%n – The Little Option Noobody Knows

• %n writes into the int pointed to by the respective argument the number of characters printed so far.

• An attacker can choose to write (%n), where to write (supply a pointer).

• By playing with field length, can also control what to write.

• Bare shortcuts, that may require printing an average of 2GB of data.