Handling SQLMap Errors¶

Every penetration tester has stared at a failing SQLMap scan wondering what went wrong. This section covers every common error and the exact steps to fix it.

Connection Errors¶

"connection timed out to the target URL"¶

[CRITICAL] connection timed out to the target URL. sqlmap is going to retry the request(s)

Root Cause: SQLMap cannot reach the target server within the default timeout (30 seconds).

Solutions:

sqlmap -r request.txt --timeout=60

sqlmap -r request.txt --timeout=60 --retries=5

# If the target is on an internal network:
sqlmap -r request.txt --proxy="http://your-vpn-proxy:8080"

Checklist:

• Is the target URL correct? (no typos)
• Is the target server running? (try curl or browser)
• Is your VPN/tunnel active? (for internal targets)
• Is a firewall blocking your IP?
• Are you behind a corporate proxy?

"connection refused by the target URL"¶

[CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s)

Root Cause: The server is actively refusing connections on that port.

Solutions:

• Verify the correct port (80 vs 443 vs 8080)
• Check if the service uses HTTPS: try https:// instead of http://
• Verify firewall rules aren't blocking your IP

SSL/TLS Errors¶

[CRITICAL] can't establish SSL connection

Solutions:

sqlmap -r request.txt --force-ssl

# SQLMap doesn't verify SSL certs by default, but if you have issues:
sqlmap -r request.txt --force-ssl

Detection Failures¶

"all tested parameters do not appear to be injectable"¶

[WARNING] GET parameter 'id' does not appear to be injectable
[CRITICAL] all tested parameters do not appear to be injectable. Try to 
increase values for '--level'/'--risk' options if you wish to perform more tests.

This is the most common error beginners encounter. Here's a systematic troubleshooting process:

Step 1: Increase Level and Risk¶

sqlmap -r request.txt --level=5 --risk=3

What this changes:

Step 2: Specify the DBMS¶

If you know (or suspect) the database type, tell SQLMap:

sqlmap -r request.txt --dbms=mysql
sqlmap -r request.txt --dbms=mssql
sqlmap -r request.txt --dbms=postgresql

This eliminates payloads for other DBMS types and focuses testing.

Step 3: Manually Specify the Injection Technique¶

sqlmap -r request.txt --technique=BT

sqlmap -r request.txt --technique=U

Step 4: Add Custom Prefix/Suffix¶

The application might wrap your input in a specific SQL context. You can tell SQLMap what comes before and after the injection point:

sqlmap -r request.txt --prefix="'" --suffix="-- -"

sqlmap -r request.txt --prefix='"' --suffix='-- -'

sqlmap -r request.txt --prefix=")" --suffix="-- -"

Step 5: Check if the Parameter Is Actually Injectable¶

Go back to manual testing. In Burp Suite, try these payloads:

id=1'          → Does it cause an error?
id=1 AND 1=1   → Same response as normal?
id=1 AND 1=2   → Different response?
id=1' AND '1'='1  → Same response as normal?
id=1' AND '1'='2  → Different response?

If none of these cause any observable difference, the parameter might genuinely not be injectable.

"heuristic (basic) test shows that GET parameter 'id' might not be injectable"¶

[WARNING] heuristic (basic) test shows that GET parameter 'id' might not be injectable

What this means: SQLMap sent a single quote (') and didn't see an error or notable change in the response. This is a heuristic, not a definitive answer.

What to do: Continue the scan — the full test suite may still find injection:

sqlmap -r request.txt --level=5 --risk=3 --batch

False Positives & False Negatives¶

Dealing with False Positives¶

Sometimes SQLMap reports injection when there isn't one. This is more common with:

• Unstable pages (dynamic content, ads, timestamps)
• Redirections that happen to match the comparison
• Applications that return the same page regardless of input

How to verify:

sqlmap -r request.txt --string="Welcome, admin"

sqlmap -r request.txt --not-string="No results found"

sqlmap -r request.txt --code=200    # TRUE = 200 OK

Dealing with False Negatives¶

SQLMap says "not injectable" but you know it is:

sqlmap -r request.txt \
  --level=5 \
  --risk=3 \
  --dbms=mysql \
  --technique=BEUSTQ \
  --tamper=space2comment \
  --threads=1 \
  --time-sec=10 \
  --flush-session

WAF/IPS Detection¶

"heuristics detected that the target is protected by some kind of WAF/IPS"¶

[WARNING] heuristics detected that the target is protected by some kind of 
WAF/IPS

What this means: SQLMap detected patterns consistent with a WAF blocking its requests. This could be Cloudflare, ModSecurity, AWS WAF, etc.

Solutions:

sqlmap -r request.txt --identify-waf

sqlmap -r request.txt --tamper=space2comment,between,randomcase

See the Bypassing Web Application Protections section for detailed WAF evasion techniques.

Requests Being Blocked (403 Forbidden)¶

[WARNING] target URL responded with status code 403 (Forbidden). 
sqlmap is going to retry the request

Solutions:

sqlmap -r request.txt --random-agent

sqlmap -r request.txt --delay=2    # 2 seconds between requests

sqlmap -r request.txt --randomize=1-3    # Random delay 1-3 seconds

Session and State Issues¶

"possible integer casting detected"¶

[WARNING] possible integer casting detected (e.g., "1 AND 1=1" would become 
"1") at the back-end

What this means: The application converts your input to an integer before using it in a query. Injected SQL text is stripped.

Solutions:

• This parameter is likely not injectable with standard string-based payloads
• Try arithmetic-based tests: The parameter might be injectable with numeric operations
• Move on to testing other parameters

"target URL content is NOT stable"¶

Already covered in the Output Description section, but to recap:

sqlmap -r request.txt --string="Results found"

sqlmap -r request.txt --text-only

sqlmap -r request.txt --titles

Stale/Wrong Results from Cache¶

sqlmap -r request.txt --flush-session

sqlmap -r request.txt --fresh-queries

Performance Issues¶

Scan Running Extremely Slowly¶

Possible causes and fixes:

sqlmap -r request.txt --threads=10

sqlmap -r request.txt --technique=UE    # Union + Error only (fast)

sqlmap -r request.txt --technique=BEUS   # Everything except Time-based

sqlmap -r request.txt -o
# Equivalent to: --predict-output --keep-alive --null-connection --threads=3

Scan Taking Too Long on Blind Injection¶

Blind injection is inherently slow. Speed it up:

sqlmap -r request.txt --threads=10

sqlmap -r request.txt --time-sec=2    # Default is 5 seconds

Systematic Troubleshooting Checklist¶

When SQLMap isn't working, run through this checklist:

• Connection: Can you reach the target? (curl -v <URL>)
• Authentication: Does the request include valid session cookies/tokens?
• Request format: Is the Content-Type correct? (URL-encoded vs JSON vs XML)
• Correct parameter: Are you testing the right parameter? (-p param)
• Injection point: Does manual testing confirm injectable behavior?
• Level/Risk: Have you tried --level=5 --risk=3?
• DBMS: Have you specified --dbms?
• WAF: Is a WAF blocking payloads? (--identify-waf)
• Cache: Have you flushed the session? (--flush-session)
• Technique: Have you tried limiting/expanding techniques? (--technique)
• Prefix/Suffix: Does the injection context need custom prefix/suffix?
• Verbose output: Run with -v 3 or higher to see what's happening