0Pricing
Cyber Security Academy · Lesson

Format String Vulnerabilities

Exploit printf format strings to read arbitrary memory and write to arbitrary addresses.

Format String Vulnerabilities is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is a Format String Vulnerability?

A format string vulnerability occurs when user input is passed directly as the format string argument to printf() or similar functions. The attacker can read memory, leak stack addresses, and write arbitrary values.

The Vulnerable Pattern

Vulnerable vs safe:

// VULNERABLE - user controls the format string:
printf(user_input);
fprintf(stderr, user_input);

// SAFE - user input is a data argument:
printf("%s", user_input);

Reading Memory with %x and %p

Format specifiers without corresponding arguments read values off the stack:

# Input: %p.%p.%p.%p.%p
# Output: 0x7ffd12345678.0x400580.0x0.0x1.0x7f3a...
# Each %p prints the next value off the stack - leaking addresses!

Bypassing ASLR with Format String Leaks

Stack often contains pointers to libc, stack, and binary. By leaking these with %p or %lx specifiers, an attacker can calculate base addresses and defeat ASLR — even without any other vulnerability.

Reading Arbitrary Memory with %s

%s treats the stack value as a pointer and prints the string at that address. By positioning the target address in the right stack position and using parameter access (%7$s), an attacker reads arbitrary memory locations.

# Direct parameter access:
printf("%7$s")  # prints string at 7th stack parameter
# If 7th param is an address you control, reads that memory

Writing Memory with %n

%n writes the number of characters printed so far to the address pointed to by the corresponding argument. This allows writing controlled values to arbitrary addresses — potentially overwriting function pointers or return addresses.

Practical Write Technique

To write a specific value using %n:

  1. Control a pointer on the stack pointing to the target address
  2. Use %Xc%N$n to write X characters, then write the count to the Nth parameter (the target address)

Tools like pwntools automate format string exploit construction.

Finding Format String Bugs

Testing for format string vulnerabilities:

# Test inputs:
%x.%x.%x
%p.%p.%p
%s%s%s
AAAA.%p.%p.%p.%p (looking for 0x41414141 in output)

# Automated testing with fuzzer:
python3 -c "print('%p.' * 20)" | ./vuln

Defense: Fix the Code

The fix is trivially simple: always pass user input as a data argument, never as the format string.

// WRONG:
printf(buffer);

// RIGHT:
printf("%s", buffer);

// Compiler warning:
// gcc -Wformat-security will flag this

Format String in Other Languages

Format string vulnerabilities occur in many languages:

  • C: printf(input)
  • Python: not the same — but % formatting with dict input can expose variables
  • Java: String.format(input) — less dangerous, no memory access

Real-World Examples

Format string bugs have affected:

  • ProFTPD — enabled remote code execution via FTP commands
  • WU-FTPD — remote root exploit via format strings
  • Various Linux daemons pre-2000s

Modern compilers and FORTIFY_SOURCE help but don't eliminate the class entirely.

Quick Check: Format Strings

Which format specifier can be used to write to an arbitrary memory address in a format string attack?

Lesson Recap

Format string vulnerabilities occur when user input is used directly as a printf format string. %p/%x leaks stack memory; %s reads arbitrary addresses; %n writes to arbitrary addresses. The fix is one character: printf("%s", input). Enable -Wformat-security in compiler flags to catch these.

Frequently asked questions

Is the “Format String Vulnerabilities” lesson free?

Yes — the full text of “Format String Vulnerabilities” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Format String Vulnerabilities”?

Exploit printf format strings to read arbitrary memory and write to arbitrary addresses. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Format String Vulnerabilities” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Stack Buffer Overflows
  2. Return-Oriented Programming (ROP)
  3. Format String Vulnerabilities
  4. Heap Exploitation: Use-After-Free and Heap Spraying
← Back to Cyber Security Academy