{"record":{"id":"3b9e91681c3201f5","repo":"projectdiscovery/nuclei","slug":"sending-username-w","errorCode":null,"errorMessage":"sending username: %w","messagePattern":"sending username: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/utils/telnetmini/telnet.go","lineNumber":214,"sourceCode":"\t\t\t\ti += 2 // Skip command and option\n\t\t\t}\n\t\t}\n\t}\n\n\treturn supportsEncryption, options\n}\n\n// Auth performs a minimal Telnet username/password interaction.\n// It waits for a username/login prompt, sends username, waits for a password prompt,\n// sends password, and then looks for fail banners or shell prompts.\n// A timeout should be enforced via ctx.\nfunc (c *Client) Auth(ctx context.Context, username, password string) error {\n\t// Wait for username/login prompt\n\tif _, _, err := c.readUntil(ctx, c.UserPrompts...); err != nil {\n\t\treturn fmt.Errorf(\"waiting for login/username prompt: %w\", err)\n\t}\n\tif err := c.writeLine(ctx, username); err != nil {\n\t\treturn fmt.Errorf(\"sending username: %w\", err)\n\t}\n\n\t// Wait for password prompt\n\tif _, _, err := c.readUntil(ctx, c.PasswordPrompts...); err != nil {\n\t\treturn fmt.Errorf(\"waiting for password prompt: %w\", err)\n\t}\n\tif err := c.writeLine(ctx, password); err != nil {\n\t\treturn fmt.Errorf(\"sending password: %w\", err)\n\t}\n\n\t// Post-auth: look quickly for explicit failure, else accept shell prompt / silence.\n\tmatch, got, err := c.readUntil(ctx,\n\t\tappend(append([]string{}, c.FailBanners...), c.ShellPrompts...)...,\n\t)\n\tif err != nil && !errors.Is(err, context.DeadlineExceeded) {\n\t\treturn fmt.Errorf(\"post-auth read: %s (got: %s)\", preview(got, 200), err)\n\t}\n\tlow := strings.ToLower(match)","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/utils/telnetmini/telnet.go#L196-L232","documentation":"Client.Auth's second step: after a login prompt matched, the username plus CRLF is written via writeLine (io.WriteString + Flush) under the ctx deadline. A write or flush error returns 'sending username: %w' — meaning the connection died in the narrow window between receiving the prompt and sending the credential line.","triggerScenarios":"Server resets the connection right after the banner (inetd per-connection limits, fail2ban matching on the negotiation bytes, TLS-expecting service receiving plaintext), a full send buffer on a stalled connection causing the deadline to expire mid-write, or the ctx deadline expiring exactly after the prompt read.","commonSituations":"Aggressive parallel telnet scanning tripping hosts.allow/fail2ban that kill the session after the first interaction round; flaky links where reads succeed but writes race a reset; hardcoded credentials tests against appliances that drop connections on unexpected input.","solutions":["Retry with backoff — the prompt was seen, so the protocol is right; the drop is usually a transient limit","Lower concurrency against this target and add a delay between attempts to avoid connection limits","Check the wrapped error: broken pipe/EPIPE vs i/o timeout vs RST each point to server-side kill vs stall","Verify the same credentials manually with `telnet target` to confirm the server accepts interactive login at all"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Health-check the write path right after the prompt match:\nif err := conn.SetWriteDeadline(time.Now().Add(3 * time.Second)); err != nil {\n    return err\n}","typeGuard":null,"tryCatchPattern":"err := client.Auth(ctx, user, pass)\nif err != nil && strings.Contains(err.Error(), \"sending username\") {\n    time.Sleep(500 * time.Millisecond)\n    // reconnect and retry once — prompt was seen, drop is usually a transient limit\n    return authWithNewConn(ctx, user, pass)\n}","preventionTips":["Expect servers to drop sessions under load — always make telnet auth retryable with a fresh connection","Cap concurrent auth attempts per host to stay under inetd/fail2ban thresholds","Use the ctx deadline so a stalled write fails fast instead of hanging the worker","Log the wrapped syscall error (EPIPE vs timeout) to distinguish server kill from stall"],"tags":["telnet","auth","write-error","connection-reset","retry"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}