Exploit PHP loose comparison and magic hash collisions to bypass authentication checks.
npx skills add https://github.com/lNwNl/Praxis --skill type-juggling-lnwnl
Please help me install this Agent Skill. Skill: type-juggling Source: https://github.com/lNwNl/Praxis/tree/main/skills/type-juggling Command: npx skills add https://github.com/lNwNl/Praxis --skill type-juggling-lnwnl
==) silently coerces types, letting attackers bypass authentication, HMAC verification, and token validation without knowing the real secret. This Skill gives testers a systematic playbook for identifying and exploiting these weak comparison flaws in PHP code during authorized CTF and penetration testing engagements. ## Core Features & Use Cases - Loose Comparison Analysis: Truth tables for == behavior across PHP 5, 7, and 8, covering string-to-int coercion, falsy chains, and version-specific deltas like 'abc' == 0. - Magic Hash Collisions: Precomputed 0e... digests (e.g., 240610708 / QNKCDZO for MD5) that compare equal under ==, plus brute-force methodology for SHA-1/SHA-256 and HMAC-vs-"0" bypasses. - CTF Pattern Library: Ready payloads for strcmp([]) NULL tricks, intval hex/octal parsing, json_decode with true values, and is_numeric scientific notation abuse. - Use Case: During a web CTF, you find if (md5($_GET['a']) == md5($_GET['b'])) in the source. Submit ?a=240610708&b=QNKCDZO — both digests match ^0e[0-9]+$, so PHP evaluates them as 0.0 == 0.0 and the check passes. ## Quick Start Use the type-juggling skill to analyze this PHP login code that compares md5 hashes with == and suggest a bypass payload.High-intent search queries and answers about installing and using this skill.
Use two magic hash inputs whose MD5 digests both match the pattern ^0e[0-9]+$, such as 240610708 and QNKCDZO. PHP interprets these strings as scientific notation floats equal to 0.0, so the loose == comparison returns true even though the digests differ.
A magic hash is a digest string matching ^0e[0-9]+$ that PHP coerces to the float 0.0 during loose comparison. When two different inputs produce such digests, md5($a) == md5($b) evaluates true, bypassing equality checks without a real hash collision.
Partially. PHP 8 fixed non-numeric string to integer comparison, so 'abc' == 0 is now false, and md5([]) throws a TypeError instead of returning NULL. Magic hash collisions between two numeric-looking strings still work on all versions.
Send the parameter as an array, e.g. ?p[]=1. strcmp() receives an invalid argument type and returns NULL, and if the code checks strcmp(...) == 0 loosely, NULL == 0 evaluates true and the comparison passes.
It fails when the code uses strict comparison (===) or hash_equals() for secrets, since both enforce type and value equality without coercion. It also fails on PHP 8 for array-to-hash tricks that now raise TypeError instead of producing NULL.
ok-helloworldProbe PHP loose comparisons to verify authentication and signature bypasses.
Prohao42Exploit Windows system vulnerabilities to escalate privileges and gain administrative access.
wgpsecChains confirmed PHP audit findings into validated multi-vulnerability exploitation paths.
iiammaeDetect timing side channels in cryptographic code using dudect and timecop.