What causes "No token passed" in digininja/DVWA?

Include a token field in the POST body, e.g. curl -d 'token= '.

digininja/DVWA · warning · Exception

No token passed

Error message

No token passed

What it means

First validation in the medium-level POST handler: it demands a 'token' key in $_POST before any length, decryption, or JSON checks run. It fires purely on request shape - the value may be empty and still pass, only the presence of the parameter matters.

Source

Thrown at vulnerabilities/cryptography/source/medium.php:19

<?php
function decrypt ($ciphertext, $key) {
	$e = openssl_decrypt($ciphertext, 'aes-128-ecb', $key, OPENSSL_PKCS1_PADDING);
	if ($e === false) {
		throw new Exception ("Decryption failed");
	}
	return $e;
}

$key = "ik ben een aardbei";

$errors = "";
$success = "";
$messages = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
	try {
		if (!array_key_exists ('token', $_POST)) {
			throw new Exception ("No token passed");
		} else {
			$token = $_POST['token'];
			if (strlen($token) % 32 != 0) {
				throw new Exception ("Token is in wrong format");
			} else {
				$decrypted = decrypt(hex2bin ($token), $key);

				$user = json_decode ($decrypted);
				if ($user === null) {
					throw new Exception ("Could not decode JSON object.");
				}

				if ($user->user == "sweep" && $user->ex > time() && $user->level == "admin") {
					$success = "Welcome administrator Sweep";
				} else {
					$messages = "Login successful but not as the right user.";
				}
			}

View on GitHub (pinned to 5d5c76cced)

Solutions

Include a token field in the POST body, e.g. curl -d 'token=<hex token>'.
If using the web form, make sure the textarea keeps name='token' inside the form element.
When scripting, set Content-Type to application/x-www-form-urlencoded so the body is parsed into $_POST.

Example fix

<!-- before: input stripped or renamed -->
<!-- after -->
<textarea id='token' name='token'></textarea>

Defensive patterns

Strategy: validation

Validate before calling

document.forms.ecb.addEventListener('submit', function (e) {
    var token = document.getElementById('token').value.trim();
    if (token === '') {
        e.preventDefault();
        alert('Paste a token before submitting.');
    }
});

Try / catch

} catch (Exception $e) {
    $errors = match ($e->getMessage()) {
        'No token passed' => 'Paste a token before submitting.',
        default => $e->getMessage(),
    };
}

Prevention

Keep required form fields present and named exactly as the server expects.
Add client-side required/validation checks to fail fast before the POST.
When scripting requests, always send the full expected parameter set with the correct Content-Type.

When it happens

Trigger: Sending a crafted POST (curl, Burp Repeater, fetch from a console) with no token parameter at all; removing the textarea from the DOM before submitting so the browser omits the field; renaming the form input so the posted name is no longer 'token'; scanners that probe the endpoint with empty bodies.

Common situations: Scripted clients and security scanners dropping optional-looking parameters; refactors that rename form fields without updating server-side key expectations; automated form-filling tools that clear and remove inputs.

Related errors

AI-assisted analysis of digininja/DVWA@5d5c76cced (2026-08-21). Data as JSON: /api/errors/0b856ed6a54695be. Report an issue: GitHub.