{"record":{"id":"fbfc9d08670abd75","repo":"shadow1ng/fscan","slug":"s-fbfc9d","errorCode":null,"errorMessage":"%s","messagePattern":"%s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/kafka.go","lineNumber":44,"sourceCode":"\t\tBasePlugin: plugins.NewBasePlugin(\"kafka\"),\n\t}\n}\n\nfunc (p *KafkaPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {\n\tconfig := session.Config\n\tstate := session.State\n\tif config.DisableBrute {\n\t\treturn p.identifyService(ctx, info, session)\n\t}\n\n\ttarget := info.Target()\n\n\tcredentials := GenerateCredentials(\"kafka\", config)\n\tif len(credentials) == 0 {\n\t\treturn &ScanResult{\n\t\t\tSuccess: false,\n\t\t\tService: \"kafka\",\n\t\t\tError:   fmt.Errorf(\"%s\", i18n.GetText(\"service_no_credentials\")),\n\t\t}\n\t}\n\n\tauthFn := p.createAuthFunc(info, config, state)\n\ttestConfig := DefaultConcurrentTestConfigWithTarget(config, info)\n\n\tresult := TestCredentialsConcurrently(ctx, credentials, authFn, \"kafka\", testConfig)\n\n\tif result.Success {\n\t\tsession.LogVuln(i18n.Tr(\"kafka_credential\", target, result.Username, result.Password))\n\t}\n\n\treturn result\n}\n\nfunc (p *KafkaPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {\n\treturn func(ctx context.Context, cred Credential) *AuthResult {\n\t\treturn p.doKafkaAuth(ctx, info, cred, config, state)","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/kafka.go#L26-L62","documentation":"The Kafka plugin's Scan returns a ScanResult whose Error field carries the i18n 'no credentials' message when GenerateCredentials(\"kafka\", config) returns an empty slice. Scan refuses to run the SASL credential test loop with zero candidates. Purely a config/input issue.","triggerScenarios":"Scan (public) on the Kafka plugin: GenerateCredentials(\"kafka\", config) yields len(credentials) == 0 — no usernames/passwords configured for the Kafka target.","commonSituations":"Kafka section of the config left empty or with wrong keys; user assumed anonymous/unauthenticated Kafka access is handled here but provided no credential list; YAML/JSON config loaded but credentials block omitted.","solutions":["Add username/password entries to the kafka credentials config","If the broker allows anonymous access, skip SASL testing rather than invoking this Scan path","Pre-validate credential lists are non-empty before starting the scan","Confirm the config file was actually loaded (check for silent parse failures yielding empty config)"],"exampleFix":"// before\ncredentials := GenerateCredentials(\"kafka\", config) // may be empty\n// after\ncredentials := GenerateCredentials(\"kafka\", config)\nif len(credentials) == 0 {\n    return nil, fmt.Errorf(\"kafka scan requires credentials in config (or use anonymous mode)\")\n}","handlingStrategy":"validation","validationCode":"kcfg := loadKafkaConfig(config)\nif len(kcfg.Usernames) == 0 || len(kcfg.Passwords) == 0 {\n    return fmt.Errorf(\"kafka config must contain credentials or use anonymous mode\")\n}","typeGuard":"func kafkaCredsConfigured(c map[string][]string) bool {\n    return len(c[\"usernames\"]) > 0 && len(c[\"passwords\"]) > 0\n}","tryCatchPattern":"res := plugin.Scan(info, config, state)\nif res != nil && res.Error != nil && strings.Contains(res.Error.Error(), i18n.GetText(\"service_no_credentials\")) {\n    log.Println(\"kafka: no credentials configured; supply user/pass pairs or skip SASL testing\")\n    return\n}","preventionTips":["Non-empty credentials check in a pre-scan config validation pass","Confirm the config file actually loaded (log parsed credential counts)","Skip SASL testing explicitly for anonymous-allowed brokers","Keep per-service credential keys documented to avoid typos"],"tags":["kafka","credentials","config","empty"],"backgroundTag":"missing-credentials","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}