sqlmapproject/sqlmap · error · SqlmapNotVulnerableException

all tested parameters do not appear to be injectable.

Error message

all tested parameters do not appear to be injectable.

What it means

Reported at the end of start() when testing ran to completion but no injection was confirmed for any parameter. It is a results summary rather than a crash, and the surrounding code appends advisory hints (e.g. --string/--regexp tuning, WAF/IPS presence) when applicable.

Solutions

1. Raise the risk/level (e.g. --level=5 --risk=3) so more injection techniques and parameter locations are tested
2. Tune boolean detection with --string/--regexp/--text-only when responses are volatile
3. If a WAF/IPS was identified, try evasion via --tamper or adjust the request with --hpp/--delay

When it happens

Trigger: Thrown at lib/controller/controller.py:875 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/4557f3f5a2c2cdd4. Report an issue: GitHub.

Appendix: source

Thrown at lib/controller/controller.py:875

                    elif conf.regexp:
                        errMsg += " Also, you can try to rerun by providing a "
                        errMsg += "valid value for option '--regexp' as perhaps the regular "
                        errMsg += "expression that you have chosen "
                        errMsg += "does not match exclusively True responses."

                    if not conf.tamper:
                        if kb.identifiedWafs:
                            errMsg += " As a WAF/IPS ('%s') was identified during the run, " % ", ".join(kb.identifiedWafs)
                            errMsg += "you are strongly advised to retry with option '--tamper' (e.g. '--tamper=space2comment')"
                        else:
                            errMsg += " If you suspect that there is some kind of protection mechanism "
                            errMsg += "involved (e.g. WAF) maybe you could try to use "
                            errMsg += "option '--tamper' (e.g. '--tamper=space2comment')"

                        if not conf.randomAgent:
                            errMsg += " and/or switch '--random-agent'"

                    raise SqlmapNotVulnerableException(errMsg.rstrip('.'))
            else:
                # Flush the flag
                kb.testMode = False

                _saveToResultsFile()
                _saveToHashDB()
                _showInjections()
                _selectInjection()

            if kb.injection.place is not None and kb.injection.parameter is not None:
                if conf.multipleTargets:
                    message = "do you want to exploit this SQL injection? [Y/n] "
                    condition = readInput(message, default='Y', boolean=True)
                else:
                    condition = True

                if condition:
                    try:

View on GitHub (pinned to 0a35b20e39)