nerdexam
GIAC

GCIH · Question #55

Adam works as a Senior Programmer for Umbrella Inc. A project has been assigned to him to write a short program to gather user input for a Web application. He wants to keep his program neat and…

The correct answer is A. Format string attack. Using printf(str) passes user-controlled input directly as the format string, enabling a format string attack where an attacker injects format specifiers to read or write arbitrary memory locations.

Vulnerability Exploitation & Privilege Escalation

Question

Adam works as a Senior Programmer for Umbrella Inc. A project has been assigned to him to write a short program to gather user input for a Web application. He wants to keep his program neat and simple. His chooses to use printf(str) where he should have ideally used printf("%s", str). What attack will his program expose the Web application to?

Options

  • AFormat string attack
  • BCross Site Scripting attack
  • CSQL injection attack
  • DSequence++ attack

How the community answered

(51 responses)
  • A
    71% (36)
  • B
    4% (2)
  • C
    16% (8)
  • D
    10% (5)

Why each option

Using printf(str) passes user-controlled input directly as the format string, enabling a format string attack where an attacker injects format specifiers to read or write arbitrary memory locations.

AFormat string attackCorrect

When printf() receives user input as its format string argument - printf(str) instead of the safe printf("%s", str) - an attacker can supply specifiers like %x, %s, or %n to read values off the stack, cause crashes, or write to arbitrary memory addresses. This misuse of variadic format functions is the defining characteristic of a format string vulnerability.

BCross Site Scripting attack

A Cross-Site Scripting attack injects malicious client-side scripts into web pages viewed by other users and is caused by unsanitized HTML output rendered in a browser, not by misuse of C-style format functions.

CSQL injection attack

SQL injection occurs when unsanitized user input is concatenated into SQL query strings, enabling database manipulation, which is entirely unrelated to how printf processes its format argument.

DSequence++ attack

Sequence++ is not a recognized attack category in any major security framework or certification body, and does not describe any known vulnerability class associated with format string misuse.

Concept tested: Format string vulnerability via improper printf usage

Source: https://owasp.org/www-community/attacks/Format_string_attack

Topics

#format string attack#printf vulnerability#memory exploitation#C programming flaws

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice