digininja/DVWA · warning · Exception

Token is in wrong format

Error message

Token is in wrong format

What it means

Cheap length gate before any cryptography: the hex-encoded token must have a strlen that is a multiple of 32, because each 16-byte AES block is 32 hex characters. The check says nothing about the characters being valid hex - that surfaces later as a decrypt failure - it only rejects lengths that cannot represent whole blocks.

Source

Thrown at vulnerabilities/cryptography/source/medium.php:23

		throw new Exception ("Decryption failed");
	}
	return $e;
}

$key = "ik ben een aardbei";

$errors = "";
$success = "";
$messages = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
	try {
		if (!array_key_exists ('token', $_POST)) {
			throw new Exception ("No token passed");
		} else {
			$token = $_POST['token'];
			if (strlen($token) % 32 != 0) {
				throw new Exception ("Token is in wrong format");
			} else {
				$decrypted = decrypt(hex2bin ($token), $key);

				$user = json_decode ($decrypted);
				if ($user === null) {
					throw new Exception ("Could not decode JSON object.");
				}

				if ($user->user == "sweep" && $user->ex > time() && $user->level == "admin") {
					$success = "Welcome administrator Sweep";
				} else {
					$messages = "Login successful but not as the right user.";
				}
			}
		}
	} catch(Exception $e) {
		$errors = $e->getMessage();
	}

View on GitHub (pinned to 5d5c76cced)

Solutions

1. Re-copy one of the sample tokens exactly - each is 128 hex characters.
2. Strip surrounding whitespace before submitting (the handler does not trim for you).
3. Verify strlen(token) % 32 == 0 and the string is pure hex.
4. If generating tokens, bin2hex() raw CBC/ECB ciphertext so the length is inherently block-aligned.

Example fix

// before
$token = $_POST['token'];
// after
$token = trim($_POST['token'] ?? '');

$token = trim($_POST['token'] ?? '');
if ($token === '' || strlen($token) % 32 !== 0 || !ctype_xdigit($token)) {
    $errors = 'Token is in wrong format';
    return;
}

function isWellFormedHexToken(string $token): bool
{
    return $token !== ''
        && ctype_xdigit($token)
        && strlen($token) % 32 === 0;
}

} catch (Exception $e) {
    if ($e->getMessage() === 'Token is in wrong format') {
        $errors = 'Token must be hex, whole 16-byte blocks (32 chars per block), no whitespace.';
    } else {
        $errors = $e->getMessage();
    }
}

When it happens

Trigger: A token with an odd number of characters; a truncated or extended hex string; a trailing newline or space copied along from the textarea (adds 1-2 characters); pasting a base64 token instead of hex; concatenating two tokens with a stray separator character.

Common situations: Terminal/editor copy-paste picking up whitespace; manual editing of hex strings; mixing encodings between systems (base64 vs hex); scripts that join or slice hex without checking alignment.

Related errors

• Decryption failed
• No token passed
• Could not decode JSON object.
• IV must be 16 bytes, {strlen($iv)} passed
• Decryption failed

AI-assisted analysis of digininja/DVWA@5d5c76cced (2026-08-21). Data as JSON: /api/errors/4d53e7c58c08c7fe. Report an issue: GitHub.