0x7000 · Exploitation Techniques
Format-String Bugs: Arbitrary Read and Write
One printf(user_input) is a full read/write primitive. Leak with %p, overwrite with %n via pwntools, then watch -Wformat=2 and FORTIFY_SOURCE shut it down.
Guides tagged: #format-string
0x1000 · Vulnerability Classes
Integer Overflows and Format-String Bugs, Explained
How integer overflow, truncation and signedness errors turn into memory corruption, why user-controlled format strings are dangerous, and the checks and warnings that prevent both.