From the course: Writing Secure Code in iOS by Infosec

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Format string attack, part 1

Format string attack, part 1

From the course: Writing Secure Code in iOS by Infosec

Start my 1-month free trial Buy for my team

Format string attack, part 1

“

- Let's now talk about another common vulnerability, the format string attack. So what's a format string? You've probably used it already, many times. It's an ASCII string. It contains text and format parameters. It's used to insert values into a text string. You could put in variable substitutions or data formatting, and you'll see format strings in many programming languages. C, Objective-C, Swift, Python, Java, many of them. When you insert values into an output string, you use format specifiers, parameter specifiers, people interchangeably use those words sometimes as placeholders in the string. You pass the values as additional parameters to the function. Format functions are really useful. They generate readable output. They save you a lot of time and work. They do automatic type conversions, and if used incorrectly, they can cause vulnerabilities. Let's go back in time. It all goes back to the C programming language. Print formatted, printf, was one of the very first functions…

Contents