architect/skills/binary/format-string-exploitation.md

metadata

name: format-string-exploitation
domain: binary
triggers:
  languages:
    - c
    - cpp
severity_focus:
  - P1
  - P2
  - P3

format-string-exploitation

printf-family with attacker-controlled format: arbitrary read (%n$s/x), arbitrary write (%n), GOT overwrites, leaks for ASLR bypass.

Detection checklist

• enumerate exposure
• match canonical sinks
• confirm reproducibility
• map to CWE / OWASP / CVSS

Exploitation primitives

• reproduce in lab
• minimise the PoC
• assess blast radius

Reporting fingerprint

• include affected version range
• include suggested fix snippet
• include CVSS 3.1 vector