PHP security testing and exploitation techniques. Use this skill whenever the user needs to test PHP applications for vulnerabilities, analyze PHP code for security issues, generate PHP payloads, understand PHP type juggling attacks, or perform web application pentesting on PHP-based systems. Make sure to use this skill for any PHP security assessment, code review, or exploitation scenario.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
PHP security testing and exploitation techniques. Use this skill whenever the user needs to test PHP applications for vulnerabilities, analyze PHP code for security issues, generate PHP payloads, understand PHP type juggling attacks, or perform web application pentesting on PHP-based systems. Make sure to use this skill for any PHP security assessment, code review, or exploitation scenario.
PHP Pentesting Skill
A comprehensive guide for testing and exploiting PHP applications.
Quick Reference
Common Cookie/Session Locations
/var/lib/php/sessions
/var/lib/php5/
/tmp/
# Example path traversal: ../../../../../../tmp/sess_d1d531db62523df80e1153ada1d4b02e
Common cookie names:
PHPSESSID
phpMyAdmin
Type Juggling Attacks
Loose Comparison Bypasses (==)
PHP's loose comparison (==) can be exploited:
Pattern
Result
Exploit
"string" == 0
True
Non-numeric strings equal 0
"0xAAAA" == "43690"
True
Hex strings compare as numbers
"0e3264578" == 0
True
"0e" prefix = scientific notation
"0X3264578" == 0X
True
"0" + letter = 0
"0e12334" == "0"
True
Hash collision bypass
"X" == 0
True
Any letter = 0
Use case: Bypass password/hash comparisons in authentication.
