{"record":{"id":"4674a1cf9b0770a4","repo":"shadow1ng/fscan","slug":"authentication-failed-s","errorCode":null,"errorMessage":"authentication failed: %s","messagePattern":"authentication failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/cassandra.go","lineNumber":142,"sourceCode":"\tif opcode == cqlOpAuthChl {\n\t\tif cred.Username == \"\" && cred.Password == \"\" {\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf(\"authentication required\")}\n\t\t}\n\t\t// SASL PLAIN: \\x00username\\x00password\n\t\tsaslToken := []byte(\"\\x00\" + cred.Username + \"\\x00\" + cred.Password)\n\t\tif err := cqlSend(conn, cqlOpAuthRsp, saslToken); err != nil {\n\t\t\tstate.IncrementTCPFailedPacketCount()\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t\t}\n\t\topcode, body, err = cqlRecv(conn)\n\t\tif err != nil {\n\t\t\tstate.IncrementTCPFailedPacketCount()\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t\t}\n\t\t// AUTH_SUCCESS → 认证成功\n\t\t// ERROR → 认证失败\n\t\tif opcode == cqlOpError {\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf(\"authentication failed: %s\", string(body))}\n\t\t}\n\t\tif opcode != cqlOpAuthOk && opcode != cqlOpReady {\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf(\"unexpected opcode: %d\", opcode)}\n\t\t}\n\t}\n\n\t// Step 4: 发送测试查询\n\tqueryBody := cqlLongString(\"SELECT cluster_name FROM system.local\")\n\t// 添加 consistency level (ONE=1)\n\tqueryBody = append(queryBody, 0x00, 0x01) // flags=0, consistency=ONE\n\tif err := cqlSend(conn, cqlOpQuery, queryBody); err != nil {\n\t\tstate.IncrementTCPFailedPacketCount()\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t}\n\topcode, body, err = cqlRecv(conn)\n\tif err != nil {\n\t\tstate.IncrementTCPFailedPacketCount()\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/cassandra.go#L124-L160","documentation":"After sending the SASL PLAIN token, the plugin expected AUTH_SUCCESS or READY but got an ERROR frame, meaning the server rejected the credentials. The server's message body is wrapped as 'authentication failed: %s'.","triggerScenarios":"doCassandraAuth sends cqlOpAuthRsp with the SASL token, reads the reply, and the opcode is cqlOpError — Cassandra's standard response to bad username/password.","commonSituations":"Wrong password for a real account; testing against a cluster where the default cassandra/cassandra credentials were changed; account locked or user dropped; brute-force attempt legitimately denied by the server.","solutions":["Check the embedded server message to confirm it is a bad-credentials error, then use a valid username/password pair.","Verify the credential source/wordlist targets the correct cluster; default creds may have been rotated.","If the credential is expected to be valid, confirm the user exists and is not locked (system_auth.roles)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"res := doCassandraAuth(conn, cred, state)\nif !res.Success && res.ErrorType == ErrorTypeAuth && strings.HasPrefix(res.Error.Error(), \"authentication failed\") {\n    log.Printf(\"bad credentials for %s: %v\", target, res.Error)\n    // do not retry with the same credential\n}","preventionTips":["Verify credentials manually (cqlsh) before adding them to automated testing.","Keep credential sets updated when clusters rotate passwords.","Rate-limit auth attempts so legitimate testing is not confused with abuse."],"tags":["cassandra","authentication","sasl","credentials"],"backgroundTag":"authentication-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}