{"record":{"id":"9fa83c7b5ac94dea","repo":"shadow1ng/fscan","slug":"s-socks5-unsupported-version","errorCode":null,"errorMessage":"%s [socks5_unsupported_version]","messagePattern":"(.+?) \\[socks5_unsupported_version\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/local/socks5proxy.go","lineNumber":169,"sourceCode":"\t\treturn\n\t}\n\tdefer func() { _ = targetConn.Close() }()\n\n\tsession.LogSuccess(i18n.GetText(\"socks5_connected\"))\n\n\t// 双向数据转发\n\tp.relayData(clientConn, targetConn)\n}\n\n// handleSocks5Handshake 处理SOCKS5握手\nfunc (p *Socks5ProxyPlugin) handleSocks5Handshake(conn net.Conn) error {\n\theader := make([]byte, 2)\n\tif _, err := io.ReadFull(conn, header); err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"socks5_handshake_read_failed\"), err)\n\t}\n\n\tif header[0] != 0x05 || header[1] == 0 {\n\t\treturn fmt.Errorf(\"%s\", i18n.GetText(\"socks5_unsupported_version\"))\n\t}\n\tmethods := make([]byte, int(header[1]))\n\tif _, err := io.ReadFull(conn, methods); err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"socks5_handshake_read_failed\"), err)\n\t}\n\tif !containsByte(methods, 0x00) {\n\t\t_, _ = conn.Write([]byte{0x05, 0xff})\n\t\treturn fmt.Errorf(\"%s\", i18n.GetText(\"socks5_unsupported_version\"))\n\t}\n\n\t// 发送握手响应（无认证）\n\tresponse := []byte{0x05, 0x00} // 版本5，无认证\n\tif _, err := conn.Write(response); err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"socks5_handshake_write_failed\"), err)\n\t}\n\n\treturn nil\n}","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/socks5proxy.go#L151-L187","documentation":"The client's SOCKS5 greeting declared a version other than 0x05 or advertised zero authentication methods, so the handshake is rejected. This library throws it because it only supports SOCKS5 (RFC 1928) with at least one method.","triggerScenarios":"In handleSocks5Handshake, header[0] != 0x05 or header[1] == 0 after successfully reading the 2-byte header — e.g. a SOCKS4 client (version byte 0x04) or a malformed/empty method list.","commonSituations":"Client configured for SOCKS4/SOCKS4a instead of SOCKS5; hand-rolled client sending only [0x05] without a method count; fuzzers or protocol-mismatched tools hitting the port.","solutions":["Reconfigure the client to use SOCKS5 (version 5) rather than SOCKS4/SOCKS4a.","Ensure the client sends a valid greeting: [0x05, N] followed by N method bytes.","If you control the client code, include 0x00 (no-auth) in the offered methods to match this server.","Point the offending scanner/tool away from the SOCKS port."],"exampleFix":"// before (client sending bad greeting)\nconn.Write([]byte{0x04, 0x01}) // SOCKS4 — rejected\n// after\nconn.Write([]byte{0x05, 0x01, 0x00}) // SOCKS5, one method: no-auth","handlingStrategy":"validation","validationCode":"// client-side: verify greeting bytes before sending\nfunc greeting() []byte {\n\tb := []byte{0x05, 0x01, 0x00} // SOCKS5, 1 method: NO-AUTH\n\tif b[0] != 0x05 || b[1] == 0 || len(b) < int(2+b[1]) {\n\t\tpanic(\"invalid socks5 greeting\")\n\t}\n\treturn b\n}","typeGuard":"func isSocks5Greeting(b []byte) bool {\n\treturn len(b) >= 2 && b[0] == 0x05 && b[1] > 0\n}","tryCatchPattern":"if err := handleSocks5Handshake(conn); err != nil {\n\tif strings.Contains(err.Error(), \"socks5_unsupported_version\") {\n\t\t// log client address; likely SOCKS4 or malformed client\n\t}\n}","preventionTips":["Configure clients for SOCKS5, never SOCKS4","Always include at least one method (prefer 0x00)","Validate greeting bytes in client code before sending","Log the first received byte on rejection for diagnosis"],"tags":["network","socks5","protocol","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}