shadow1ng/fscan · error

i18n.Tr("service_connection_failed", "%w")

Error message

i18n.Tr("service_connection_failed", "%w")

What it means

checkMongoAuth dials the MongoDB address with the session's module timeout. If DialTCP fails, the connection error is wrapped in the localized 'service_connection_failed' template and returned. This means the plugin could not even establish a TCP connection before any MongoDB protocol exchange.

Source

Thrown at plugins/services/mongodb.go:644

			return false, err
		}
	}

	if strings.Contains(reply, "totalLinesWritten") {
		return true, nil
	}

	if len(reply) > 0 {
		return false, nil
	}

	return false, fmt.Errorf("%s", i18n.Tr("service_not_identified", "MongoDB"))
}

func (p *MongoDBPlugin) checkMongoAuth(ctx context.Context, address string, packet []byte, session *common.ScanSession) (string, error) {
	conn, err := session.DialTCP(ctx, "tcp", address, session.Config.ModuleTimeout())
	if err != nil {
		return "", fmt.Errorf(i18n.Tr("service_connection_failed", "%w"), err)
	}
	defer func() { _ = conn.Close() }()

	select {
	case <-ctx.Done():
		return "", ctx.Err()
	default:
	}

	if deadlineErr := conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout())); deadlineErr != nil {
		return "", deadlineErr
	}

	if _, writeErr := conn.Write(packet); writeErr != nil {
		return "", writeErr
	}

	select {

View on GitHub (pinned to 95cc12e753)

Solutions

  1. Confirm mongod is listening on the scanned interface (netstat / bindIp in mongod.conf)
  2. Check firewall/security-group rules allow the scanner to reach the port
  3. Verify the address/port used by the plugin matches the actual service
  4. Test reachability with a basic TCP connect (nc -vz host port) before re-scanning

Example fix

// mongod.conf before
net:
  bindIp: 127.0.0.1
// after
net:
  bindIp: 0.0.0.0
Defensive patterns

Strategy: try-catch

Validate before calling

conn, err := net.DialTimeout("tcp", addr, 3*time.Second)
if err != nil {
    return fmt.Errorf("mongodb unreachable at %s: %w", addr, err)
}
conn.Close()

Type guard

func isConnError(err error) bool {
    var ne net.Error
    return errors.As(err, &ne) || errors.Is(err, syscall.ECONNREFUSED)
}

Try / catch

_, err := checkMongoAuth(ctx, addr, packet, session)
if err != nil {
    var opErr *net.OpError
    if errors.As(err, &opErr) {
        log.Warnf("cannot reach %s: %v — check bindIp/firewall", addr, opErr)
        return
    }
    return err
}

Prevention

When it happens

Trigger: session.DialTCP returns an error: host unreachable, connection refused, network timeout, or DNS failure — the error from the dialer is embedded via %w.

Common situations: MongoDB bound to localhost/127.0.0.1 only while the scanner targets an external interface; firewall dropping 27017; wrong IP:port in scan targets; container port not published.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/8d8610bc7e5db520. Report an issue: GitHub.