{"record":{"id":"c175b0dd4e3c244b","repo":"shadow1ng/fscan","slug":"service-no-credentials-c175b0","errorCode":null,"errorMessage":"service_no_credentials","messagePattern":"service_no_credentials","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/neo4j.go","lineNumber":46,"sourceCode":"\tconfig := session.Config\n\ttarget := info.Target()\n\n\tif config.DisableBrute {\n\t\treturn p.identifyService(ctx, info, session)\n\t}\n\n\t// 先测试未授权访问\n\tif result := p.testUnauthorizedAccess(ctx, info, session); result != nil && result.Success {\n\t\tsession.LogVuln(i18n.Tr(\"neo4j_unauth\", target))\n\t\treturn result\n\t}\n\n\tcredentials := GenerateCredentials(\"neo4j\", config)\n\tif len(credentials) == 0 {\n\t\treturn &ScanResult{\n\t\t\tSuccess: false,\n\t\t\tService: \"neo4j\",\n\t\t\tError:   fmt.Errorf(\"%s\", i18n.GetText(\"service_no_credentials\")),\n\t\t}\n\t}\n\n\t// 使用公共框架进行并发凭据测试\n\tauthFn := p.createAuthFunc(info, session)\n\ttestConfig := DefaultConcurrentTestConfigWithTarget(config, info)\n\n\tresult := TestCredentialsConcurrently(ctx, credentials, authFn, \"neo4j\", testConfig)\n\n\tif result.Success {\n\t\tsession.LogVuln(i18n.Tr(\"neo4j_credential\", target, result.Username, result.Password))\n\t}\n\n\treturn result\n}\n\n// createAuthFunc 创建Neo4j认证函数\nfunc (p *Neo4jPlugin) createAuthFunc(info *common.HostInfo, session *common.ScanSession) AuthFunc {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/neo4j.go#L28-L64","documentation":"The Neo4j plugin's Scan generates its credential list via GenerateCredentials(\"neo4j\", config). If the result is empty there is nothing to brute-force, so Scan returns a failed ScanResult carrying the localized 'service_no_credentials' message.","triggerScenarios":"Scan invoked with a Config whose neo4j credential sources yield zero entries — empty custom username/password lists, a missing or empty dictionary file, or defaults turned off in brute-force settings.","commonSituations":"Users supply a custom credential file that is empty or has a wrong path; configuration keys for neo4j credentials are misspelled so none load; a scoped scan config that disables default wordlists without replacements.","solutions":["Provide neo4j usernames/passwords in the config (include the neo4j default account).","Verify the credential dictionary file exists and is non-empty and readable.","Re-enable built-in default credential lists if they were intentionally disabled.","Emit the credential count in scan logs to catch empty lists early."],"exampleFix":"// before\nneo4j: {}\n// after\nneo4j:\n  users: [\"neo4j\"]\n  passwords: [\"neo4j\", \"password\"]","handlingStrategy":"validation","validationCode":"creds := GenerateCredentials(\"neo4j\", config)\nif len(creds) == 0 {\n    return fmt.Errorf(\"no neo4j credentials configured: add users/passwords or enable defaults\")\n}","typeGuard":null,"tryCatchPattern":"result := plugin.Scan(ctx, info, session)\nif result.Error != nil && strings.Contains(result.Error.Error(), \"service_no_credentials\") {\n    // report a configuration problem, not a target problem\n}","preventionTips":["Include the default 'neo4j' account in credential lists.","Validate dictionary files exist and are non-empty at startup.","Log generated credential counts before scanning.","Keep default wordlists enabled unless explicitly replaced."],"tags":["neo4j","credentials","config","scan"],"backgroundTag":"missing-credentials","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}