type-juggling

PHP type juggling enables authentication bypass when loose comparison operators (`==`/`!=`) coerce attacker-controlled inputs to match secrets. This Skill identifies vulnerable endpoints and verifies bypasses by testing magic hashes, NULL, and array coercion edge cases.

A magic hash is a `0e...` formatted hash digest that PHP evaluates as zero under loose comparison, enabling HMAC bypass. This Skill guides testing for magic hash vulnerabilities and other type coercion issues in signature validation endpoints.

To find weak equality bypasses in PHP token validation, this Skill analyzes endpoints using `==`/`!=` instead of strict equality or `hash_equals`. It routes probes based on the comparison sink and PHP version to target type juggling vulnerabilities.

You should use strict equality or `hash_equals` for password checks whenever attacker-controlled inputs are compared to secrets. This Skill helps identify endpoints failing to do so, verifying loose comparison vulnerabilities in authorized testing contexts.

Type juggling cannot bypass signature validation if the code uses `hash_equals` or strict equality (`===`). This Skill specifically targets endpoints using loose comparison (`==`/`!=`) for HMAC and hash digest checks where type coercion applies.

To reproduce PHP weak comparison behavior safely, this Skill provides payload shapes and decision paths for authorized lab testing. It verifies server behavior by targeting magic hash and NULL/array coercion edge cases based on the comparison sink.