Type Juggling Magic: Why PHP thinks 0 and 'password' are the same [Capture The Flag Fundamentals]

preview_player
Показать описание
When you declare a variable in PHP, you don’t need to define its type – you just declare it. If variables are used as part of a comparison, in order to compare them, PHP needs to guess what those variables represent. After making this guess, PHP will convert the variables to some common data type to then perform the actual comparison.

This can result in unexpected behaviour, which as we’ve seen before and from a security is perspective is almost always a bad idea.

🏆 The 247CTF channel is dedicated to teaching Capture The Flag fundamentals. If you want to improve your technical skills and succeed in Capture The Flag competitions, make sure to subscribe!

📺 Subscribe for more Capture The Flag videos!
📌Free flag ➝ 247CTF{9719c5ddf317154473d334f47a77ac6a}

🚨 247CTF’s channel videos are intended for educational purposes only. Methods and techniques discussed are not to be used for illegal activities against unauthorised systems.
Рекомендации по теме
Комментарии
Автор

👍 Liking this video will increase your ability to solve CTF challenges by 👍

CTF
Автор

Didn't know 247CTF had a channel! This is cool. Subbed

bourbon
Автор

Always use that === for strict comparison with PHP!

RhyanGarrison
Автор

I guess you need to release new version of this video

ctfs
Автор

Great Video! What about that? if ($user_input == substr(md5($user_input), 0, 24)

nameless