What causes "oracle authentication failed" in shadow1ng/fscan?

Verify the username/password pair manually with sqlplus or another client to confirm the credential is valid.

oracle authentication failed

Error message

oracle authentication failed

What it means

errOracleAuthFailed is the sentinel the raw Oracle TNS client returns when the server rejects the credentials during the lightweight authentication handshake. When the session-level oracleError() is classified as ErrorTypeAuth, the code wraps it with %w so callers can match errors.Is(err, errOracleAuthFailed) while retaining the underlying TNS error text.

Source

Thrown at plugins/services/oracle_raw.go:62

)

const (
	oraclePacketConnect  = 1
	oraclePacketAccept   = 2
	oraclePacketRefuse   = 4
	oraclePacketRedirect = 5
	oraclePacketData     = 6
	oraclePacketResend   = 11

	oracleNoNewPass   = 0x1
	oracleUserAndPass = 0x100

	oracleTypeRepNative    int16 = 0
	oracleTypeRepUniversal int16 = 1
	oracleTypeRepOracle    int16 = 10
)

var errOracleAuthFailed = errors.New("oracle authentication failed")

type oracleSession struct {
	conn              net.Conn
	in                []byte
	out               bytes.Buffer
	index             int
	version           uint16
	negotiatedOptions uint16
	sessionDataUnit   uint32
	transportDataUnit uint32
	acfl0             uint8
	acfl1             uint8
	handshakeComplete bool
	ttcVersion        uint8
	hasEOSCapability  bool
	hasFSAPCapability bool
	useBigClrChunks   bool
	clrChunkSize      int

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the username/password pair manually with sqlplus or another client to confirm the credential is valid.
Match with errors.Is(err, errOracleAuthFailed) to distinguish auth failures from network/protocol failures in your scanner logic.
Unwrap the error to read the underlying ORA-code and handle specific cases (locked account vs invalid password).
Check for account lockout policies if scanning multiple credentials — repeated failures lock the account.

Example fix

// before
if err != nil {
    log.Println(err)
}
// after
if err != nil {
    if errors.Is(err, errOracleAuthFailed) {
        log.Println("bad credentials:", err)
    } else {
        log.Println("oracle connect failed:", err)
    }
}

Defensive patterns

Strategy: try-catch

Validate before calling

// validate credentials shape before attempting TNS auth
if user == "" || pass == "" {
    return errors.New("oracle credentials must not be empty")
}

Try / catch

err := oracleRawAuth(conn, user, pass, svc)
if errors.Is(err, errOracleAuthFailed) {
    // credential rejected; do not retry same creds
    return classifyCredentialFailure(err)
}

Prevention

Test each credential pair with sqlplus before bulk scanning
Use errors.Is against errOracleAuthFailed to branch auth vs network failures
Watch for account lockout when trying multiple passwords
Unwrap to inspect the specific ORA- error code

When it happens

Trigger: oracleRawAuth completes the TNS handshake, the server replies with an error packet classified by classifyOracleErrorType as ErrorTypeAuth (e.g. ORA-01017 invalid username/password), and the code returns fmt.Errorf("%w: %v", errOracleAuthFailed, err).

Common situations: Wrong password in the credential list; account locked or expired (sometimes classified as auth); connecting to a service where the schema does not exist; password file/AD integration servers rejecting simple auth.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/2670fb0bdb58955c. Report an issue: GitHub.