Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?

Question

Since PHP has loose type comparison, we have:

php -r 'var_dump("1234e03"=="1234000");'
bool(true)

And since MD5 hashs are often reprensented as hexa string like 713f44b3d2c680df02eb5a0bde86fcd7

Are there two already known values that make a MD5 collison for PHP loose type comparison like md5($value1) == md5($value2) ?

With the snippet time crunch 1 6|pv|php -r '$x=fopen("php://stdin","r");while ($l=trim(fgets($x))) {if (is_numeric(md5($l))) { echo "$l\t".md5($l)."\n"; exit; } }' I found that ecrbx yields 0310763137713908293306e502423361 which is a number in scientific notation. So I guess such collisions could be easier to do than plain simple collisions, but I don't know any example.

The same question would apply for other hash functions, like SHA1, SHA256, etc but would probably be harder to answer

Answer 1

These are often known as "magic hashes", and have been found for lots of different hashing algorithms. You can find a list of them here.

The easiest way to find them to to look for a hash output that starts with 0e, and the rest of the hash is all numbers (because zero times 10 to the power of anything is zero).

For example, for MD5 240610708 hashes to 0e462097431906509019562988736854 and and QLTHNDT hashes to 0e405967825401955372549139051580:

$ php -r 'var_dump(md5("240610708") == md5("QLTHNDT"));'
bool(true)