PHP expresses two different strings to be the same [duplicate]

最新推荐文章于 2022-01-27 16:56:43 发布

ncafei

最新推荐文章于 2022-01-27 16:56:43 发布

阅读量677

点赞数

分类专栏： ctf web 安全

安全同时被 3 个专栏收录

47 篇文章

订阅专栏

web

44 篇文章

订阅专栏

ctf

5 篇文章

订阅专栏

本文探讨了如何利用 PHP 的类型转换特性绕过 MD5 哈希比较验证。通过特殊的字符串输入使得 MD5 函数输出特定的浮点数形式，从而在使用 == 运算符时被当作数值进行比较并返回真。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

ctf遇到一题，绕过 == 操作符判断的 php:md5 相等验证

原理在 stackoverflow上找到了答案

stackoverflow

php-expresses-two-different-strings-to-be-the-same

why-md5240610708-is-equal-to-md5qnkcdzo

Why does the following statement return true?

"608E-4234" == "272E-3063"

"608E-4234" is the float number format, so they will cast into number when they compares.

608E-4234 and 272E-3063 will both be float(0) because they are too small.

For == in php,

If you compare a number with a string or the comparison involves numerical strings, then each string is converted to a number and the comparison performed numerically.

http://php.net/manual/en/language.operators.comparison.php

and

var_dump(md5('240610708') == md5('QNKCDZO'));

Output:

bool(true)

md5('240610708') 's result is 0e462097431906509019562988736854.

md5('QNKCDZO') 's result is 0e830400451993494058024219903391.

They are both float number format strings (numerical strings), and if you use == in php, when compare a number with a string or the comparison involves numerical strings, then each string is converted to a number and the comparison performed numerically.

Both of the strings are converted to 0 when compared with ==, if you want to compare them as string, remember to use ===(strict comparison) instead.

类似

PHP 探测任意网站密码明文/加密手段办法： md5('240610708') == md5('QNKCDZO')

var_dump(md5('240610708') == md5('QNKCDZO'));
var_dump(md5('aabg7XSs') == md5('aabC9RqS'));
var_dump(sha1('aaroZmOk') == sha1('aaK1STfY'));
var_dump(sha1('aaO8zKZF') == sha1('aa3OFF9m'));
var_dump('0010e2' == '1e3');
var_dump('0x1234Ab' == '1193131');
var_dump('0xABCdef' == ' 0xABCdef');

https://news.ycombinator.com/item?id=9484757