sqlmapproject/sqlmap · error · OperationalError

unexpected SCRAM server-final message

Error message

unexpected SCRAM server-final message

What it means

Error "unexpected SCRAM server-final message" thrown in sqlmapproject/sqlmap.

Source

Thrown at extra/dbwire/postgres.py:280

            # server-first and drive the exchange - and dbwire has no TLS layer underneath to catch it.
            if not client_nonce or not snonce.startswith(client_nonce) or len(snonce) <= len(client_nonce):
                raise OperationalError("SCRAM server nonce does not extend the client nonce (rogue server?)")
            if iterations < 4096:   # RFC 5802 recommends >= 4096; a tiny count cheapens an offline attack
                raise OperationalError("SCRAM iteration count %d is too low" % iterations)
            salted = hashlib.pbkdf2_hmac("sha256", (password or "").encode("utf-8"), salt, iterations)
            client_key = hmac.new(salted, b"Client Key", hashlib.sha256).digest()
            stored_key = hashlib.sha256(client_key).digest()
            client_final_noproof = "c=biws,r=%s" % snonce
            auth_message = "%s,%s,%s" % (cfirst_bare, server_first, client_final_noproof)
            client_sig = hmac.new(stored_key, auth_message.encode("ascii"), hashlib.sha256).digest()
            proof = base64.b64encode(_xor(client_key, client_sig)).decode("ascii")
            _send(sock, b"p", ("%s,p=%s" % (client_final_noproof, proof)).encode("ascii"))
        elif code == 12:  # SASLFinal (server-final): verify the server too, or the handshake is one-way
            # Without this the client proves itself to the server and simply trusts whatever answers back.
            # ServerSignature = HMAC(ServerKey, AuthMessage) can only be produced by a peer that holds the
            # stored credentials, so comparing it is what makes the exchange mutual (RFC 5802 5, 5.1).
            if salted is None or auth_message is None:
                raise OperationalError("unexpected SCRAM server-final message")
            try:
                attrs = dict(kv.split("=", 1) for kv in payload[4:].decode("ascii").split(","))
            except (ValueError, UnicodeDecodeError) as ex:
                raise OperationalError("malformed SCRAM server-final message (%s)" % ex)
            if "e" in attrs:
                raise OperationalError("SCRAM authentication failed (%s)" % attrs["e"])
            try:
                signature = base64.b64decode(attrs["v"])
            except (KeyError, binascii.Error, ValueError) as ex:
                raise OperationalError("malformed SCRAM server signature (%s)" % ex)
            server_key = hmac.new(salted, b"Server Key", hashlib.sha256).digest()
            expected = hmac.new(server_key, auth_message.encode("ascii"), hashlib.sha256).digest()
            if not hmac.compare_digest(signature, expected):
                raise OperationalError("SCRAM server signature mismatch (rogue server?)")
        else:
            raise InterfaceError("unsupported authentication request %d" % code)

def _raise_server_error_as_operational(payload):

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at extra/dbwire/postgres.py:280 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/47e9fe8f565fef98. Report an issue: GitHub.