Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-23. Type Juggling in the Secure Authentication System
Mission
This login portal supports form login, a JSON API login, and a verification-code check. The admin account's real password is unknown, but the way values are compared may allow a bypass.
Hints
Hint 1 Show
Do you understand the difference between PHP's `==` and `===`?
Hint 2 Show
Think about how type juggling (automatic type conversion) affects security
Hint 3 Show
Some MD5 hashes start with 0e followed only by digits — a special case