Juggling facts

Platform: HackTheBox | Category: Web | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

An organization seems to possess knowledge of the true nature of pumpkins. Can you find out what they honestly know and uncover this centuries-long secret once and for all?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Click the secret button.

3. Now let's check the source code given.

4. Looks like the flag is in the secrets page.

5. Then when i analyzed the IndexController.php file.

6. What comes to my mind is, the vuln here is type juggling. Notice there's 3 equal signs, which means not only the value must be the same but the type also. Not only that, we know that in PHP , the switch-case statement does loose comparison.

SOURCE

https://www.php.net/manual/en/control-structures.switch.php

1. Based of the documentation from the link above. We can't send the type value at json as true. Hence we got the false bool, then we can get the flag.

2. Let's implement this using burpsuite and set the intercept to on when entering the secrets page.

3. Choose send to repeater, click send.

4. Change the type value as true, without the quote, otherwise the webapp shall think that we request a type.

5. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.