PLT / GOT Diagram

• Leak target: read GOT[puts] to learn libc's address.
• Overwrite target: write GOT[puts] so the next puts call runs your chosen address.