CRITICAL] unable to connect" sqlmap fails against in-scope authorized login form

TL;DR

CRITICAL means the first request died, almost always a session or request-shape problem on login forms. Fetch the login page manually, capture a fresh session cookie from a real browser login, pass it with --cookie, and handle CSRF tokens if the form uses them.

[CRITICAL] unable to connect

Use this when

• Sqlmap prints [CRITICAL] unable to connect against a login form URL.
• The login page loads fine in a browser on the same network.
• The engagement covers authenticated testing of the app.

Not for this skill when

• The connection succeeds but credentials are rejected. That is an auth problem, not a connection problem.
• The form is out of scope. Do not work around access controls on it.
• The target is down for everyone. Confirm with the client contact first.

Steps

1. Fetch the login page with curl and confirm it loads: curl -s -o /dev/null -w "%{http_code}" YOUR_TARGET_HOST/login. Verify: you get 200 and the form HTML.
2. Log in through a real browser, copy the session cookie, and pass it: sqlmap -u "YOUR_TARGET_HOST/login" --cookie="[session cookie]" --data="[login form fields]". Verify: sqlmap's first request gets a session-aware response instead of dying.
3. If the form uses CSRF tokens, re-fetch per attempt: add --csrf-token [token name] --csrf-url=YOUR_TARGET_HOST/login. Verify: sqlmap stops being bounced to the login page.
4. Confirm the app allows your egress IP; some labs IP-allowlist the login form. Verify: the same cookie-carrying request succeeds from curl.
5. Rerun and watch the first request succeed. Verify: testing proceeds past the connection phase.

Variant phrasings

sqlmap critical unable to connect login

The compact search.

sqlmap fails on login form connection

Symptom phrasing.

sqlmap cookie session login form

The fix-oriented search.

Compatibility: sqlmap 1.x. --csrf-token/--csrf-url available in recent builds; check --help on older ones.

Why it happens

Login forms commonly require a valid session cookie before they answer at all, or they reject requests missing anti-CSRF headers. Sqlmap's bare first request looks nothing like a browser's, so the app drops it and sqlmap reports the death as critical.

Edge cases / pitfalls

• Session cookies expire. A cookie captured an hour ago may already be dead; re-capture if the critical error returns.
• Some apps bind sessions to IP or user agent. Match sqlmap's --user-agent to the browser you captured from.
• Do not brute-force the login form to "fix" a connection error. That is a different test with different authorization.
• Record the cookie capture method in your notes; a finding that only reproduces with an undocumented session is weak evidence.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Lasw2Xka0Zyylo7gVaqvtQ