Format string attacks

- Format string attacks. Why did we just spend some time talking about formatting? Well, because you can take string formatting to a level where it might constitute a vulnerability. Let's talk about format string attacks. What's a format string? We already know. It's an ASCII string. It has text and format parameters. We've been playing with that. Format strings are used to insert values into a text string. You could put in variable substitutions and data formatting. We've played with that. They exist in many programming languages, including Kotlin and Java and C, Objective-C, Swift, Python, et cetera, et cetera, et cetera. When you insert a value into an output string, you can use format specifiers as placeholders, and you pass the values in as additional parameters into the function. And they're really useful. I mean, they allow you to format the output so it's easier to read. They can save programmers a lot of time and effort when the language permits automatic type conversions…