Top 10 winner
Magic Hashes
PHP's == operator compares two hash strings numerically when both look like 0e followed only by digits, so both become the float zero and match. Submitting a precomputed magic value as a password, token or cookie therefore makes the comparison return true without knowing the secret, and the post tabulates such inputs for md5, sha1, ripemd, tiger, haval and others.
Record
- Published by
- WhiteHat Security
- Topic
- Crypto
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of WhiteHat Security, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .