sqlmapproject/sqlmap · error · TimelessUnusable

payload carries no negatable comparison

Error message

payload carries no negatable comparison

What it means

Error "payload carries no negatable comparison" thrown in sqlmapproject/sqlmap.

Source

Thrown at lib/request/connect.py:1685

        # is in place before any payload is built), a boolean comparison is answered by relative HTTP/2
        # response order instead of wall-clock timing - orders of magnitude faster and jitter-immune, and
        # it skips the time-based statistical warm-up entirely. The comparison request is assembled exactly
        # as it would be sent (buildOnly) and the bit is read from a coalesced pair. Not engaged -> timing.
        if timeBasedCompare and kb.get("timeless") is not None:
            from lib.request.timeless import CONNECTIVITY_ERRORS
            from lib.request.timeless import TimelessUnusable
            from lib.request.timeless import disengage
            from lib.request.timeless import negatePayload
            # Build the condition and negation requests through the SAME path (queryPage buildOnly on the
            # raw pre-placement value) so the pair differs ONLY by the negated comparison - building cond
            # from the already-placed uri/get/post while neg goes through fresh placement would make them
            # non-corresponding and flip the order.
            negValue = negatePayload(timelessOrigValue)
            try:
                if negValue is None:
                    # No sentinels (a tamper script mangled them, or a non-timeless vector slipped through):
                    # the symmetric oracle cannot be built, and there is no calibrated alternative reading.
                    raise TimelessUnusable("payload carries no negatable comparison")
                condSpec = Connect.queryPage(timelessOrigValue, place=place, buildOnly=True)
                negSpec = Connect.queryPage(negValue, place=place, buildOnly=True)
                return kb.timeless.readBitFromSpecs(condSpec, negSpec)
            except CONNECTIVITY_ERRORS as ex:
                # Either the oracle can no longer be trusted (a fresh connection failed calibration, the
                # responses drifted off the calibrated control) or the target stopped negotiating HTTP/2
                # altogether. Disengage - which restores the classic time-based vector - and answer this
                # comparison the wall-clock way instead of crashing the scan. The payload in flight was
                # forged from the heavy (millisecond) vector, so it has to be re-forged onto the restored
                # one first: re-sending it as-is would read False whatever the truth.
                warnMsg = "HTTP/2 timeless timing is no longer reliable ('%s'). Falling back to classic time-based" % getSafeExString(ex)
                singleTimeWarnMessage(warnMsg)
                disengage()
                # Re-run this comparison the wall-clock way. The payload in flight was forged from the
                # heavy (millisecond) vector, so re-sending it as-is would read False whatever the truth -
                # the straggler rewrite at the top of queryPage puts it back on the restored vector, the
                # same way it will handle the rest of this value.
                if kb.get("timelessRestore"):

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at lib/request/connect.py:1685 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/6004e5e45a7d909d. Report an issue: GitHub.