## TL;DR
CRITICAL means the first request died, almost always a session or request-shape problem on login forms. Fetch the login page manually, capture a fresh session cookie from a real browser login, pass it with `--cookie`, and handle CSRF tokens if the form uses them.

```text
[CRITICAL] unable to connect
```

## Use this when
- Sqlmap prints `[CRITICAL] unable to connect` against a login form URL.
- The login page loads fine in a browser on the same network.
- The engagement covers authenticated testing of the app.

## Not for this skill when
- The connection succeeds but credentials are rejected. That is an auth problem, not a connection problem.
- The form is out of scope. Do not work around access controls on it.
- The target is down for everyone. Confirm with the client contact first.

## Steps
1. Fetch the login page with curl and confirm it loads: `curl -s -o /dev/null -w "%{http_code}" YOUR_TARGET_HOST/login`. Verify: you get 200 and the form HTML.
2. Log in through a real browser, copy the session cookie, and pass it: `sqlmap -u "YOUR_TARGET_HOST/login" --cookie="[session cookie]" --data="[login form fields]"`. Verify: sqlmap's first request gets a session-aware response instead of dying.
3. If the form uses CSRF tokens, re-fetch per attempt: add `--csrf-token [token name] --csrf-url=YOUR_TARGET_HOST/login`. Verify: sqlmap stops being bounced to the login page.
4. Confirm the app allows your egress IP; some labs IP-allowlist the login form. Verify: the same cookie-carrying request succeeds from curl.
5. Rerun and watch the first request succeed. Verify: testing proceeds past the connection phase.

## Variant phrasings
### sqlmap critical unable to connect login
The compact search.
### sqlmap fails on login form connection
Symptom phrasing.
### sqlmap cookie session login form
The fix-oriented search.

Compatibility: sqlmap 1.x. `--csrf-token`/`--csrf-url` available in recent builds; check `--help` on older ones.

## Why it happens
Login forms commonly require a valid session cookie before they answer at all, or they reject requests missing anti-CSRF headers. Sqlmap's bare first request looks nothing like a browser's, so the app drops it and sqlmap reports the death as critical.

## Edge cases / pitfalls
- Session cookies expire. A cookie captured an hour ago may already be dead; re-capture if the critical error returns.
- Some apps bind sessions to IP or user agent. Match sqlmap's `--user-agent` to the browser you captured from.
- Do not brute-force the login form to "fix" a connection error. That is a different test with different authorization.
- Record the cookie capture method in your notes; a finding that only reproduces with an undocumented session is weak evidence.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Lasw2Xka0Zyylo7gVaqvtQ