What causes "mysql username contains unsupported DSN delimiter" in shadow1ng/fscan?

Remove or replace delimiter characters in the username (e.g. strip '@domain' from UPN-form entries).

mysql username contains unsupported DSN delimiter

Error message

mysql username contains unsupported DSN delimiter

What it means

mySQLConnString builds a go-sql-driver DSN. The username is interpolated into the DSN where ':', '@', and '/' are delimiters (user:pass@host/db), and unescaped occurrences would corrupt the DSN. To avoid ambiguous or wrong DSNs, the function rejects usernames containing any of those characters outright.

Source

Thrown at plugins/services/mysql.go:128

			Success:   false,
			ErrorType: classifyMySQLErrorType(err),
			Error:     err,
		}
	}

	state.IncrementTCPSuccessPacketCount()

	return &AuthResult{
		Success:   true,
		Conn:      &SQLDBWrapper{db},
		ErrorType: ErrorTypeUnknown,
		Error:     nil,
	}
}

func mySQLConnString(username, password string, info *common.HostInfo, timeout time.Duration) (string, error) {
	if strings.ContainsAny(username, ":@/") {
		return "", fmt.Errorf("mysql username contains unsupported DSN delimiter")
	}
	cfg := mysql.NewConfig()
	cfg.User = username
	cfg.Passwd = password
	cfg.Net = "tcp"
	cfg.Addr = net.JoinHostPort(info.Host, strconv.Itoa(info.Port))
	cfg.DBName = "information_schema"
	cfg.Params = map[string]string{"charset": "utf8"}
	cfg.Timeout = timeout
	return cfg.FormatDSN(), nil
}

// classifyMySQLErrorType MySQL错误分类
func classifyMySQLErrorType(err error) ErrorType {
	if err == nil {
		return ErrorTypeUnknown
	}

View on GitHub (pinned to 95cc12e753)

Solutions

Remove or replace delimiter characters in the username (e.g. strip '@domain' from UPN-form entries).
Percent-encode the username before building the DSN (go-sql-driver accepts URL-encoded credentials in DSNs).
Filter wordlists at load time to drop entries containing ':@/'.
If the server truly requires such a username, construct the mysql.Config directly and use sql.OpenDB instead of a formatted DSN string.

Example fix

// before
username := "svc@corp.local"
connStr, err := mySQLConnString(username, password, info, timeout) // error
// after
localUser := strings.SplitN(username, "@", 2)[0]
connStr, err := mySQLConnString(localUser, password, info, timeout)

Defensive patterns

Strategy: validation

Validate before calling

if strings.ContainsAny(username, ":@/") {
    return fmt.Errorf("skipping credential %q: contains DSN delimiter", username)
}

Try / catch

connStr, err := mySQLConnString(user, pass, info, timeout)
if err != nil {
    if strings.Contains(err.Error(), "unsupported DSN delimiter") {
        return skipCredential(user) // filter bad entry, keep scanning
    }
}

Prevention

Sanitize or skip wordlist entries containing ':@/'.
Convert UPN usernames ('user@domain') to the local part for MySQL.
Percent-encode credentials if you must embed unusual characters in a DSN.
Prefer mysql.Config + sql.OpenDB over string DSNs for arbitrary usernames.

When it happens

Trigger: Calling doMySQLAuth (or mySQLConnString directly) with a Credential whose Username contains ':', '@', or '/' — e.g. usernames like 'admin:root', 'a@b', 'domain/user' pulled from a brute-force wordlist.

Common situations: Wordlists containing UPN-style names ('user@domain') or Windows-style 'DOMAIN/user'; copy-pasted connection strings used as usernames; fuzzed credential lists.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/93c44a7e3a7a38f3. Report an issue: GitHub.