This document discusses format string vulnerabilities, how they work, and how they differ from buffer overflows. It introduces common format string functions like printf and sprintf, and explains how format specifiers like %s and %d are passed to these functions. It notes that exploiting format strings was discovered later than buffer overflows and has resulted in fewer exploits due to being easier for programmers to detect and fix.

1. FormatStringvulnerability

2. →RakeshParuchuri(nuc13us)
→SecurityEnthusiastic
→LovesplayingCTF’s
→iplayforbi0steam

3. Outline:
→Introduction
→Howprintfworks
→Formatstringfunctions
→formatspecifiers
→Exploitingformatstring
→formatstringvulnerability(vs)Bufferoverflow

4. Introduction:
printf(<formatstring>,a,b);

5. Howprintfworks:

6. Formatstringfunctions:
intprintf(constchar*format,...);
intsprintf(char*str,constchar*format,...);
intsnprintf(char*str,size_tsize,constchar*format,...);

7. formatspecifiers
Format Specifier Description Passed as
%d decimal value
%u Unsigned decimal value
%s String reference
%x hexadecimal value
%n Write number of bytes
written so far
reference

8. Exploitingformatstring

9. formatstringvulnerability(vs)Bufferoverflow
Buffer Overflow Format string
Discovered in 1980’s Discovered in 1999
Number of exploits are in
thousands
Number of exploits are very less
Security threat Programmers mistake
Difficult to find out Easy to find