Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Update "Insecure deserialization" topic

Matvey | Last updated: Apr 03, 2024 09:36AM UTC

I was reading the "Modifying data types" (https://portswigger.net/web-security/deserialization/exploiting#modifying-data-types) section of the topic and tried to test the comparison operator in a PHP sandbox online, the "0" == "Example string" example in particular. I got a bit confused as the results did not match with what was said in the text. Turns out, comparison operator's behavior was changed in PHP 8 and the previously mentioned example now returns 'false' instead of 'true'. Perhaps it's worth adding a note so that readers would be aware that the provided examples' results may vary depending on the PHP version used in the application?

Hannah, PortSwigger Agent | Last updated: Apr 03, 2024 04:12PM UTC

Hi. Thanks for highlighting this. Are these the differences that you are referring to? - https://www.php.net/manual/en/migration80.incompatible.php

Matvey | Last updated: Apr 08, 2024 12:53PM UTC

Sorry for a long response. Yeah, I was talking about these differences.

Hannah, PortSwigger Agent | Last updated: Apr 10, 2024 11:44AM UTC