Course

In this exercise, you will explore the security implications of PHP's `assert` function when improperly used. The lab demonstrates how injecting a single or double quote can break the syntax, revealing that PHP is evaluating the code. You will learn how to correct the syntax and inject a payload that allows you to execute PHP functions such as `phpinfo()`, which provides detailed configuration information of the PHP environment.

The lab also guides you to replace `phpinfo()` with more impactful functions like `system()` to execute system commands. This exercise emphasizes the importance of understanding how PHP's `assert` function works and the potential risks associated with its misuse, especially in PHP versions prior to 7.0. The lab concludes by highlighting that these methods are largely mitigated in PHP 7 and above, due to changes in how `assert` handles string arguments.