PHP Type Juggling: Python Web Hacking | Natas: OverTheWire (Level 23)

Key Takeaways

level 23 of natus for the over the wire war game gets into a little bit of PHP variable type misunderstanding cuz see I'm actually looking at the source code in the webpage here because they're doing a little bit of the PHP highlight file where they're they throw a bunch of like span characters or HTML stuff that's not that good to look at in sublime text so I'm back in the web site here in in the Firefox in a web browser but we're determining okay if we've submitted to the form here which asks us do we want to enter a password and the PHP code tests if that key exists if we've actually submitted the form is there a stir stir or a string string whatever PHP function that is and is the request password greater than 10 so this stir stir looks like it's kind of comparing something like the requested password with a string I love you and and so and obviously this both of these conditions must be returned true to actually be retrieving the credentials for the next level password for NAT is 24 so I want to check out what these things were I wanted to see okay what is PHP stir stir and it looks like that will find the first occurrence of a string and it will return part of a haystack string starting to something from and including the first occurrence of the needle to the end of the haystack okay and that greater than 10 thing is interesting because that's expecting that request password to be an integer but we're using it as a string over here in this context so how do we get around this interesting thing is that PHP type conversions PHP doesn't entirely care really what your variable really is it all depends on what context you're using it in there how you're testing things with it PHP does not require support explicit type definition variable declarations the variable types determined by the context in which the variables being used so that is to say if string value is assigned to variable var var becomes a string if an integer variable as a sign of our it becomes an enter that's cool because it's dynamic type setting and stuff like that but it's also interesting when you're using comparison operators or just assignment operators on them so I'll shut up and I'll show you what I mean if we get back into our Python code we'll go ahead and request this page with the get function but if we wanted to post to this page we can change the method there set data to have the password and we'll set it to that string I love you so this will return wrong after I include a comment or a comma there because we're not getting that same greater than 10 thing in this case we're seeing that string I love you that the string password interpreted as a string and when it's being tested as less than or greater than 10 it's just gonna be nothing really or a zero I don't I don't entirely know I'll admit what PHP will evaluate it to however if we were to give it some numbers here like if we were to say 10 PHP is gonna start to think that this first part here when you're interpreting it as a number as an integer that's gonna be what takes precedence if you interpret it as a number so weird thing right what if I were to say oh 11 I love you because 11 is greater than 10 and the i-love-you string is still in there it'll return true on both of those cases 11 is greater than 10 and I love you is in the string it's returning that needle and the rest of the haystack so it gets it just fine here we go the credentials for the next level are password for NAT is 24 okay let's snag that but keep that in mind because PHP type juggling is seen like everywhere and a lot of web challenges and in CTF style stuff and I'm sure you'll probably run into it in the wild because PHP is still out there like crazy so definitely keep that in mind weird weird oddities with PHP that stuff gets into like magic hashes etc and PHP is just a bundle of bugs depending on on who you ask and what opinions you get but that is the solution for natus 23 let's save this for a script from natus 24 and we will move on to see what's next in this level are we getting the page perfect all right thank you guys so much for watching hope you're enjoying these if you did like the video please do press that like button if you want to comment tell me what you think what you like what you didn't like what I can do better much how much I suck etc if you want to subscribe and if you would like to support me please do check out my patreon account want to send a special shout out to the people that are supporting me already spencer clark thank you for supporting me on patreon I try to shout out everyone who does support me if they give anything more than just a dollar and five dollars or more we'll let you all showcase everything that I upload to YouTube as early as I can so even if it's scheduled for upload later I'll give it to you early access so thanks for watching guys see you soon