{"record":{"id":"61270a1a48b73fed","repo":"shadow1ng/fscan","slug":"authentication-failed-s-61270a","errorCode":null,"errorMessage":"authentication failed: %s","messagePattern":"authentication failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/mongodb.go","lineNumber":142,"sourceCode":"\t\tkv(\"autoAuthorize\", 1),\n\t))\n\tif _, err := sendMongoMsg(ctx, conn, saslStartCmd, timeout); err != nil {\n\t\tstate.IncrementTCPFailedPacketCount()\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t}\n\tresp, err = readMongoMsg(conn, timeout)\n\tif err != nil {\n\t\tstate.IncrementTCPFailedPacketCount()\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t}\n\n\tstartReply, err := parseMongoCommandReply(resp)\n\tif err != nil {\n\t\tstate.IncrementTCPFailedPacketCount()\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t}\n\tif !startReply.ok {\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf(\"authentication failed: %s\", startReply.errmsg)}\n\t}\n\tif !startReply.conversationSet || len(startReply.payload) == 0 {\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf(\"invalid saslStart response\")}\n\t}\n\n\tserverFirst := string(startReply.payload)\n\tclientFinal, err := buildMongoSCRAMClientFinal(cred.Username, cred.Password, clientFirstBare, serverFirst)\n\tif err != nil {\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: err}\n\t}\n\n\tsaslContinueCmd := buildMongoCommand(\"admin\", orderedDoc(\n\t\tkv(\"saslContinue\", 1),\n\t\tkv(\"conversationId\", int(startReply.conversationID)),\n\t\tkv(\"payload\", []byte(clientFinal)),\n\t))\n\tif _, err := sendMongoMsg(ctx, conn, saslContinueCmd, timeout); err != nil {\n\t\tstate.IncrementTCPFailedPacketCount()","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mongodb.go#L124-L160","documentation":"During the SCRAM-SHA-1 handshake (doMongoDBAuth), the server's saslStart reply parsed successfully but reported ok:false with an errmsg. fscan wraps the server's message as 'authentication failed: <errmsg>'. This is an application-level auth rejection from MongoDB (wrong user/password, user not found, mechanism not permitted), not a network failure; the AuthResult carries ErrorType ErrorTypeAuth.","triggerScenarios":"Calling Scan (brute mode) which drives TestCredentialsConcurrently -> doMongoDBAuth whenever a saslStart/saslContinue command reply has ok=false, e.g. wrong username or password in Credential, user absent from the admin db, SCRAM-SHA-1 disabled via authenticationMechanisms, or the server rejecting the payload.","commonSituations":"Brute-forcing with dictionaries that don't match the deployment's users; testing users that exist only in a non-admin database (fscan authenticates against 'admin'); MongoDB instances with SCRAM-SHA-256-only configuration; typo'd or role-restricted credentials; servers where 'authorization' disallows the probe.","solutions":["Treat as an expected per-credential rejection in brute mode; check state counters instead of treating it as a hard failure.","Verify the target MongoDB allows SCRAM-SHA-1 (getParameter authenticationMechanisms) or use SCRAM-SHA-256-capable tooling.","Ensure the tested user exists in the 'admin' database, since the plugin authenticates against $db=admin.","Confirm the username:password pair manually with mongosh --host ... -u user -p pass --authenticationDatabase admin.","Inspect startReply.errmsg text: 'Authentication failed' means bad credentials; 'mechanism' errors point to server config."],"exampleFix":"// before\nresult := TestCredentialsConcurrently(ctx, credentials, authFn, \"mongodb\", testConfig)\nlog.Println(result.Error) // authentication failed: Authentication failed.\n// after\nresult := TestCredentialsConcurrently(ctx, credentials, authFn, \"mongodb\", testConfig)\nif !result.Success && result.ErrorType == ErrorTypeAuth {\n    log.Printf(\"credential rejected (auth): %v — continue with next candidate\", result.Error)\n} else if !result.Success {\n    log.Printf(\"non-auth failure, aborting: %v\", result.Error)\n}","handlingStrategy":"type-guard","validationCode":"// before brute-forcing, confirm SCRAM-SHA-1 is enabled on the target\nstatus := shell(\"mongosh --quiet --host %s --eval 'db.runCommand({getParameter:1, authenticationMechanisms:1})'\", target)\nif !strings.Contains(status, \"SCRAM-SHA-1\") {\n\tlog.Println(\"target does not advertise SCRAM-SHA-1; auth failures expected\")\n}","typeGuard":"func isAuthRejection(ar *services.AuthResult) bool {\n\treturn ar != nil && !ar.Success && ar.ErrorType == services.ErrorTypeAuth\n}","tryCatchPattern":"ar := authFn(ctx, cred)\nif isAuthRejection(ar) {\n\tlog.Printf(\"credential %s:%s rejected by server: %v\", cred.Username, cred.Password, ar.Error)\n\t// continue to next credential; do not treat as network failure\n} else if !ar.Success {\n\tlog.Printf(\"transient/network failure: %v — retry eligible\", ar.Error)\n}","preventionTips":["Check ErrorTypeAuth on AuthResult to distinguish rejected credentials from network errors","Remember fscan authenticates against the 'admin' database — only test users defined there","Verify the server supports SCRAM-SHA-1 (or use SHA-256-capable tooling) before brute-forcing","Read the embedded errmsg: 'Authentication failed' = bad credential, 'mechanism' = server config issue"],"tags":["mongodb","scram","authentication","brute-force"],"backgroundTag":"authentication-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}