Is it actually possible?  Go to the What is your Name? challenge

I managed to find the right number, tested it locally on exact version and everything passed. However, in the code the session id is always overwritten even after passing the condition. I searched and tried but didn't seem to find any workaround. Can I get a slight hint or a push into the right direction so that I am not trying desperate things?

 .

If you don't want to give a hint, can you at least point me to some documentation or learning resources that will help? This challenge has been buggin me for several days and I honestly don't know what to do next.

Quote from XORci5t

Sep 23, 2025 - 13:56:49

If you don't want to give a hint, can you at least point me to some documentation or learning resources that will help? This challenge has been buggin me for several days and I honestly don't know what to do next.

same on my side. tried to emulate with same PHP version for 32 and 64bit. it works localy. does not work for some reason here. I am confused. Nobody managed to succced this year. so possible its not working. I did consider many different kinds of attack paths as well. stuck and well just gona try to compile php differently (not gona spoil here why) but it should only just simulate the impossibility even localy LOL

The challenge still works as expected.
This is really a nice challenge, but it's not easy. Maybe try to solve other PHP ones first, and then concentrate on the question how it could be even possible to solve this one.

Quote from tehron

Nov 02, 2025 - 15:09:43

The challenge still works as expected.
This is really a nice challenge, but it's not easy. Maybe try to solve other PHP ones first, and then concentrate on the question how it could be even possible to solve this one.

Thanks for confirmation. During years of pentesting I had ZERO production PHP apps to test. So I never focused on this untill now.