{"record":{"id":"2d517800d1f0b815","repo":"projectdiscovery/nuclei","slug":"sending-password-w","errorCode":null,"errorMessage":"sending password: %w","messagePattern":"sending password: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/utils/telnetmini/telnet.go","lineNumber":222,"sourceCode":"// Auth performs a minimal Telnet username/password interaction.\n// It waits for a username/login prompt, sends username, waits for a password prompt,\n// sends password, and then looks for fail banners or shell prompts.\n// A timeout should be enforced via ctx.\nfunc (c *Client) Auth(ctx context.Context, username, password string) error {\n\t// Wait for username/login prompt\n\tif _, _, err := c.readUntil(ctx, c.UserPrompts...); err != nil {\n\t\treturn fmt.Errorf(\"waiting for login/username prompt: %w\", err)\n\t}\n\tif err := c.writeLine(ctx, username); err != nil {\n\t\treturn fmt.Errorf(\"sending username: %w\", err)\n\t}\n\n\t// Wait for password prompt\n\tif _, _, err := c.readUntil(ctx, c.PasswordPrompts...); err != nil {\n\t\treturn fmt.Errorf(\"waiting for password prompt: %w\", err)\n\t}\n\tif err := c.writeLine(ctx, password); err != nil {\n\t\treturn fmt.Errorf(\"sending password: %w\", err)\n\t}\n\n\t// Post-auth: look quickly for explicit failure, else accept shell prompt / silence.\n\tmatch, got, err := c.readUntil(ctx,\n\t\tappend(append([]string{}, c.FailBanners...), c.ShellPrompts...)...,\n\t)\n\tif err != nil && !errors.Is(err, context.DeadlineExceeded) {\n\t\treturn fmt.Errorf(\"post-auth read: %s (got: %s)\", preview(got, 200), err)\n\t}\n\tlow := strings.ToLower(match)\n\tfor _, fb := range c.FailBanners {\n\t\tif low == strings.ToLower(fb) {\n\t\t\treturn errors.New(\"authentication failed\")\n\t\t}\n\t}\n\t// success (matched a shell prompt or timed out without explicit failure)\n\treturn nil\n}","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/utils/telnetmini/telnet.go#L204-L240","documentation":"Writing the password line to the telnet connection failed. After the password prompt matched, Client.Auth calls writeLine(ctx, password); the returned error wraps the underlying net.Conn write failure (broken pipe, connection reset, closed conn, or ctx canceled). This is a transport-level failure, not an authentication verdict.","triggerScenarios":"Server closes the connection immediately after printing the password prompt (some services do this on max sessions or bad TTY negotiation), ctx is canceled/expired before the write, or the conn was already torn down by the remote end or an intermediary.","commonSituations":"Remote device enforcing a single telnet session (kicks the new one), NAT/idle timeout killing the session mid-handshake, or test harnesses against mock listeners that accept but immediately close.","solutions":["Retry with a fresh Client/connection — a mid-handshake reset is usually transient or a session-limit signal.","Check whether the server allows more than one concurrent telnet session and close stale sessions.","Ensure ctx is not already expired when Auth is called (the same ctx bounds every read and write in the handshake).","If the server closes on username, revisit UserPrompts — the wrong value may have been sent as the username."],"exampleFix":"// before\n_ = client.Auth(ctx, user, pass)\n\n// after\nif err := client.Auth(ctx, user, pass); err != nil {\n    if strings.Contains(err.Error(), \"sending password\") {\n        client.Close()\n        // reconnect once; server dropped us mid-handshake\n    }\n}","handlingStrategy":"retry","validationCode":"// nothing to validate client-side beyond connection liveness\nif err := client.Ping(ctx); err != nil { /* skip Auth, target is unhealthy */ }","typeGuard":"func isTelnetWriteErr(err error) bool {\n    return err != nil && strings.HasPrefix(err.Error(), \"sending password:\")\n}","tryCatchPattern":"if err := client.Auth(ctx, user, pass); err != nil {\n    if isTelnetWriteErr(err) {\n        client.Close()\n        // one reconnect+retry; a mid-handshake reset is often transient or a session cap\n    }\n}","preventionTips":["Close and reopen the Client between attempts; a dead conn cannot be written to.","Avoid canceling the parent ctx during the auth handshake.","Cap retries (1) — repeated resets mean the server refuses the session, not a flake."],"tags":["telnet","network","connection-reset","authentication"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}