shadow1ng/fscan · error

mysql username contains unsupported DSN delimiter

Error message

mysql username contains unsupported DSN delimiter

What it means

mySQLConnString builds a go-sql-driver DSN. The username is interpolated into the DSN where ':', '@', and '/' are delimiters (user:pass@host/db), and unescaped occurrences would corrupt the DSN. To avoid ambiguous or wrong DSNs, the function rejects usernames containing any of those characters outright.

Solutions

1. Remove or replace delimiter characters in the username (e.g. strip '@domain' from UPN-form entries).
2. Percent-encode the username before building the DSN (go-sql-driver accepts URL-encoded credentials in DSNs).
3. Filter wordlists at load time to drop entries containing ':@/'.
4. If the server truly requires such a username, construct the mysql.Config directly and use sql.OpenDB instead of a formatted DSN string.

Example fix

// before
username := "svc@corp.local"
connStr, err := mySQLConnString(username, password, info, timeout) // error
// after
localUser := strings.SplitN(username, "@", 2)[0]
connStr, err := mySQLConnString(localUser, password, info, timeout)

if strings.ContainsAny(username, ":@/") {
    return fmt.Errorf("skipping credential %q: contains DSN delimiter", username)
}

connStr, err := mySQLConnString(user, pass, info, timeout)
if err != nil {
    if strings.Contains(err.Error(), "unsupported DSN delimiter") {
        return skipCredential(user) // filter bad entry, keep scanning
    }
}

When it happens

Trigger: Calling doMySQLAuth (or mySQLConnString directly) with a Credential whose Username contains ':', '@', or '/' — e.g. usernames like 'admin:root', 'a@b', 'domain/user' pulled from a brute-force wordlist.

Common situations: Wordlists containing UPN-style names ('user@domain') or Windows-style 'DOMAIN/user'; copy-pasted connection strings used as usernames; fuzzed credential lists.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• service_no_credentials
• auth function is nil
• authentication failed
• authentication required
• i18n.GetText("service_no_credentials")

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/93c44a7e3a7a38f3. Report an issue: GitHub.

Appendix: source

Thrown at plugins/services/mysql.go:128

			Success:   false,
			ErrorType: classifyMySQLErrorType(err),
			Error:     err,
		}
	}

	state.IncrementTCPSuccessPacketCount()

	return &AuthResult{
		Success:   true,
		Conn:      &SQLDBWrapper{db},
		ErrorType: ErrorTypeUnknown,
		Error:     nil,
	}
}

func mySQLConnString(username, password string, info *common.HostInfo, timeout time.Duration) (string, error) {
	if strings.ContainsAny(username, ":@/") {
		return "", fmt.Errorf("mysql username contains unsupported DSN delimiter")
	}
	cfg := mysql.NewConfig()
	cfg.User = username
	cfg.Passwd = password
	cfg.Net = "tcp"
	cfg.Addr = net.JoinHostPort(info.Host, strconv.Itoa(info.Port))
	cfg.DBName = "information_schema"
	cfg.Params = map[string]string{"charset": "utf8"}
	cfg.Timeout = timeout
	return cfg.FormatDSN(), nil
}

// classifyMySQLErrorType MySQL错误分类
func classifyMySQLErrorType(err error) ErrorType {
	if err == nil {
		return ErrorTypeUnknown
	}

View on GitHub (pinned to 95cc12e753)