{"record":{"id":"8420850530d965c7","repo":"shadow1ng/fscan","slug":"service-auth-failed-842085","errorCode":null,"errorMessage":"service_auth_failed","messagePattern":"service_auth_failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/smb_protocol.go","lineNumber":440,"sourceCode":"\t\t\t\tErrorType: classifySMBError(err),\n\t\t\t\tError:     err,\n\t\t\t}\n\t\t\treturn\n\t\t}\n\n\t\tif session.IsAuthenticated {\n\t\t\tresultChan <- &AuthResult{\n\t\t\t\tSuccess:   true,\n\t\t\t\tConn:      &smb1SessionWrapper{session},\n\t\t\t\tErrorType: ErrorTypeUnknown,\n\t\t\t\tError:     nil,\n\t\t\t}\n\t\t} else {\n\t\t\tsession.Close()\n\t\t\tresultChan <- &AuthResult{\n\t\t\t\tSuccess:   false,\n\t\t\t\tErrorType: ErrorTypeAuth,\n\t\t\t\tError:     fmt.Errorf(\"%s\", i18n.GetText(\"service_auth_failed\")),\n\t\t\t}\n\t\t}\n\t}()\n\n\tselect {\n\tcase result := <-resultChan:\n\t\treturn result, nil\n\tcase <-timeoutCtx.Done():\n\t\tgo func() {\n\t\t\tresult := <-resultChan\n\t\t\tif result != nil && result.Conn != nil {\n\t\t\t\t_ = result.Conn.Close()\n\t\t\t}\n\t\t}()\n\t\treturn &AuthResult{\n\t\t\tSuccess:   false,\n\t\t\tErrorType: ErrorTypeNetwork,\n\t\t\tError:     fmt.Errorf(\"%s\", i18n.GetText(\"connection_timeout\")),","sourceCodeStart":422,"sourceCodeEnd":458,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/smb_protocol.go#L422-L458","documentation":"SMB authentication failed: the plugin connected to the target and completed the SMB handshake, but the credential attempt was rejected. This error is produced in the goroutine that runs the session auth when the result is not a success, wrapping an i18n-localized 'service_auth_failed' message. It signals a wrong username/password rather than a network problem.","triggerScenarios":"Calling Authenticate on the SMB plugin with credentials that the remote host rejects; the auth goroutine's else branch fires after session negotiation succeeds but login fails.","commonSituations":"Brute-force/weak-password scanning against hosts where the credential list does not contain valid accounts; accounts locked out by policy; NTLM disabled on the target; guest access restricted.","solutions":["Verify the username/password pair is correct (test manually with smbclient or net use).","Check whether the target account is locked out or disabled and unlock it or wait out the lockout policy.","Ensure the credential list generator (GenerateCredentials) is supplied real credentials, not placeholder defaults.","Retry with a different auth dialect/protocol version if the target negotiates a legacy SMB version."],"exampleFix":"// before\nresult := plugin.Authenticate(ctx, conn, Credential{Username: \"admin\", Password: \"password\"})\n// after\ncreds := plugins.GenerateCredentials(\"smb\", cfg) // real, verified credentials\nfor _, c := range creds {\n    result := plugin.Authenticate(ctx, conn, c)\n    if result.Success { break }\n}","handlingStrategy":"try-catch","validationCode":"if cred.Username == \"\" || cred.Password == \"\" { return errors.New(\"smb credential incomplete\") }","typeGuard":"func credComplete(c Credential) bool { return c.Username != \"\" && c.Password != \"\" }","tryCatchPattern":"res := plugin.Authenticate(ctx, conn, cred)\nif res.ErrorType == ErrorTypeAuth {\n    // wrong credentials: try next credential, do not retry same pair\n}","preventionTips":["Test credentials manually against the target before automated attempts","Respect account lockout policies to avoid lockouts during scanning","Use verified credential lists rather than defaults","Log ErrorType to distinguish auth failures from network failures"],"tags":["smb","authentication","network-scan"],"backgroundTag":"authentication-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}