shadow1ng/fscan · error

i18n.GetText("service_no_credentials")

Error message

i18n.GetText("service_no_credentials")

What it means

The MongoDB plugin's Scan returns this error when GenerateCredentials("mongodb", config) produces an empty credential list, so there is nothing to brute-force. This typically means the credential dictionary for mongodb is empty in the loaded config or all default and user-supplied credentials were filtered out. The scan aborts early instead of testing zero credentials.

Source

Thrown at plugins/services/mongodb.go:68

		return &ScanResult{Success: false, Service: "mongodb", Error: err}
	}

	if isUnauth {
		session.LogVuln(i18n.Tr("mongodb_unauth", target))
		return &ScanResult{
			Type:    plugins.ResultTypeVuln,
			Success: true,
			Service: "mongodb",
			VulInfo: i18n.GetText("unauthorized_access"),
		}
	}

	credentials := GenerateCredentials("mongodb", config)
	if len(credentials) == 0 {
		return &ScanResult{
			Success: false,
			Service: "mongodb",
			Error:   fmt.Errorf("%s", i18n.GetText("service_no_credentials")),
		}
	}

	authFn := p.createAuthFunc(info, config, state)
	testConfig := DefaultConcurrentTestConfigWithTarget(config, info)

	result := TestCredentialsConcurrently(ctx, credentials, authFn, "mongodb", testConfig)

	if result.Success {
		session.LogVuln(i18n.Tr("mongodb_credential", target, result.Username, result.Password))
	}

	return result
}

func (p *MongoDBPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {
	return func(ctx context.Context, cred Credential) *AuthResult {
		return p.doMongoDBAuth(ctx, info, cred, config, state)

View on GitHub (pinned to 95cc12e753)

Solutions

  1. Supply credentials explicitly via the scan CLI flags (e.g. username/password lists).
  2. Remove or fix the custom config entry that empties the mongodb credential dictionary.
  3. Fall back to the built-in default mongodb credential list instead of a custom empty one.
  4. If embedding fscan, populate Config with at least one Credential for mongodb before calling Scan.
  5. Verify GenerateCredentials("mongodb", config) output in a debug run to see why it is empty.

Example fix

// before
cfg := common.Config{ /* no users/pass set */ }
result := plugin.Scan(ctx, info, session) // -> service_no_credentials
// after
cfg.Users = []string{"root", "admin", "mongoadmin"}
cfg.Passwords = []string{"", "root", "123456", "mongoadmin"}
if len(GenerateCredentials("mongodb", &cfg)) == 0 {
    log.Println("skipping mongodb brute: no credentials configured")
    return
}
result := plugin.Scan(ctx, info, session)
Defensive patterns

Strategy: validation

Validate before calling

creds := services.GenerateCredentials("mongodb", config)
if len(creds) == 0 {
	return fmt.Errorf("no mongodb credentials configured; set user/password lists before scanning")
}
// safe to proceed with plugin.Scan

Try / catch

result := plugin.Scan(ctx, info, session)
if !result.Success && result.Error != nil && strings.Contains(result.Error.Error(), "credential") {
	log.Println("mongodb scan aborted: no credentials available; check config user/password lists")
}

Prevention

When it happens

Trigger: Running the mongodb plugin with brute enabled when: the built-in mongodb credential dictionary is empty or was replaced by an empty list; user-supplied username/password lists are both empty or whitespace-only; a config filter removes every candidate credential.

Common situations: Users passing empty -user/-pass style flags expecting defaults to be kept; a custom config file overriding the mongodb credential section with an empty array; tooling that programmatically builds a Config and forgets to populate credentials.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/333b97defd59230f. Report an issue: GitHub.