Format String Vulnerabilities

Procedure

Click on the "Format String Playground" button.

step1

Drag and drop the format specifiers to their corresponding data types.

step2

Click on the "Understanding Format String " button.

step3

click on the run button also observe the explanation given below.

step4

Enter your name, observe the stack visualization and the program's output to see how the value is stored in the stack, retrieved, and displayed as the output.

step5

click on the "Format String Vulnerability" button

Follow the instructions given and observe how the vulnerability occurs.

  • Step 1: Identify the Vulnerable Code. The above code takes user input and uses it directly in printf, which is unsafe.
  • step6
  • Step 2: Understand the Risk. If the user enters format specifiers (like %x), printf will treat them as instructions to read from the stack.
  • step7
  • Step 3: Run the Code. Now, run the code and enter %x %x %s in the input field to see stack values and strings.
  • step8
  • Enter format specifiers in the input field, such as `%x %x %d %s %d %s`,
  • step9
  • Observe how the vulnerability happens.
  • step10
  • Read the explanation carefully to understand the vulnerability and how to prevent the vulnerability
  • step11