agent session cookie expired mid-sqlmap-run; authorized target scan failed

TL;DR

Sqlmap holds one cookie for the whole run, so when the app session expires mid-run, every subsequent request tests the logged-out state and the results go stale. Detect the logged-out pattern (login-page redirects or login forms in responses), re-login through the engagement's session procedure, update the cookie, and resume the sqlmap session from its saved state.

agent session cookie expired mid-sqlmap-run; authorized target scan failed

Use this when

• Sqlmap starts well and its results degrade partway through the run.
• Responses mid-run start showing login pages or session-expired markers.
• The target app has short session timeouts and the engagement provides a login procedure.

Not for this skill when

• Sqlmap never authenticated. Then the cookie was wrong from the start; fix the initial session.
• Sqlmap is blocked by a WAF. That shows as block pages, not login pages.
• The session belongs to an app outside your authorized engagement. Do not use it.

Steps

1. Confirm the logged-out pattern: sample responses from the failing phase and check for login forms or redirect-to-login. Verify: the pattern appears in the failing phase and not in the early phase.
2. Pause sqlmap but keep its session file; do not delete it. Verify: the session file exists and has a recent modification time.
3. Re-run the engagement's login procedure (the same steps the agent used at setup) and capture the fresh session cookie. Verify: one manual request with the new cookie returns the authenticated page.
4. Update the cookie in the sqlmap invocation and resume from the saved session. Verify: resumed requests return authenticated responses again.
5. Mark the findings from the logged-out phase as suspect and re-test those parameters. Verify: no finding in the final report comes only from the logged-out window.

Variant phrasings

sqlmap session expired halfway

Common phrasing.

sqlmap cookie expired during scan

Symptom-level search.

resume sqlmap after re-login

Workflow phrasing.

Compatibility: sqlmap 1.8+ session files. Works with any cookie-based app session.

Why it happens

Web sessions expire on inactivity or absolute timers, and sqlmap's request pattern can look inactive to the app between test batches. The agent launched sqlmap with a good cookie hours ago and never considered that cookies are perishable.

Edge cases / pitfalls

• Some apps invalidate all sessions on password events. If the engagement rotated credentials, every saved session is dead; start over.
• Findings gathered while logged out test the anonymous surface, which is a different scope. Re-test or exclude them; never silently keep them.
• Automating re-login in a loop can lock the test account. Cap re-login attempts and page the tester after two failures.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_NU-tzvQIAQHrLGuUQMq1kQ