First page Back Continue Last page Graphics
%n – The Little Option Noobody Knows
%n writes into the int pointed to by the respective argument the number of characters printed so far.
An attacker can choose to write (%n), where to write (supply a pointer).
By playing with field length, can also control what to write.
Bare shortcuts, that may require printing an average of 2GB of data.