sqlmapproject/sqlmap · error · SqlmapGenericException

there were no forms found at the given target URL

Error message

there were no forms found at the given target URL

What it means

Form discovery finished for the requested URL and the HTML response yielded zero parseable form elements, so there is nothing to turn into testable targets; it fires when --forms is used against a page that contains no forms (or whose response could not be parsed as HTML).

Solutions

1. Point sqlmap at a URL that actually contains <form> elements
2. Enable --crawl to recursively discover forms on linked pages instead of a single URL
3. Pass known parameters explicitly via --data or -r rather than relying on --forms

When it happens

Trigger: Thrown at lib/core/common.py:5013 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/ca3cec51612d66e2. Report an issue: GitHub.

Appendix: source

Thrown at lib/core/common.py:5013

        for name, value in re.findall(r"['\"]?(\w+)['\"]?\s*:\s*['\"]?([^'\",}]*)['\"]?", match.group(2)):
            data += "%s=%s%s" % (name, value.strip(), DEFAULT_GET_POST_DELIMITER)

        data = data.rstrip(DEFAULT_GET_POST_DELIMITER)
        retVal.add((url, HTTPMETHOD.POST, data, conf.cookie, None))

    for match in re.finditer(r"(?s)(\w+)\.open\(['\"]POST['\"],\s*['\"]([^'\"]+)['\"]\).*?\1\.send\(([^)]+)\)", content):
        url = _urllib.parse.urljoin(url, htmlUnescape(match.group(2)))
        data = match.group(3)

        data = re.sub(r"\s*\+\s*[^\s'\"]+|[^\s'\"]+\s*\+\s*", "", data)

        data = data.strip("['\"]")
        retVal.add((url, HTTPMETHOD.POST, data, conf.cookie, None))

    if not retVal and not conf.crawlDepth:
        errMsg = "there were no forms found at the given target URL"
        if raiseException:
            raise SqlmapGenericException(errMsg)
        else:
            logger.debug(errMsg)

    if addToTargets and retVal:
        for target in retVal:
            kb.targets.add(target)

    return retVal

def checkSameHost(*urls):
    """
    Returns True if all provided urls share that same host

    >>> checkSameHost('http://www.target.com/page1.php?id=1', 'http://www.target.com/images/page2.php')
    True
    >>> checkSameHost('http://www.target.com/page1.php?id=1', 'http://www.target2.com/images/page2.php')
    False
    """

View on GitHub (pinned to 0a35b20e39)