如何判断托管CakePHP站点的密码加密方式？

Hey there! Let's figure out how to crack this password hashing mystery for your CakePHP site. Here are the practical steps I'd take to identify the algorithm:

CakePHP has version-specific default hashing behaviors, and most implementations use a salted hash (this is why your raw MD5/SHA1 attempts failed—you're missing the site's unique salt).

• First, locate the user model (usually User.php) or the main AppController.php. Look for a beforeSave method—this is where password hashing is often handled. You might see code like:

  // Example for CakePHP 2.x
  App::uses('Security', 'Utility');
  public function beforeSave($options = array()) {
      if (isset($this->data['User']['password'])) {
          $this->data['User']['password'] = Security::hash($this->data['User']['password'], 'sha256', true);
      }
      return true;
  }
  

  The second parameter here (sha256 in the example) is the exact hashing algorithm being used.

• Next, check the site's security config:

  • For CakePHP 2.x: Look in app/Config/core.php for the Security.salt value—this is the salt string appended/prepended to passwords before hashing.
  • For CakePHP 3.x+: Check config/app.php for the Security.salt and Security.cipherSeed values.

Take a look at the existing password values in your user table—their format can tell you a lot:

• 32-character hex string: Could be MD5, but only if the site isn't using a salt (unlikely for CakePHP).
• 40-character hex string: Likely SHA1, again, only if no salt is used.
• 60-character string starting with $2a$, $2b$, or $2y$: Definitely bcrypt (Blowfish)—this is the default for CakePHP 2.x and later.
• 90+ character string starting with $argon2i$ or $argon2id$: Argon2, which became supported in CakePHP 3.7+.

If you have access to run PHP code on the server, create a quick test script to generate hashes using CakePHP's built-in tools, then compare them to existing database values:

For CakePHP 2.x: #

App::uses('Security', 'Utility');
App::uses('Configure', 'Core');

$testPassword = 'your-test-password';
$salt = Configure::read('Security.salt');

// Generate hashes for common algorithms
$testHashes = [
    'MD5 (salted)' => Security::hash($testPassword, 'md5', true),
    'SHA1 (salted)' => Security::hash($testPassword, 'sha1', true),
    'SHA256 (salted)' => Security::hash($testPassword, 'sha256', true),
    'Bcrypt' => Security::hash($testPassword, 'blowfish', true)
];

print_r($testHashes);

For CakePHP 3.x+: #

use Cake\Utility\Security;
use Cake\Core\Configure;

$testPassword = 'your-test-password';
$salt = Configure::read('Security.salt');

$testHashes = [
    'SHA256 (salted)' => Security::hash($testPassword, 'sha256', $salt),
    'Bcrypt' => Security::hash($testPassword, 'blowfish', $salt),
    'Argon2i' => Security::hash($testPassword, 'argon2i', $salt)
];

print_r($testHashes);

Compare the output to the hashes in your database—when you find a match, that's your algorithm.

Look at how the site handles login validation, usually in AppController.php or UsersController.php. For example, if using CakePHP's AuthComponent, you might see:

// CakePHP 2.x example
public $components = [
    'Auth' => [
        'authenticate' => [
            'Form' => [
                'passwordHasher' => 'Blowfish' // Explicitly defines the hasher
            ]
        ]
    ]
];

The passwordHasher value directly tells you which algorithm is in use.

Once you identify the algorithm and salt, you can generate valid passwords using CakePHP's tools (not PHPMyAdmin) and update the database with those hashes.

内容的提问来源于stack exchange，提问作者JTG