Format String Exploitation

This is a comprehensive playbook for exploiting format string vulnerabilities in printf-family functions. It covers the full attack surface: leaking stack values and arbitrary memory with %p and %s, writing to arbitrary addresses with %n variants, finding your input offset on the stack, and automating exploitation with pwntools' fmtstr_payload. The techniques section walks through GOT overwrites, hook targeting, and pointer chain exploitation for indirect writes. It handles 64-bit quirks like null bytes in addresses and includes blind exploitation methodology when you don't have the binary. The skill reads like distilled CTF wisdom, with offset calculation being the critical detail most base models mess up. If you're doing binary exploitation and need to turn a format string bug into arbitrary read/write primitives, this gives you the exact patterns and tooling.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill format-string-exploitation --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Format String Exploitation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, __malloc_hook overwrite, pointer chain exploitation, blind format string, FORTIFY_SOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after format string.

0. RELATED ROUTING

stack-overflow-and-rop — combine format string leak with stack overflow for full exploit
binary-protection-bypass — format string is the primary canary/PIE/ASLR leak method
arbitrary-write-to-rce — convert format string write primitive to code execution targets
heap-exploitation — heap address leak via format string for heap exploitation

Format String Exploitation

Install

Files

SKILL: Format String Exploitation — Expert Attack Playbook

0. RELATED ROUTING

1. VULNERABILITY IDENTIFICATION

Vulnerable Pattern

Details

More from yaklang/hack-skills

Recommended