sqlmapproject/sqlmap · error · ValueError

unsupported algorithm '%s' for forging

Error message

unsupported algorithm '%s' for forging

What it means

Error "unsupported algorithm '%s' for forging" thrown in sqlmapproject/sqlmap.

Source

Thrown at lib/utils/jwt.py:79

    """Re-encode a (possibly tampered) header/payload, signing with 'key' for an HMAC 'alg' or leaving the
    signature empty for 'alg':'none' - the primitive behind the alg:none and weak-secret exploitation paths.

    >>> forgeJWT({"alg": "none"}, {"user": "admin"}).endswith('.')
    True
    >>> parseJWT(forgeJWT({"alg": "HS256"}, {"user": "admin"}, key="secret"))["payload"]["user"] == "admin"
    True
    """

    alg = (header.get("alg") or "none")
    signingInput = "%s.%s" % (encodeSegment(header), encodeSegment(payload))

    if alg.lower() == "none":
        signature = ""
    elif alg.upper() in HMAC_ALGORITHMS and key is not None:
        digest = hmac.new(getBytes(key), getBytes(signingInput), HMAC_ALGORITHMS[alg.upper()]).digest()
        signature = encodeBase64(digest, binary=False, safe=True)
    else:
        raise ValueError("unsupported algorithm '%s' for forging" % alg)

    return "%s.%s" % (signingInput, signature)

def crackHMAC(token, secrets, limit=None):
    """Try to recover the HMAC signing secret of an HS* token from an iterable of candidate secrets; returns
    the secret on success (a full forgery primitive), else None. Purely offline - no requests.

    >>> token = forgeJWT({"alg": "HS256"}, {"user": "admin"}, key="s3cr3t")
    >>> crackHMAC(token, ["admin", "s3cr3t", "letmein"])
    's3cr3t'
    >>> crackHMAC(token, ["admin", "letmein"]) is None
    True
    """

    data = parseJWT(token)
    if not data or (data["header"].get("alg") or "").upper() not in HMAC_ALGORITHMS:
        return None

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at lib/utils/jwt.py:79 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/b75dcd5deac56ecc. Report an issue: GitHub.