skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

exploiting-type-juggling-vulnerabilities

Test PHP loose comparisons, magic hash collisions, and deserialization paths for authentication bypass.

2|Updated Apr 14, 2026
Search Tags:#php#deserialization#security-testing#authentication-bypass#type-juggling#loose-comparison#magic-hash
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill exploiting-type-juggling-vulnerabilities
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-type-juggling-vulnerabilities
Source: https://github.com/Acczdy/MoZiSec/tree/main/web-security/.claude/skills/exploiting-type-juggling-vulnerabilities
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill exploiting-type-juggling-vulnerabilities

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This skill helps security testers identify and exploit PHP type juggling weaknesses that enable authentication bypass, hash collisions, and input-validation bypasses.

Core Features & Use Cases

  • Loose-comparison testing: evaluate authentication flows with various input types (true, 0, [], null, strings) to reveal bypass opportunities.
  • Magic hash and deserialization checks: detect collisions using 0e hashes and test deserialization-related weaknesses.
  • Automated risk assessment: run scripted payloads against endpoints and summarize potential bypass vectors for remediation.

Quick Start

Run the agent against your target login URL with the proper username and password fields to start automated testing.

Frequently Asked Questions about exploiting-type-juggling-vulnerabilities

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test PHP type juggling vulnerabilities for authentication bypass?▼

Test PHP type juggling by sending loose comparison inputs like true, 0, null, and arrays to authentication endpoints. This reveals bypass opportunities when strict equality checks are missing in token verification flows.

What are magic hash collisions and how do they work in PHP security testing?▼

Magic hash collisions occur when PHP loose comparison treats strings starting with '0e' as exponential notation, making different hashes appear equal. Test deserialization paths and inputs to detect these weaknesses.

Can I use this to test both JSON and form-based inputs for loose comparison weaknesses?▼

Yes, you can test both JSON and form-based inputs for loose comparison weaknesses. Apply type juggling payloads across authentication, token verification, and input handling scenarios to determine bypass potential.

What is the best way to automate PHP deserialization and type juggling checks?▼

Automate PHP deserialization and type juggling checks by running scripted payloads against target endpoints. The scripts summarize potential bypass vectors for remediation, documenting specific payloads and affected endpoints.

What constraints apply when testing type juggling against web applications?▼

Constrain testing to authorized environments using strict scope and non-destructive requests. Do not use this approach outside designated security testing boundaries to ensure safety and compliance.

Related Skills

Explore More Software Engineering Skills→
habrahgithubhabrahgithub

penetration-testing

Perform authorized penetration testing on applications, APIs, and network services.

Community
Advanced
ricardoo022ricardoo022

scan-fase-11

Identify authentication and authorization bypass weaknesses via header, path, and parameter manipulation.

Community
Advanced
securityfortechsecurityfortech
6

open-redirect

Identify and exploit open redirect vulnerabilities in web applications by analyzing redirect parameters and employing bypass techniques.

Official
Intermediate
balsm-healthbalsm-health
2

exploiting-insecure-deserialization

Identify and exploit insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications.

Official
Advanced