sqlmapproject/sqlmap · error · SqlmapSyntaxException

HTTP authentication type value must be Basic, Digest…

Error message

HTTP authentication type value must be Basic, Digest, Bearer, NTLM, Negotiate or PKI

What it means

After the pairing checks, _setHTTPAuthentication normalizes the --auth-type value and validates it against the AUTH_TYPE enum (Basic, Digest, Bearer, NTLM, Negotiate, PKI). An unrecognized or misspelled scheme (e.g. 'ntlmv2', 'oauth', lowercase handled but 'form' not supported) fails the enum lookup and raises SqlmapSyntaxException enumerating the valid types.

Solutions

1. Use exactly one of: `--auth-type=basic|digest|bearer|ntlm|negotiate|pki`.
2. Fix common typos ('basics', 'digest auth', 'windows' are invalid; use ntlm or negotiate for Windows auth).
3. For certificate-based auth use `pki` together with `--auth-file`.
4. Consult `sqlmap --help` for the current list of supported authentication types.

When it happens

Trigger: Thrown at lib/core/option.py:1494 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/d773c0d12c7d59a4. Report an issue: GitHub.

Appendix: source

Thrown at lib/core/option.py:1494

        return

    if conf.authFile and not conf.authType:
        conf.authType = AUTH_TYPE.PKI

    elif conf.authType and not conf.authCred and not conf.authFile:
        errMsg = "you specified the HTTP authentication type, but "
        errMsg += "did not provide the credentials"
        raise SqlmapSyntaxException(errMsg)

    elif not conf.authType and conf.authCred:
        errMsg = "you specified the HTTP authentication credentials, "
        errMsg += "but did not provide the type (e.g. --auth-type=\"basic\")"
        raise SqlmapSyntaxException(errMsg)

    elif (conf.authType or "").lower() not in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST, AUTH_TYPE.BEARER, AUTH_TYPE.NTLM, AUTH_TYPE.NEGOTIATE, AUTH_TYPE.PKI):
        errMsg = "HTTP authentication type value must be "
        errMsg += "Basic, Digest, Bearer, NTLM, Negotiate or PKI"
        raise SqlmapSyntaxException(errMsg)

    if not conf.authFile:
        debugMsg = "setting the HTTP authentication type and credentials"
        logger.debug(debugMsg)

        authType = conf.authType.lower()

        if authType in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST):
            regExp = "^(.*?):(.*?)$"
            errMsg = "HTTP %s authentication credentials " % authType
            errMsg += "value must be in format 'username:password'"
        elif authType == AUTH_TYPE.BEARER:
            conf.httpHeaders.append((HTTP_HEADER.AUTHORIZATION, "Bearer %s" % conf.authCred.strip()))
            return
        elif authType in (AUTH_TYPE.NTLM, AUTH_TYPE.NEGOTIATE):
            # Note: the DOMAIN\username part is colon-free, so the password group takes the full
            # remainder (a greedy first group would otherwise swallow colons inside the password).
            # For Negotiate, DOMAIN is the Kerberos realm.

View on GitHub (pinned to 0a35b20e39)