Skip to main content

Questions tagged [typejuggling]

Abusing automatic type conversion to provoke unintended behaviour. A common attack against systems written in loosely-typed languages such as PHP.

Filter by
Sorted by
Tagged with
49 votes
2 answers

Magic hash attack in JavaScript

In PHP a magic hash attack happens when loose type comparisons cause completely different values to be evaluated as equal, causing a password "match" without actually knowing the password. ...
drewiepooey's user avatar
0 votes
1 answer

Array in HTTP GET/POST requests

In PHP server programming, URL-encoded GET/POST requests are parsed into associative "array" type upon receiving. For most of the time, query arguments can be assumed to be strings, however sometimes ...
DannyNiu's user avatar
  • 374
1 vote
1 answer

PHP type juggling with MAC

I am trying to solve a challenge, and I suspect it has to do with PHP juggling, because I get this base64 encoded json cooke as a response {"User":"foo","MAC":"bar"} BUG #2 The calculated MAC (...
Ludisposed's user avatar
29 votes
2 answers

Is the undesirable conversion of a scientific number a vulnerability?

I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
Bob Ortiz's user avatar
  • 6,685