数组绕过

0x01精华

---

md5(array()) = null
sha1(array()) = null    
ereg(pattern,array()) = null vs preg_match(pattern,array) = false
strcmp(array(), "abc") = null
strpos(array(),"abc") = null

转载于：简书m3lon

0x02怎么用

---

举个栗子：

$pass=@$_POST['pass'];
$pass1=***********;//被隐藏起来的密码
if(isset($pass))
{
if(@!strcmp($pass,$pass1)){
echo "flag:nctf{*}";
}else{
echo "the pass is wrong!";
}
}else{
echo "please input pass!";
}

payload

pass[]=clt

菜狗乱讲

当数组传入时，strcmp()函数返回的值会是null, !之后就过了if了。