Type Juggling in PHP Switch - Juggling Facts [HackTheBoo CTF 2022]

Published: 04 November 2022
on channel: 0xdf

1,256

Type juggling is a really interesting PHP vulerability that happens when a developer uses == to compare two items that might be of different types, and can lead to some unexpected behavior. Juggling Facts can be exploited by noticing that the switch statement in PHP uses a loose comparison, not a strict one. This video will cover all of this, and exploit type juggling to get the flag.

PHP switch: https://www.php.net/manual/en/control...
PHP comparisons: https://www.php.net/manual/en/types.c...
HTB Falafel writeup with type juggling using hash: https://0xdf.gitlab.io/2018/06/23/htb...

☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf

[00:00] Introduction
[00:27] Webpage enumeration
[02:19] Looking at source, starting with docker
[03:26] PHP source analysis
[04:15] getfacts endpoint
[05:39] Type juggling analysis
[08:08] Switch type juggling example in PHP terminal
[10:30] Get flag in Burp Repeater

On this page of the site you can watch the video online Type Juggling in PHP Switch - Juggling Facts [HackTheBoo CTF 2022] with a duration of hours minute second in good quality, which was uploaded by the user 0xdf 04 November 2022, share the link with friends and acquaintances, this video has already been watched 1,256 times on youtube and it was liked by 44 viewers. Enjoy your viewing!

37,384

1.6K

00:00:00