sqlmapproject/sqlmap · error · SqlmapSyntaxException

invalid proxy address

Error message

invalid proxy address '%s' ('%s')

What it means

In _setHTTPHandlers, when a --proxy value is supplied, sqlmap parses it with urllib.parse.urlsplit inside try/except. If urlsplit (or subsequent handling) raises ValueError — e.g. malformed brackets in an IPv6 host, invalid port syntax, or characters the parser rejects — the guard re-raises as SqlmapDataException with the proxy string and the parser's error message embedded.

Solutions

1. Correct the --proxy value to a well-formed URL, e.g. `http://host:port` or `socks5://host:port`.
2. For IPv6 hosts, wrap the address in square brackets: `http://[::1]:8080`.
3. Remove stray characters, spaces, or a duplicated scheme (e.g. avoid `http://http://...`).
4. Test the URL with `python -c "import urllib.parse; print(urllib.parse.urlsplit('<proxy>'))"` to confirm it parses.

When it happens

Trigger: Thrown at lib/core/option.py:1267 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/426b573bc1140102. Report an issue: GitHub.

Appendix: source

Thrown at lib/core/option.py:1267

            conf.proxyList = conf.proxyList[1:] + conf.proxyList[:1]

            if len(conf.proxyList) > 1:
                infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy
                logger.info(infoMsg)

        elif not conf.proxy:
            if conf.hostname in ("localhost", "127.0.0.1") or conf.ignoreProxy:
                proxyHandler.proxies = {}

        if conf.proxy:
            debugMsg = "setting the HTTP/SOCKS proxy for all HTTP requests"
            logger.debug(debugMsg)

            try:
                _ = _urllib.parse.urlsplit(conf.proxy)
            except Exception as ex:
                errMsg = "invalid proxy address '%s' ('%s')" % (conf.proxy, getSafeExString(ex))
                raise SqlmapSyntaxException(errMsg)

            match = re.search(r"\A([^:]*):([^:]*)@([^@]+)\Z", _.netloc)
            if match:
                username, password = match.group(1), match.group(2)
            else:
                username, password = None, None

            hostnamePort = _.netloc.rsplit('@', 1)[-1].rsplit(":", 1)

            scheme = _.scheme.upper()
            hostname = hostnamePort[0]
            port = None

            if len(hostnamePort) == 2:
                try:
                    port = int(hostnamePort[1])
                except:
                    pass  # drops into the next check block

View on GitHub (pinned to 0a35b20e39)