Format String Vulnerabilities

Learn how print functions and format strings format data, display information, and print debug messages, and why improper use can cause serious damage, laying the foundations of format string vulnerabilities.

Explore how a primitive print function uses format specifiers to print stack data in various representations—decimal, hex, float, characters, strings, and data pointed to by an address—through examples.

Demonstrates how the print function uses format specifiers to display integers, floats, pointers, and strings, including hex output and memory addresses, with an emphasis on stack storage.

Explore how unusual use of printf format specifiers pulls values from the stack, exposes memory addresses, and enables format string vulnerabilities when untrusted data controls output.

Explore the dangers of format string vulnerabilities, including leaking memory addresses to bypass ASLR and stack protections, revealing secrets, overriding memory, and causing denial of service.

Explore how format string vulnerabilities enable leaking memory strings by crafting input to printf, reveal the secret on the stack, and bypass mitigations such as slr.

demonstrates how to exploit format string vulnerabilities to dump stack data and cause a crash by using an invalid memory address, resulting in a segmentation fault.

Learn how stack canaries detect buffer overflows and format string vulnerabilities by placing a canary before the return address and verifying it before return, with examples and bypass notes.

examine the theory of bypassing stack canaries and exploit format string and stack-based buffer overflow vulnerabilities, and learn to automate control of the ip register using pwntools.

Demonstrates manually leaking the stack canary via a format string vulnerability, using gdb to dump stack entries, identify the canary in registers, and discuss automating the process across runs.

Automate finding the stack canary offset by creating a pattern, feeding input to trigger a buffer overflow, and using a breakpoint and pattern search to locate the canary value.

Learn to bypass stack canary protections by discovering the offset to the rip using a large pattern, leaking the canary, and overwriting registers to exploit a buffer overflow.

Learn to bypass the stack canary in a buffer overflow by extracting the leaked canary from a vulnerable program, converting it to hex, and crafting a Python exploit.

Shows bypassing a stack canary by crafting an offset payload and shellcode, then uses core dumps to locate addresses for a chained format string and buffer overflow exploit.

Thank you for completing the course on format string vulnerabilities. Encourage others by sharing your learning experience and spreading the word about Learning Exploit Development Fundamentals to friends and colleagues.