How to Remotely Exploit Format String Bugs - A practical tutorial. Includes info on guessing the offset, guessing the address of the shellcode in the stack, using format string bugs as debuggers, examples, etc.
c323add4e7a0e2f2f14ec27d9d50002992564b1d0be3d391722da88350a25a83