python Verified current stable Not installed? Security

Python / Provide Http Auth Credentials

Provide Http Auth Credentials

Provides HTTP Basic authentication credentials for requests requiring authorization.

$
Terminal
python sqlmap.py -u "{http://www.example.com/vuln.php}" --auth-type <Basic> --auth-cred "{testuser:testpass}"

When To Use

When testing web applications that enforce authorization for certain endpoints.

Pro Tip

Utilize --ignore-401 to proceed with further testing even if the unauthorized response is encountered.

Anatomy of Output

Understanding the result

[06:45:10] [INFO] using HTTP Basic authentication Auth Type

Indicates that Basic authentication is being applied.

[06:45:11] [INFO] sending credentials for authentication Auth Info

Credentials are being sent with the request.

[06:45:12] [SUCCESS] authenticated as 'testuser' Auth Result

Confirms successful authentication for the provided user.

Power User Variants

Optimized versions

python sqlmap.py -u 'http://www.example.com/vuln.php' --auth-type Digest --auth-cred 'testuser:testpass'

Testing with Digest authentication.

python sqlmap.py -u 'http://www.example.com/vuln.php' --auth-type Basic --auth-cred 'admin:adminpass'

Using different demo credentials for testing.

Troubleshooting

Common pitfalls

sqlmap -u '...' --auth-type Basic --auth-cred '...' - ERROR: 401 Unauthorized

Solution: Confirm that credentials are correct and the endpoint requires Basic Auth.

sqlmap -u '...' --auth-type Basic --auth-cred '...' - ERROR: Invalid authentication type

Solution: Check that the specified auth type is supported by the application.

sqlmap -u '...' --auth-type Basic --auth-cred '...' - ERROR: Unable to establish a secure connection

Solution: Ensure HTTPS is enabled if using Basic authentication over SSL.

Command Breakdown

What each part is doing

python
Base Command
The executable that performs this operation. Here it runs Python before the shell applies any redirect operators.
-u
u| url
The URL supplied to this command.
{http://www.example.com/vuln.php}
http: www.example.com vuln.php
The value supplied for http: www.example.com vuln.php.
<Basic>
Basic
The value supplied for Basic.
{testuser:testpass}
testuser:testpass
The user value supplied to this command.
-u
Command Option
Tool-specific option used by this command invocation.
--auth-type
Command Option
Tool-specific option used by this command invocation.
--auth-cred
Command Option
Tool-specific option used by this command invocation.

Alternative Approaches

Comparable commands in other tools

Alternative security tools for the same job.