{"record":{"id":"7a05fb22e605a1d0","repo":"projectdiscovery/nuclei","slug":"authentication-failed","errorCode":null,"errorMessage":"authentication failed","messagePattern":"authentication failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/utils/telnetmini/telnet.go","lineNumber":235,"sourceCode":"\t// Wait for password prompt\n\tif _, _, err := c.readUntil(ctx, c.PasswordPrompts...); err != nil {\n\t\treturn fmt.Errorf(\"waiting for password prompt: %w\", err)\n\t}\n\tif err := c.writeLine(ctx, password); err != nil {\n\t\treturn fmt.Errorf(\"sending password: %w\", err)\n\t}\n\n\t// Post-auth: look quickly for explicit failure, else accept shell prompt / silence.\n\tmatch, got, err := c.readUntil(ctx,\n\t\tappend(append([]string{}, c.FailBanners...), c.ShellPrompts...)...,\n\t)\n\tif err != nil && !errors.Is(err, context.DeadlineExceeded) {\n\t\treturn fmt.Errorf(\"post-auth read: %s (got: %s)\", preview(got, 200), err)\n\t}\n\tlow := strings.ToLower(match)\n\tfor _, fb := range c.FailBanners {\n\t\tif low == strings.ToLower(fb) {\n\t\t\treturn errors.New(\"authentication failed\")\n\t\t}\n\t}\n\t// success (matched a shell prompt or timed out without explicit failure)\n\treturn nil\n}\n\n// Exec sends a command followed by CRLF and returns text captured until one of\n// the provided prompts appears (typically your shell prompt). Provide a deadline via ctx.\nfunc (c *Client) Exec(ctx context.Context, command string, until ...string) (string, error) {\n\tif err := c.writeLine(ctx, command); err != nil {\n\t\treturn \"\", err\n\t}\n\t_, out, err := c.readUntil(ctx, until...)\n\treturn out, err\n}\n\n// --- internals ---\n","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/utils/telnetmini/telnet.go#L217-L253","documentation":"telnetmini's login flow (pkg/utils/telnetmini/telnet.go:235) reads post-auth output until one of FailBanners or ShellPrompts matches; if the matched needle equals a FailBanner (case-insensitive, whole-string compare), authentication is declared failed. Default FailBanners are 'login incorrect', 'authentication failed', 'login failed' and default ShellPrompts are '$ ', '# ', '> ' (set by Client.Defaults()). Wrong credentials are the usual cause, but a success path whose prompt never matches can leave a fail banner as the only thing read.","triggerScenarios":"Calling the auth flow with incorrect username/password; a device printing a failure banner after credentials; ShellPrompts not matching the device's real prompt so only the FailBanner is ever seen; FailBanners containing a phrase that also appears on successful login.","commonSituations":"Network/tcp templates logging into Cisco/Linux telnet with default or stale credentials; devices with custom PS1 prompts that differ from the '$ ', '# ', '> ' defaults; banner wording differing between device families.","solutions":["Verify the credentials the template supplies actually work (manual telnet test)","Set ShellPrompts to the device's exact prompt (e.g. 'router# ') so success matches before any fail text","Trim or adjust FailBanners if a success message contains a fail phrase","Give the login ctx a longer deadline so slow banners are fully read"],"exampleFix":"// before\nc := telnetmini.New(conn)\n\n// after\nc := telnetmini.New(conn)\nc.ShellPrompts = []string{\"router> \", \"router# \"}\nc.FailBanners = []string{\"login incorrect\", \"authentication failed\"}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := c.Auth(ctx, user, pass)\nif err != nil {\n    if strings.Contains(err.Error(), \"authentication failed\") {\n        // credential problem: log and skip this target\n        return fmt.Errorf(\"telnet auth rejected for %s\", target)\n    }\n    return err // transport/deadline issue\n}","preventionTips":["Confirm credentials with one manual telnet login before templating","Set ShellPrompts to the device's exact prompt so success outruns fail banners","Keep FailBanners and ShellPrompts disjoint to avoid ambiguous matches","Always run auth with a ctx deadline"],"tags":["go","nuclei","telnet","network","authentication"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}