shadow1ng/fscan · info

i18n.GetText("memcached_access_failed")

Error message

i18n.GetText("memcached_access_failed")

What it means

The memcached Scan plugin returns this error when brute-force mode is enabled (DisableBrute is false) but the unauthenticated-access probe fails: either the TCP connection to the memcached port could not be established (connectToMemcached returned nil) or the 'version' command probe did not elicit a VERSION/memcached response. Since memcached normally has no authentication, fscan treats failure of the unauth check as evidence the service is not reachable/usable and reports 'memcached access failed'. It is a scan-level negative result, not a Go panic.

Source

Thrown at plugins/services/memcached.go:45

func (p *MemcachedPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
	config := session.Config
	target := info.Target()

	if config.DisableBrute {
		return p.identifyService(ctx, info, session)
	}

	// 检测未授权访问
	if result := p.testUnauthorizedAccess(ctx, info, session); result != nil && result.Success {
		session.LogVuln(i18n.Tr("memcached_unauth", target))
		return result
	}

	// Memcached通常不需要认证，如果上面检测失败则服务可能不可用
	return &ScanResult{
		Success: false,
		Service: "memcached",
		Error:   fmt.Errorf("%s", i18n.GetText("memcached_access_failed")),
	}
}

// testUnauthorizedAccess 测试Memcached未授权访问
func (p *MemcachedPlugin) testUnauthorizedAccess(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
	conn := p.connectToMemcached(ctx, info, session)
	if conn == nil {
		return nil
	}
	defer func() { _ = conn.Close() }()

	if p.testBasicCommand(conn, session.Config) {
		return &ScanResult{
			Type:    plugins.ResultTypeVuln,
			Success: true,
			Service: "memcached",
			Banner:  i18n.GetText("service_unauthorized"),
		}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the target actually exposes memcached on the scanned port (telnet/nc to 11211 and send 'version\r\n').
2. Check firewall/security-group rules allowing inbound TCP to 11211 from the scanning host.
3. Increase the module timeout so slow links are not mistaken for dead services.
4. Confirm the port list; the plugin only runs on 11211/11212/11213, so re-run with the correct port if memcached listens elsewhere.
5. If the server requires SASL or a proxy banner, inspect its response manually and treat this result as a false negative.

Example fix

// before
if result := p.testUnauthorizedAccess(ctx, info, session); result != nil && result.Success { ... }
return &ScanResult{Success: false, Error: fmt.Errorf("%s", i18n.GetText("memcached_access_failed"))}
// after
// pre-check reachability in the caller before interpreting the result as 'access failed'
conn, err := net.DialTimeout("tcp", "10.0.0.5:11211", 3*time.Second)
if err != nil { log.Println("port closed, memcached_access_failed is expected") } else { conn.Close() }

func memcachedReachable(host string, port int, timeout time.Duration) bool {
	conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", host, port), timeout)
	if err != nil { return false }
	defer conn.Close()
	conn.SetDeadline(time.Now().Add(timeout))
	if _, err := conn.Write([]byte("version\r\n")); err != nil { return false }
	buf := make([]byte, 256)
	n, err := conn.Read(buf)
	return err == nil && strings.Contains(string(buf[:n]), "VERSION")
}

func isScanFailureWithReason(r *services.ScanResult, reason string) bool {
	return r != nil && !r.Success && r.Error != nil && strings.Contains(r.Error.Error(), reason)
}

result := plugin.Scan(ctx, info, session)
if !result.Success && result.Error != nil {
	if isScanFailureWithReason(result, "memcached") {
		log.Printf("memcached probe failed on %s: %v (treat as unavailable)", info.Target(), result.Error)
	} else {
		log.Printf("unexpected scan error: %v", result.Error)
	}
}

When it happens

Trigger: Calling Scan on a memcached-registered port (11211-11213) with brute enabled when: the target refuses or times out on the TCP dial; the context is cancelled mid-dial; the server accepts TCP but does not answer 'version\r\n' with a string containing 'VERSION' or 'memcached'.

Common situations: Scanning a host where memcached is bound to localhost only or firewalled; a non-memcached service (e.g. another daemon) listening on 11211; network latency exceeding ModuleTimeout; the target is actually running a memcached variant that suppresses the version banner.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• mcs sendConnectInitial write error %v
• ReadConnectResponse %v
• mcs recvData get data error %v
• short oracle data packet
• oracle resend is not supported

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/350a44d902f2a593. Report an issue: GitHub.