owasp-amass/amass · warning

probes were not successful against the target

Error message

probes were not successful against the target

What it means

Thrown by support.JARMFingerprint when every TLS probe to the target produced no usable data, so the assembled raw hash collapses to the all-zero sentinel that jarm.RawHashToFuzzyHash maps to a 64-zero-character fuzzy hash. This means the JARM probes could not extract any TLS responses. The function treats the all-zero hash as a failure rather than returning a meaningless fingerprint.

Source

Thrown at engine/plugins/support/fingerprinting.go:83

		buf := make([]byte, 1484)
		n, err := c.Read(buf)
		if err != nil || n == 0 {
			results = append(results, "")
			continue
		}
		data = buf[:n]

		ans, err := jarm.ParseServerHello(data, probe)
		if err != nil {
			results = append(results, "")
			continue
		}
		results = append(results, ans)
	}

	hash := jarm.RawHashToFuzzyHash(strings.Join(results, ","))
	if hash == "00000000000000000000000000000000000000000000000000000000000000" {
		return "", errors.New("probes were not successful against the target")
	}
	return hash, nil
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Confirm the target port actually speaks TLS and is reachable (test with openssl s_client)
2. Check firewall/IDS rules that may drop JARM's malformed-TLS probes
3. Verify network reachability and DNS resolution of the target host
4. Retry later or mark the target as unfingerprintable instead of treating it as an error

Example fix

// before
hash, err := support.JARMFingerprint(session, fqdn, 443)
if err != nil {
	return err
}
// after
hash, err := support.JARMFingerprint(session, fqdn, 443)
if err != nil {
	// target likely unreachable or non-TLS; skip fingerprinting
	return nil
}

conn, err := net.DialTimeout("tcp", host+":"+port, 5*time.Second)
if err != nil {
	return nil // target unreachable; JARM probes will fail
}
conn.Close()

null

hash, err := support.JARMFingerprint(session, target, port)
if err != nil {
	if strings.Contains(err.Error(), "probes were not successful") {
		// unreachable or non-TLS target; skip or retry later
		return nil
	}
	return err
}

When it happens

Trigger: All JARM probe packets to host:port fail or return empty answers (host unreachable, port filtered/closed, no TLS service, firewall drops, network timeouts), yielding results that hash to the all-zero sentinel.

Common situations: Scanning hosts behind firewalls that drop non-standard TLS probes; target port not running TLS; hosts that blackhole packets (timeout) instead of refusing; IPv6 misconfig where the address is unreachable; aggressive rate limiting dropping probes.

Related errors

• target must be a FQDN or IPAddress
• GLEIFSearchFuzzyCompletions: %s
• failed to create the connection to the log server: %v
• failed to cast the DomainRecord
• failed to cast the IPNetRecord

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/4d4041f3b50e140c. Report an issue: GitHub.