sqlmapproject/sqlmap · error · SqlmapSyntaxException

HTTP authentication credentials value must be in format…

Error message

HTTP %s authentication credentials value must be in format 'username:password'

What it means

For Basic/Digest the credentials must match '^(.*?):(.*?)$' (username:password); for NTLM/Negotiate the stricter '^(DOMAIN\\username):(.*)$' form is required since the domain must be separated by a backslash and the greedy first group avoids swallowing colons in the password. When --auth-cred does not match the scheme's regular expression, this SqlmapSyntaxException — with the auth type interpolated — is raised.

Solutions

1. For basic/digest use `--auth-cred="username:password"` with exactly one colon.
2. For ntlm/negotiate use `--auth-cred="DOMAIN\\username:password"` (single backslash; quote it in shells so it is not eaten).
3. Do not include the scheme or 'Authorization:' prefix in the value — only raw credentials.
4. Check for whitespace or hidden characters introduced by copy-paste; quote the argument if the password contains shell metacharacters.

When it happens

Trigger: Thrown at lib/core/option.py:1524 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/00626336d7887437. Report an issue: GitHub.

Appendix: source

Thrown at lib/core/option.py:1524

        elif authType == AUTH_TYPE.BEARER:
            conf.httpHeaders.append((HTTP_HEADER.AUTHORIZATION, "Bearer %s" % conf.authCred.strip()))
            return
        elif authType in (AUTH_TYPE.NTLM, AUTH_TYPE.NEGOTIATE):
            # Note: the DOMAIN\username part is colon-free, so the password group takes the full
            # remainder (a greedy first group would otherwise swallow colons inside the password).
            # For Negotiate, DOMAIN is the Kerberos realm.
            regExp = "^([^:]*\\\\[^:]*):(.*)$"
            errMsg = "HTTP %s authentication credentials value must " % authType
            errMsg += "be in format 'DOMAIN\\username:password'"
        elif authType == AUTH_TYPE.PKI:
            errMsg = "HTTP PKI authentication require "
            errMsg += "usage of option `--auth-file`"
            raise SqlmapSyntaxException(errMsg)

        aCredRegExp = re.search(regExp, conf.authCred)

        if not aCredRegExp:
            raise SqlmapSyntaxException(errMsg)

        conf.authUsername = aCredRegExp.group(1)
        conf.authPassword = aCredRegExp.group(2)

        kb.passwordMgr = _urllib.request.HTTPPasswordMgrWithDefaultRealm()

        _setAuthCred()

        if authType == AUTH_TYPE.BASIC:
            authHandler = SmartHTTPBasicAuthHandler(kb.passwordMgr)

        elif authType == AUTH_TYPE.DIGEST:
            authHandler = _urllib.request.HTTPDigestAuthHandler(kb.passwordMgr)

        elif authType == AUTH_TYPE.NTLM:
            from lib.request.ntlm import HTTPNtlmAuthHandler
            authHandler = HTTPNtlmAuthHandler(kb.passwordMgr)

View on GitHub (pinned to 0a35b20e39)