Agent skill · security · yaklang
format-string-exploitation
Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.
Why this skill is useful
Adds detailed exploitation techniques and scripts for format string vulnerabilities that are not commonly known or documented.
What it needs
About 7k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Format String Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION: Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, mallochook overwrite, pointer chain exploitation, blind format string, FORTIFYSOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after format string. 0. RELATED ROUTING stack-overflow-and-rop — combine format string leak with stack overflow for full exploit binary-protection-bypass — format string is the primary canary/PIE/ASLR leak method arbitrary-write-to-rce — convert format string write primitive to code execution targets heap-exploitation — heap address leak via format string for heap exploitation --- 1. VULNERABILITY IDENTIFICATION Vulnerable Pattern Quick Test --- 2. READING MEMORY Stack Leak (%p) Format Action Use --- --- --- %p Print next stack value as pointer Sequential stack dump %N$p Print N-th parameter as pointer Direct positional access %N$lx Same as %p but explicit hex (64-bit) Portable %N$s Dereference N-th parameter as string pointer Read memory at pointer value Finding Your Input Offset Leaking Specific Values Target Method Stack Position --- --- --- Canary %N$p where N = canary offset from format string Typically at offset bufsize/8 + few Saved RBP %N$p (just above return address) Leaks stack address → stack base Return address %N$p Leaks .text address (PIE base = leak & ~0xfff - offset) Libc address %N$p where N points to libcstartmain+XX return on stack libc base = leak - offset Reading Arbitrary Address (%s) --- 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/format-string-exploitation