{"record":{"id":"e5c21937f15a7bec","repo":"projectdiscovery/nuclei","slug":"waiting-for-password-prompt-w","errorCode":null,"errorMessage":"waiting for password prompt: %w","messagePattern":"waiting for password prompt: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/utils/telnetmini/telnet.go","lineNumber":219,"sourceCode":"\treturn supportsEncryption, options\n}\n\n// Auth performs a minimal Telnet username/password interaction.\n// It waits for a username/login prompt, sends username, waits for a password prompt,\n// sends password, and then looks for fail banners or shell prompts.\n// A timeout should be enforced via ctx.\nfunc (c *Client) Auth(ctx context.Context, username, password string) error {\n\t// Wait for username/login prompt\n\tif _, _, err := c.readUntil(ctx, c.UserPrompts...); err != nil {\n\t\treturn fmt.Errorf(\"waiting for login/username prompt: %w\", err)\n\t}\n\tif err := c.writeLine(ctx, username); err != nil {\n\t\treturn fmt.Errorf(\"sending username: %w\", err)\n\t}\n\n\t// Wait for password prompt\n\tif _, _, err := c.readUntil(ctx, c.PasswordPrompts...); err != nil {\n\t\treturn fmt.Errorf(\"waiting for password prompt: %w\", err)\n\t}\n\tif err := c.writeLine(ctx, password); err != nil {\n\t\treturn fmt.Errorf(\"sending password: %w\", err)\n\t}\n\n\t// Post-auth: look quickly for explicit failure, else accept shell prompt / silence.\n\tmatch, got, err := c.readUntil(ctx,\n\t\tappend(append([]string{}, c.FailBanners...), c.ShellPrompts...)...,\n\t)\n\tif err != nil && !errors.Is(err, context.DeadlineExceeded) {\n\t\treturn fmt.Errorf(\"post-auth read: %s (got: %s)\", preview(got, 200), err)\n\t}\n\tlow := strings.ToLower(match)\n\tfor _, fb := range c.FailBanners {\n\t\tif low == strings.ToLower(fb) {\n\t\t\treturn errors.New(\"authentication failed\")\n\t\t}\n\t}","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/utils/telnetmini/telnet.go#L201-L237","documentation":"Telnet authentication flow failed while waiting for the server's password prompt. telnetmini.Client.Auth reads from the connection until one of the configured PasswordPrompts appears; readUntil honors the caller-supplied context, so the wrapped error is usually a context deadline/timeout or a connection read error. The username was sent successfully, so the failure is strictly about the password prompt never matching within the ctx budget.","triggerScenarios":"Calling Client.Auth(ctx, user, pass) where ctx has a short/zero deadline, the service's password prompt text does not match any entry in Client.PasswordPrompts, the server rejected the username silently (no prompt follows), or the TCP connection was closed between the username write and this read.","commonSituations":"Custom telnet-like services with non-standard prompts (e.g. 'Passcode:', localized prompts), a UserPrompts regex/string matching the wrong line so the username is sent too early, firewall/middlebox dropping the connection after login banner, or an aggressive ctx timeout in a scanner harness.","solutions":["Increase the ctx deadline passed to Auth (the comment says a timeout must be enforced via ctx; make it long enough for a slow login banner exchange).","Inspect the raw session bytes (readUntil returns what it got) and add the exact password prompt string to Client.PasswordPrompts (defaults expect classic 'Password:' style prompts).","Verify the service actually requires username/password telnet auth and that UserPrompts matched the real login prompt — an early/incorrect username write can suppress the password prompt.","Check network health: a reset connection surfaces the same call site as a read error."],"exampleFix":"// before\nctx, cancel := context.WithTimeout(ctx, 2*time.Second)\nerr := client.Auth(ctx, \"admin\", \"pass\")\n\n// after\nctx, cancel := context.WithTimeout(ctx, 15*time.Second)\nerr := client.Auth(ctx, \"admin\", \"pass\")\n// and, if the prompt is non-standard:\n// client.PasswordPrompts = append(client.PasswordPrompts, \"Passcode:\")","handlingStrategy":"validation","validationCode":"ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)\ndefer cancel()\n// optional: probe the service first\nif conn, err := net.DialTimeout(\"tcp\", addr, 5*time.Second); err != nil {\n    return fmt.Errorf(\"target unreachable: %w\", err)\n}\n_ = conn.Close()\nerr := client.Auth(ctx, user, pass)","typeGuard":"func isTelnetAuthPromptErr(err error) bool {\n    return err != nil && strings.HasPrefix(err.Error(), \"waiting for password prompt:\")\n}","tryCatchPattern":"if err := client.Auth(ctx, user, pass); err != nil {\n    if isTelnetAuthPromptErr(err) { /* prompt mismatch or timeout: adjust prompts/ctx, do not retry blindly */ }\n    return err\n}","preventionTips":["Configure PasswordPrompts to match the exact prompt bytes the target emits (capture a raw session once).","Give ctx a deadline larger than the slowest observed banner-to-prompt delay.","Skip Auth for services that use nonstandard handshakes; drive reads manually with readUntil."],"tags":["telnet","network","authentication","timeout"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}