shadow1ng/fscan · error

Capability length expected %d

Error message

Capability length expected %d

What it means

Protocol validation in readCapability (RDP PDU capability parsing): the capability-set length field read from the server is <= 4, meaning there is no payload after the type and length header — a malformed or truncated capability set from the server.

Source

Thrown at libs/grdp/protocol/pdu/caps.go:686

	CacheSize    uint16 `struc:"little"`
	CacheEntries uint16 `struc:"little"`
}

func (*DrawNineGridCapability) Type() CapsType {
	return CAPSTYPE_DRAWNINEGRIDCACHE
}

func readCapability(r io.Reader) (Capability, error) {
	capType, err := core.ReadUint16LE(r)
	if err != nil {
		return nil, err
	}
	capLen, err := core.ReadUint16LE(r)
	if err != nil {
		return nil, err
	}
	if int(capLen)-4 <= 0 {
		return nil, errors.New(fmt.Sprintf("Capability length expected %d", capLen))
	}

	capBytes, err := core.ReadBytes(int(capLen)-4, r)
	if err != nil {
		return nil, err
	}
	capReader := bytes.NewReader(capBytes)
	var c Capability
	glog.Debugf("Capability type 0x%04x", capType)
	switch CapsType(capType) {
	case CAPSTYPE_GENERAL:
		c = &GeneralCapability{}
	case CAPSTYPE_BITMAP:
		c = &BitmapCapability{}
	case CAPSTYPE_ORDER:
		c = &OrderCapability{}
	case CAPSTYPE_BITMAPCACHE:
		c = &BitmapCacheCapability{}

View on GitHub (pinned to 95cc12e753)

Solutions

  1. Treat the peer as speaking a broken/nonstandard RDP and skip further negotiation
  2. Verify the service is actually RDP and not a protocol-smart honeypot
  3. Capture the raw packet to identify where the capability stream got truncated
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at libs/grdp/protocol/pdu/caps.go:686 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/616c779310021846. Report an issue: GitHub.