sqlmapproject/sqlmap · error · NotSupportedError

SCRAM-SHA-256 authentication requires Python >= 2.7.8 (hashl

Error message

SCRAM-SHA-256 authentication requires Python >= 2.7.8 (hashlib.pbkdf2_hmac)

What it means

Error "SCRAM-SHA-256 authentication requires Python >= 2.7.8 (hashlib.pbkdf2_hmac)" thrown in sqlmapproject/sqlmap.

Source

Thrown at extra/dbwire/postgres.py:248

        if mtype in (b"N", b"S"):  # NoticeResponse / ParameterStatus may legally precede AuthenticationOk
            continue
        if mtype == b"E":
            _raise_server_error_as_operational(payload)
        if mtype != b"R":
            raise InterfaceError("unexpected message %r during authentication" % mtype)
        (code,) = struct.unpack("!I", payload[:4])
        if code == 0:  # AuthenticationOk (also the trust case)
            return
        elif code == 3:  # cleartext password
            _send(sock, b"p", (password or "").encode("utf-8") + b"\x00")
        elif code == 5:  # MD5 password
            salt = payload[4:8]
            inner = hashlib.md5((password or "").encode("utf-8") + (user or "").encode("utf-8")).hexdigest()
            token = b"md5" + hashlib.md5(inner.encode("ascii") + salt).hexdigest().encode("ascii")
            _send(sock, b"p", token + b"\x00")
        elif code == 10:  # SASL (SCRAM-SHA-256)
            if not hasattr(hashlib, "pbkdf2_hmac"):
                raise NotSupportedError("SCRAM-SHA-256 authentication requires Python >= 2.7.8 (hashlib.pbkdf2_hmac)")
            client_nonce = base64.b64encode(os.urandom(18)).decode("ascii")
            cfirst_bare = "n=,r=%s" % client_nonce
            client_first = "n,," + cfirst_bare
            _send(sock, b"p", b"SCRAM-SHA-256\x00" + struct.pack("!I", len(client_first)) + client_first.encode("ascii"))
        elif code == 11:  # SASLContinue (server-first)
            try:
                server_first = payload[4:].decode("ascii")
                attrs = dict(kv.split("=", 1) for kv in server_first.split(","))
                snonce, salt, iterations = attrs["r"], base64.b64decode(attrs["s"]), int(attrs["i"])
            except (KeyError, ValueError, binascii.Error, UnicodeDecodeError) as ex:
                raise OperationalError("malformed SCRAM server-first message (%s)" % ex)
            # RFC 5802 5.1: the server nonce MUST start with the client nonce and MUST add material of its
            # own. Skipping this lets anything that can answer the TCP connection replay a recorded
            # server-first and drive the exchange - and dbwire has no TLS layer underneath to catch it.
            if not client_nonce or not snonce.startswith(client_nonce) or len(snonce) <= len(client_nonce):
                raise OperationalError("SCRAM server nonce does not extend the client nonce (rogue server?)")
            if iterations < 4096:   # RFC 5802 recommends >= 4096; a tiny count cheapens an offline attack
                raise OperationalError("SCRAM iteration count %d is too low" % iterations)

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at extra/dbwire/postgres.py:248 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/3af32f4b8874304f. Report an issue: GitHub.