{"record":{"id":"eb697ecbf0d0a0ad","repo":"shadow1ng/fscan","slug":"service-not-identified-eb697e","errorCode":null,"errorMessage":"service_not_identified","messagePattern":"service_not_identified","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"plugins/services/mysql.go","lineNumber":192,"sourceCode":"\t\t\tError:   err,\n\t\t}\n\t}\n\tdefer func() { _ = conn.Close() }()\n\n\tif banner := p.readMySQLBanner(conn, session.Config); banner != \"\" {\n\t\tsession.LogSuccess(i18n.Tr(\"mysql_service\", target, banner))\n\t\treturn &ScanResult{\n\t\t\tType:    plugins.ResultTypeService,\n\t\t\tSuccess: true,\n\t\t\tService: \"mysql\",\n\t\t\tBanner:  banner,\n\t\t}\n\t}\n\n\treturn &ScanResult{\n\t\tSuccess: false,\n\t\tService: \"mysql\",\n\t\tError:   fmt.Errorf(\"%s\", i18n.Tr(\"service_not_identified\", \"MySQL\")),\n\t}\n}\n\nfunc (p *MySQLPlugin) readMySQLBanner(conn net.Conn, config *common.Config) string {\n\t_ = conn.SetReadDeadline(time.Now().Add(config.ModuleTimeout()))\n\n\theader := make([]byte, 5)\n\tif _, err := io.ReadFull(conn, header); err != nil {\n\t\treturn \"\"\n\t}\n\n\tif header[4] != 10 {\n\t\treturn \"\"\n\t}\n\n\tversion := make([]byte, 0, 64)\n\tvar b [1]byte\n\tfor len(version) < 250 {","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mysql.go#L174-L210","documentation":"identifyService runs when brute force is disabled (config.DisableBrute): it connects to the port and tries to read a MySQL handshake banner. If the banner cannot be read or does not look like a MySQL greeting, it returns a failed ScanResult with the localized 'service_not_identified' message (parameterized with 'MySQL').","triggerScenarios":"TCP connect succeeds but readMySQLBanner returns an empty string — the server closes immediately, times out before sending the greeting, or sends bytes that fail the MySQL protocol header/version checks.","commonSituations":"The port hosts a different service (e.g. MariaDB fork with altered greeting handling, or a proxy accept-and-drop); a firewall allows the handshake but drops data; server-side max_connection_errors blocking; TLS-required MySQL configured to not send a plaintext greeting (rare, but with custom wrappers).","solutions":["Verify the target is really MySQL on that port (nmap/service probe).","Increase the module/read timeout if the server's greeting is slow under load.","Connect without a proxy/middlebox that may swallow the initial greeting packet.","Check server-side blocks (host blocked due to too many connection errors) and allowlist the scanner IP.","If brute force is acceptable, disable DisableBrute so full authentication testing runs instead."],"exampleFix":"// before\nconfig.DisableBrute = true // only banner identification\n// after\nconfig.DisableBrute = false // full credential testing + identification","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"res := plugin.identifyService(ctx, info, session)\nif res.Error != nil && strings.Contains(res.Error.Error(), \"service_not_identified\") {\n    // retry with a longer read deadline before marking the service unknown\n}","preventionTips":["Probe the port's service fingerprint before MySQL identification.","Allow generous read deadlines for slow servers under load.","Ensure the scanner IP is not blocked by the MySQL server or a firewall.","Fall back to full credential testing instead of banner-only identification."],"tags":["mysql","service-identification","banner","scan"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}