Four new PHP challenges, three from real incidents

Four new challenges are live in the PHP game: Steam.php, Insecure Normalization.php, Capital0.php and Command Injection.php. The first three are inspired by well-known incidents.

Steam.php is a time-of-check to time-of-use (TOCTOU) vulnerability: the code checks a value, then uses it after it has changed. It is inspired by the 2019 Steam client privilege escalation that relied on a TOCTOU race (CVE-2019-15316).

Insecure Normalization.php is a Unicode account takeover, based on a 2013 Spotify bug. Spotify converted usernames to a canonical form, but converting twice gave a different result from converting once. An attacker could register ᴮᴵᴳᴮᴵᴿᴰ, request a password reset for that new account, and end up setting the password of the existing account bigbird.

Capital0.php is server-side request forgery (SSRF), the bug class behind the 2019 Capital One breach: the server fetches a URL the attacker supplies, and reaches systems the attacker cannot reach directly.

Command Injection.php is a challenge demonstrating an app where user input reaches a shell command.

Try them: Play - SecDim