Skip to content
logo
Red tradecraft
PHP assert()
  • Privacy greenhouse
  • Defence blues
  • Purple crossroads
  • Indigo observatory
  • Contact
Initializing search
    • An adversary mind map, one of many
    • The grounds
    • Ankh-Morpork: the city leaves a footprint
    • Fungolia earthworks
    • Unseen University Power & Light Co.
    • The Scarlet Semaphore
    • TryHackMe rooms
    • Root-Me challenges
      • Boars in the API undergrowth
      • Rooting around in memory
      • Picking the locks of ciphers
      • Where a script hands over the keys
      • Rhizomatic sprawl: the network underworld
      • Prising binaries open
      • Secrets buried in pixels
      • Foraging in the web orchard
        • Root-Me Web client challenges
        • Root-Me Web server challenges
          • Insecure code management
          • Directory traversal
          • File upload: null byte
          • PHP assert()
            • Resources
            • Techniques
          • PHP Filters
          • PHP Register globals
          • JWT Introduction
          • JWT (not) revoked token
          • JWT weak secret
          • Python: Server-side Template Injection Introduction
          • Command injection: filter bypass
          • Java: Server-side Template Injection (SSTI)
          • Local file inclusion
          • Local file inclusion: double encoding
          • PHP preg_replace
          • PHP type juggling
          • SQL injection: authentication
          • SQL injection: string
          • XSLT code execution
          • PHP path truncation
          • PHP serialisation
          • SQL injection: numeric
          • SQL injection: routed
          • SQL truncation
          • XPath injection: authentication
          • SQL injection: time-based
    • RIPE NCC Academy labs
    • Resources
    • Techniques

    PHP assert()¶

    root-me challenge: PHP - assert(): Find and exploit the vulnerability to read the file .passwd.

    PHP assert()

    etcetera.

    Remember to sanitise all user input! / Pensez à valider toutes les entrées utilisateurs !
    Don't use assert! / N'utilisez pas assert 
    

    Resources¶

    • HackTricks: Code execution with Assert()

    Techniques¶

    • Directory traversal

    • Broken access control

    • Path traversal runbook

    2026-07-30 17:57
    © Copyright 2025, TyMyrddin.
    Created using Sphinx 7.2.6. and Sphinx-Immaterial

    Made with love by Ty Myrddin, 2026, with a forest garden fostered by /ut7