern
17 
18```c
19printf(user_input);          // VULNERABLE: user controls format string
20fprintf(fp, user_input);     // VULNERABLE
21sprintf(buf, user_input);    // VULNERABLE
22snprintf(buf, sz, user_input); // VULNERABLE
23 
24printf("%s", user_input);    // SAFE: format string is fixed
25```
26 
27### Quick Test
28 
29```
30Input: AAAA%p%p%p%p%p%p%p%p
31If output shows stack values (hex addresses): format string confirmed
32…