What causes "failed to read response: %w" in shadow1ng/fscan?

Raise ModuleTimeout in the scan configuration

failed to read response: %w

Error message

failed to read response: %w

What it means

identifyService reads the broker's reply to its STOMP CONNECT probe. Any read error (timeout, reset, EOF) is returned as 'failed to read response' in the ScanResult (hardcoded English string, not i18n).

Source

Thrown at plugins/services/activemq.go:235

	stompConnect := "CONNECT\naccept-version:1.0,1.1,1.2\nhost:/\n\n\x00"

	_ = conn.SetWriteDeadline(time.Now().Add(timeout))
	if _, writeErr := conn.Write([]byte(stompConnect)); writeErr != nil {
		return &ScanResult{
			Success: false,
			Service: "activemq",
			Error:   fmt.Errorf("STOMP request send failed: %w", writeErr),
		}
	}

	_ = conn.SetReadDeadline(time.Now().Add(timeout))
	response := make([]byte, 512)
	n, err := conn.Read(response)
	if err != nil {
		return &ScanResult{
			Success: false,
			Service: "activemq",
			Error:   fmt.Errorf("failed to read response: %w", err),
		}
	}
	if n == 0 {
		return &ScanResult{
			Success: false,
			Service: "activemq",
			Error:   fmt.Errorf("%s", i18n.GetText("activemq_stomp_empty_response")),
		}
	}

	responseStr := string(response[:n])

	if common.ContainsAny(responseStr, "CONNECTED", "ERROR") {
		banner := "ActiveMQ STOMP"
		if strings.Contains(responseStr, "server:") {
			lines := strings.Split(responseStr, "\n")
			for _, line := range lines {
				if strings.HasPrefix(line, "server:") {

View on GitHub (pinned to 95cc12e753)

Solutions

Raise ModuleTimeout in the scan configuration
Verify the port speaks plaintext STOMP vs TLS and probe accordingly
Check network devices (IDS/IPS/firewall) dropping STOMP traffic
Retry the identification; transient drops are common on busy networks

Defensive patterns

Strategy: retry

Validate before calling

// ensure deadline is set generously before probing
conn.SetReadDeadline(time.Now().Add(2 * timeout))

Try / catch

res := plugin.identifyService(ctx, host, session)
if res.Error != nil && strings.Contains(res.Error.Error(), "failed to read response") {
    if isTimeout(res.Error) { /* retry with larger timeout */ }
}

Prevention

Raise ModuleTimeout on high-latency networks
Detect TLS ports and skip plaintext STOMP probes
Whitelist scan traffic with network/security teams
Always inspect res.Error before trusting ScanResult fields

When it happens

Trigger: Read deadline expiry before the broker answers, TCP RST, or connection closed while awaiting the CONNECTED/ERROR frame during service identification.

Common situations: Overloaded broker during wide network scans, TLS-only port that cannot answer a plaintext STOMP probe, IDS/IPS dropping the probe, or timeouts tuned too aggressively for the network.

Understand the failure class

Background: Request timed out: what client-side request timeouts mean across libraries (Request timed out, TIMED_OUT, APITimeoutError) — this error's family across 39 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/bc254c7317bee08f. Report an issue: GitHub.