将 SHA1 转换为正常形式
我有一个数据库，其中每个密码都是通过 SHA1 传递的。有时，我想进入用户仪表板看看感觉如何。有没有办法，我可以将 SHA1 转换为正常形式以用于测试目的？
谢谢
I have a database where every password is passed via SHA1. Sometimes, I want to go to the users dashboard and look how it feels like. Is there a way, I could convert SHA1 to normal form just for testing purposes?
Thank You
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果“正常形式”的意思是“我可以检索创建给定哈希的字符串”，那么答案是否定的。它应该是否定的，因为这就是安全哈希的全部要点：使其非常容易创建，极其复杂（理想情况下不可能）恢复，否则，你到底为什么要创建安全哈希？
如果您试图破解用户的帐户，那么我建议您去另一个论坛。
If by "normal form" you mean "can I retrieve the string that created a given hash", the answer is no. And it should be NO, because that's the whole point of secure hashes: make it very easy to create, extremely complicated (ideally impossible) to revert, otherwise, why on Earth would you make a secure hash?
If you are trying to hack on the user's accounts, then I suggest you go to another forum.
SHA1 是一种单向哈希。您无法将其转换为正常形式。您可以在这里阅读更多相关信息： http://php.net/manual/en/function .sha1.php
出于测试目的，您应该创建一个测试用户帐户。使用 sha1('测试');或者任何你喜欢的东西。
SHA1 is a one-way hash. You can't convert it to normal form. You can read more about it here: http://php.net/manual/en/function.sha1.php
For testing purposes, you should create a test user account. Use sha1('test'); or whatever you prefer.
由于您无法将 SHA1 转换为明文，因此您可以编辑身份验证脚本，假设其 PHP 将密码输入文本加密为 SHA1，然后将其与数据库值进行比较以允许匹配的密码或“管理员”密码。
例如，如果您的代码类似于
if( $html_username_input == $db_username && $sha1_html_password_input == $db_password ) {
//已验证
}
别的 {
// 未验证
类似于
您可以添加一个 elseif 语句，其内容
elseif( $html_username_input == $db_username && $sha1_html_password_input == $sha1_YOUR_ADMIN_PASSWORD ) {
// 已验证
显然，
您的代码看起来不会完全像那样，但这是一个允许您检查随机人员的仪表板的选项。
Since you cannot convert SHA1 to plaintext, you can edit the authentication script assuming its PHP where it encrypts the password input text to SHA1 and than compares it to the DB value to allow either the matched password, or an "admin" password.
For example, if your code is something like
if( $html_username_input == $db_username && $sha1_html_password_input == $db_password ) {
//Authenticated
}
else {
// Not Authenticated
}
You can add in an elseif statement that says something like
elseif( $html_username_input == $db_username && $sha1_html_password_input == $sha1_YOUR_ADMIN_PASSWORD ) {
// Authenticated
}
Obviously your code won't look exactly like that, but that is an option to allow you to check on random people's dashboards.
虽然上面提供了您问题的答案，但我会提到一些可能会解决您问题的内容。
您需要为您自己的网站创建虚拟帐户。我意识到您的管理员拥有所有权限，出于测试目的，这不会为您提供用户视角。我将我的虚拟帐户命名为 fakeuser，密码为 fakepassword。该用户仅存在于我进行测试的本地主机上。
While the answer to your question is provided above, I'll mention something that might solve your problem.
You need to create dummy accounts to your own website. I realize your admin has all privileges, and for testing purposes this doesn't give you the user perspective. I named my dummy account fakeuser with the password fakepassword. This user exists only on my localhost where I do my testing.