I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs credentials (as in --auth-type)
How do I tell sqlmap, the 401 is a valid response, when the username is wrong?

Here an example:

POST /api/login HTTP/1.1
Connection: close


Assuming user/pass are valid login credentials, the server responses with 200. As soon as a Injection is added to username or password, the server responds with 401.

I want SQLmap to ignore 401 responses and try other injections. I already tried --ignore-code=401 which results in [CRITICAL] unable to retrieve page content

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.