Type Juggling in PHP Switch - Juggling Facts [HackTheBoo CTF 2022]
Type juggling is a really interesting PHP vulerability that happens when a developer uses == to compare two items that might be of different types, and can lead to some unexpected behavior. Juggling Facts can be exploited by noticing that the switch statement in PHP uses a loose comparison, not a strict one. This video will cover all of this, and exploit type juggling to get the flag.
PHP switch: https://www.php.net/manual/en/control...
PHP comparisons: https://www.php.net/manual/en/types.c...
HTB Falafel writeup with type juggling using hash: https://0xdf.gitlab.io/2018/06/23/htb...
☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf
[00:00] Introduction
[00:27] Webpage enumeration
[02:19] Looking at source, starting with docker
[03:26] PHP source analysis
[04:15] getfacts endpoint
[05:39] Type juggling analysis
[08:08] Switch type juggling example in PHP terminal
[10:30] Get flag in Burp Repeater