I have to find two string which are passed in URL as parameter 'str1' and 'str2' and satisfies these conditions ?
if($_GET['str1'] !== $_GET['str2'] and $_GET['str1'] and $_GET['str2'])
{
$hash1 = hash('sha256', $salt . $_GET['str1']);
$hash2 = hash('sha256', $salt . $_GET['str2']);
if($hash1 === $hash2) {
#print str1 and str2
}
}
How will I find out?
The only possible solution to break that is to make the hash function not work.
Hash function expects string input (or typecast to string), so making input as array will break the hash and both return false/not working.
Meaning both is strictly the same.
It's a cheat, but it satisfies all parts of the code as it currently is.
<?php
$_GET['str1'] = ["a"];
$_GET['str2'] = ["b"];
$salt = "aaabdnelnFnekknfn";
if($_GET['str1'] !== $_GET['str2'] and $_GET['str1'] and $_GET['str2'])
{
$hash1 = hash('sha256', $salt . $_GET['str1']);
$hash2 = hash('sha256', $salt . $_GET['str2']);
if($hash1 === $hash2) {
var_dump($_GET['str1'],$_GET['str2']);
}
}