php弱类型绕过

php弱类型绕过

1
2
3
4
5
6
7
8
9
10

'' == 0 == false
'123' == 123
'abc' == 0
'123a' == 123
'0x01' == 1
'0e12346789' == '0e987654321'	（都解释为0）
[false] == [0] == [NULL] == ['']
NULL == false == 0
true == 1
true == "***"	(true和任意字符串弱相等)

例题

secretjson
页面源码

<?php
include_once 'secret.php'; // $flag  $key
if (isset($_POST['message'])) {
    $message = json_decode($_POST['message']);
    if ($message->key == $key) {
        echo $flag;
    } 
    else {
        echo "fail";
    }
}
else show_source(__FILE__);
?>

post –> message={“key”:true} 即可获取flag