> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/type-juggling.md).

# Type Juggling

### PHP

<figure><img src="/files/7I0z2UtFUQ53GNHraoCq" alt=""><figcaption></figcaption></figure>

* \== is an insecure comparison
* Checks if 2 strings are equal to each other but does not check the data types

#### Exploitation

* If we submit an empty array `password[]=something`, PHP translates POST variables to an empty array which causes strcmp($password, array()) -> NULL which will return 0.

```bash
username[]=admin&password[]=admin
```

<figure><img src="/files/e8xYq9gkKhssp4osOOks" alt=""><figcaption></figcaption></figure>

<details>

<summary>Good Writeup</summary>

<https://0xdf.gitlab.io/2020/04/22/htb-nineveh.html>

</details>