title: Pen-test hard-coded php compare
body: <p>I post today because I have a small problem. In fact I have to do a pen-test for my IT school, and I must bypass a login form coded like this :</p>
  
  <pre><code>&lt;?php
  if (count($_POST) &amp;&amp; (
      $_POST['pseudo'] != 'admin' ||
       $_POST['pass'] != '* HIDDEN *'))
    header('location: index.php');
  [...blablabla...] PASSPHRASE [...bliblibli...]
  ?&gt;
  </code></pre>
  
  <p>I have to get the passphrase, but I cannot do an SQL injection, because the login and the password are stored in the .php file.
  Does someone have an idea how to bypass that?</p>
  
  <p>I tried to do like an SQL Injection, but in PHP, like typing : 1!=1))// into the password form, but it doesn't work at all.</p>