PHP Type Juggling, LFI and Command Injection - Solution to April ’23 Challenge

🏆 The official writeup for the April ’23 Challenge, featuring PHP Type Juggling, LFI, Command Injection / Log Poisoning (incl some WAF filters) 😎 Follow strangemonkey: Solve the challenge: 🧑💻 Sign up and start hacking right now - 🐱💻 Can’t get enough of these challenges? - 👾 Join our Discord - 🎙️ This show is hosted by ( @_CryptoCat ) & 👕 Do you want some Intigriti Swag? Check out 00:00 Intro 00:20 Explore web application 01:11 PHP type juggling 05:37 Investigate endpoint 06:05 Fuzzing GET parameters 11:04 Local file inclusion 12:54 Discover hidden admin page 14:23 Log poisoning / Command injection 20:51 Challenge summary 21:53 Conclusion