What causes "i18n.Tr("service_not_identified", "MongoDB")" in shadow1ng/fscan?

Verify the service on that port is genuinely MongoDB (check hello/buildInfo output)

i18n.Tr("service_not_identified", "MongoDB")

Error message

i18n.Tr("service_not_identified", "MongoDB")

What it means

mongodbUnauth sends a probe to a MongoDB server without credentials; if the server returns a non-empty reply but the plugin cannot conclude an unauthenticated state from it, it reports the generic localized 'service not identified: MongoDB' error — the service could not be positively fingerprinted as MongoDB with the given response.

Source

Thrown at plugins/services/mongodb.go:638

	realhost := info.Target()

	reply, err := p.checkMongoAuth(ctx, realhost, createOpMsgPacket(), session)
	if err != nil {
		reply, err = p.checkMongoAuth(ctx, realhost, createOpQueryPacket(), session)
		if err != nil {
			return false, err
		}
	}

	if strings.Contains(reply, "totalLinesWritten") {
		return true, nil
	}

	if len(reply) > 0 {
		return false, nil
	}

	return false, fmt.Errorf("%s", i18n.Tr("service_not_identified", "MongoDB"))
}

func (p *MongoDBPlugin) checkMongoAuth(ctx context.Context, address string, packet []byte, session *common.ScanSession) (string, error) {
	conn, err := session.DialTCP(ctx, "tcp", address, session.Config.ModuleTimeout())
	if err != nil {
		return "", fmt.Errorf(i18n.Tr("service_connection_failed", "%w"), err)
	}
	defer func() { _ = conn.Close() }()

	select {
	case <-ctx.Done():
		return "", ctx.Err()
	default:
	}

	if deadlineErr := conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout())); deadlineErr != nil {
		return "", deadlineErr
	}

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the service on that port is genuinely MongoDB (check hello/buildInfo output)
Update the response-parsing heuristics if the target runs a newer MongoDB with a changed reply format
Scan with a plain protocol banner grab first to confirm what is listening
Exclude intermediate security devices that inject synthetic responses

Defensive patterns

Strategy: try-catch

Validate before calling

// confirm MongoDB banner before unauth check
if !strings.Contains(strings.ToLower(banner), "mongodb") {
    return errors.New("target does not advertise MongoDB")
}

Type guard

func isServiceNotIdentified(err error) bool {
    return err != nil && strings.Contains(err.Error(), "not identified")
}

Try / catch

ok, err := mongodbUnauth(ctx, addr, session)
if err != nil {
    if isServiceNotIdentified(err) {
        log.Infof("%s did not fingerprint as MongoDB; skipping", addr)
        return nil
    }
    return err
}

Prevention

Run a generic banner grab before service-specific plugins
Keep fingerprint heuristics updated for new MongoDB major versions
Exclude proxy-synthesized responses from detection logic

When it happens

Trigger: checkMongoAuth returns a reply string, but the caller's heuristics find no MongoDB marker in it, or the reply is unexpected for both the auth and unauth paths, so mongodbUnauth falls through to its final error return.

Common situations: Scanning a port where a non-MongoDB service responds with arbitrary bytes; a mongod whose reply shape changed across major versions; firewalls/IPS returning synthetic responses.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/e68f260f25fda0f5. Report an issue: GitHub.