What Is Worth Leaking

A format string leak is an ASLR-bypass engine (recall Class 05):

• Stack canary: a stack word ending in 00; leak it, then replay it during a later overflow so the check passes.
• Libc address: a leaked return address or saved pointer into libc reveals the libc base, defeating library ASLR.
• PIE base: a leaked code pointer (e.g. a return address into main) reveals the program base, defeating PIE.
• Stack address: useful for building a stack pivot or locating your own buffer.