webPromedium

Секретный ключ (Secret Key)

hackerlab

Task: PHP login form with strcmp() comparison. Solution: Type juggling bypass via array injection (secretKey[]=x) makes strcmp() return NULL which equals 0 in loose comparison.

$ ls tags/ techniques/
phpauthentication_bypassapachetype_jugglingloose_comparisonstrcmparray_injectionbackup_filesource_code_leakubuntu
Source code analysisPHP strcmp() type juggling bypassBackup file discovery (backup.tar.gz)Array injection to bypass string comparison
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups