{"record":{"id":"041efd0b5b36bfb9","repo":"sqlmapproject/sqlmap","slug":"anti-csrf-token-parameter-s-not-found-in-provid","errorCode":null,"errorMessage":"anti-CSRF token parameter '%s' not found in provided GET, POST, Cookie or header values","messagePattern":"anti-CSRF token parameter '(.+?)' not found in provided GET, POST, Cookie or header values","errorType":"validation","errorClass":"SqlmapGenericException","httpStatus":null,"severity":"error","filePath":"lib/core/target.py","lineNumber":463,"sourceCode":"                    conf.paramDict[PLACE.CUSTOM_HEADER] = {httpHeader: \"%s,%s%s\" % (httpHeader, headerValue, kb.customInjectionMark)}\n                    conf.httpHeaders = [(_[0], _[1].replace(kb.customInjectionMark, \"\")) for _ in conf.httpHeaders]\n                    testableParameters = True\n\n    if not conf.parameters:\n        errMsg = \"you did not provide any GET, POST and Cookie \"\n        errMsg += \"parameter, neither an User-Agent, Referer or Host header value\"\n        raise SqlmapGenericException(errMsg)\n\n    elif not testableParameters:\n        errMsg = \"all testable parameters you provided are not present \"\n        errMsg += \"within the given request data\"\n        raise SqlmapGenericException(errMsg)\n\n    if conf.csrfToken:\n        if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r\"\\b%s\\b\" % conf.csrfToken, conf.data or \"\") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}) and not any(re.search(conf.csrfToken, _, re.I) for _ in conf.paramDict.get(PLACE.URI, {}).values()):\n            errMsg = \"anti-CSRF token parameter '%s' not \" % conf.csrfToken._original\n            errMsg += \"found in provided GET, POST, Cookie or header values\"\n            raise SqlmapGenericException(errMsg)\n    else:\n        for place in (PLACE.GET, PLACE.POST, PLACE.COOKIE):\n            if conf.csrfToken:\n                break\n\n            for parameter in conf.paramDict.get(place, {}):\n                if any(parameter.lower().count(_) for _ in CSRF_TOKEN_PARAMETER_INFIXES):\n                    message = \"%sparameter '%s' appears to hold anti-CSRF token. \" % (\"%s \" % place if place != parameter else \"\", parameter)\n                    message += \"Do you want sqlmap to automatically update it in further requests? [y/N] \"\n\n                    if readInput(message, default='N', boolean=True):\n                        class _(six.text_type):\n                            pass\n                        conf.csrfToken = _(re.escape(getUnicode(parameter)))\n                        conf.csrfToken._original = getUnicode(parameter)\n                        break\n\ndef _setHashDB():","sourceCodeStart":445,"sourceCodeEnd":481,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/lib/core/target.py#L445-L481","documentation":"Error \"anti-CSRF token parameter '%s' not found in provided GET, POST, Cookie or header values\" thrown in sqlmapproject/sqlmap.","triggerScenarios":"Thrown at lib/core/target.py:463 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","schemaVersion":2},"datasetVersion":"2026-08-27T03:17:27.898Z"}