Leaking the Stack with {%p

/ %x}

char buf[128];
fgets(buf, sizeof buf, stdin);
printf(buf);          /* vulnerable */

Feed it a row of conversions and watch memory pour out:

input : %p %p %p %p %p %p %p %p
output: 0x7ffe... 0x1 0x7f... 0x4011a0 0x4141... ...

• %p prints a pointer-sized word; %x prints 4 bytes.
• The values are whatever happens to sit in the argument registers, then on the stack: saved registers, canaries, return addresses, and (often) your own input echoed back.