{"record":{"id":"8d8610bc7e5db520","repo":"shadow1ng/fscan","slug":"i18n-tr-service-connection-failed-w","errorCode":null,"errorMessage":"i18n.Tr(\"service_connection_failed\", \"%w\")","messagePattern":"i18n\\.Tr\\(\"service_connection_failed\", \"%w\"\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/mongodb.go","lineNumber":644,"sourceCode":"\t\t\treturn false, err\n\t\t}\n\t}\n\n\tif strings.Contains(reply, \"totalLinesWritten\") {\n\t\treturn true, nil\n\t}\n\n\tif len(reply) > 0 {\n\t\treturn false, nil\n\t}\n\n\treturn false, fmt.Errorf(\"%s\", i18n.Tr(\"service_not_identified\", \"MongoDB\"))\n}\n\nfunc (p *MongoDBPlugin) checkMongoAuth(ctx context.Context, address string, packet []byte, session *common.ScanSession) (string, error) {\n\tconn, err := session.DialTCP(ctx, \"tcp\", address, session.Config.ModuleTimeout())\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(i18n.Tr(\"service_connection_failed\", \"%w\"), err)\n\t}\n\tdefer func() { _ = conn.Close() }()\n\n\tselect {\n\tcase <-ctx.Done():\n\t\treturn \"\", ctx.Err()\n\tdefault:\n\t}\n\n\tif deadlineErr := conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout())); deadlineErr != nil {\n\t\treturn \"\", deadlineErr\n\t}\n\n\tif _, writeErr := conn.Write(packet); writeErr != nil {\n\t\treturn \"\", writeErr\n\t}\n\n\tselect {","sourceCodeStart":626,"sourceCodeEnd":662,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mongodb.go#L626-L662","documentation":"checkMongoAuth dials the MongoDB address with the session's module timeout. If DialTCP fails, the connection error is wrapped in the localized 'service_connection_failed' template and returned. This means the plugin could not even establish a TCP connection before any MongoDB protocol exchange.","triggerScenarios":"session.DialTCP returns an error: host unreachable, connection refused, network timeout, or DNS failure — the error from the dialer is embedded via %w.","commonSituations":"MongoDB bound to localhost/127.0.0.1 only while the scanner targets an external interface; firewall dropping 27017; wrong IP:port in scan targets; container port not published.","solutions":["Confirm mongod is listening on the scanned interface (netstat / bindIp in mongod.conf)","Check firewall/security-group rules allow the scanner to reach the port","Verify the address/port used by the plugin matches the actual service","Test reachability with a basic TCP connect (nc -vz host port) before re-scanning"],"exampleFix":"// mongod.conf before\nnet:\n  bindIp: 127.0.0.1\n// after\nnet:\n  bindIp: 0.0.0.0","handlingStrategy":"try-catch","validationCode":"conn, err := net.DialTimeout(\"tcp\", addr, 3*time.Second)\nif err != nil {\n    return fmt.Errorf(\"mongodb unreachable at %s: %w\", addr, err)\n}\nconn.Close()","typeGuard":"func isConnError(err error) bool {\n    var ne net.Error\n    return errors.As(err, &ne) || errors.Is(err, syscall.ECONNREFUSED)\n}","tryCatchPattern":"_, err := checkMongoAuth(ctx, addr, packet, session)\nif err != nil {\n    var opErr *net.OpError\n    if errors.As(err, &opErr) {\n        log.Warnf(\"cannot reach %s: %v — check bindIp/firewall\", addr, opErr)\n        return\n    }\n    return err\n}","preventionTips":["Verify mongod bindIp allows remote scanners","Pre-check port reachability with a TCP dial before the plugin run","Audit firewall/security-group rules for port 27017"],"tags":["mongodb","network","tcp","connection"],"backgroundTag":"connection-refused","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}