# SimpleAuth
The challenge server is running the following PHP script:
```php Parses encoded_string as if it were the query string passed via a URL andsets variables in the current scope (or in the array if result is provided).  > **Warning** Using this function without the result parameter is highlyDISCOURAGED and DEPRECATED as of PHP 7.2.  > Read section on security of Using Register Globals explaining why it isdangerous.
What this means is that, unless a second argument is passed to `parse_str`,all variables in the query string will become PHP variables in the currentscope. So for example if we invoked the script with `?action=myaction`,`$action` will be set to `myaction` in php code. We can set any global variablewe want in this way.
The script checks if `$action == 'auth'`, then uses `$user` and `$pass` tocompute a md5 hash and compares the hash against a constant. Since we can setany global variable, rather than attempting to crack the hash, we can just use`?action=auth&hashed_password=c019f6e5cd8aa0bbbcc6e994a54c757e`.
`TWCTF{d0_n0t_use_parse_str_without_result_param}`