What causes "oracle_connect_failed" in shadow1ng/fscan?

Verify the Oracle listener is up: telnet/nc to host:port and check lsnrctl status

oracle_connect_failed

Error message

oracle_connect_failed

What it means

doOracleAuth reports ErrorTypeNetwork with the localized oracle_connect_failed message when the underlying oracleRawAuth connection phase fails — the scanner could not establish or complete the initial Oracle TNS connection to the target. This is a network-level failure, distinct from wrong credentials.

Source

Thrown at plugins/services/oracle.go:92

		connectCtx, cancel := context.WithTimeout(ctx, config.ModuleTimeout())
		err := oracleRawAuth(connectCtx, info.Host, info.Port, serviceName, cred.Username, cred.Password, config.ModuleTimeout())
		cancel()
		if err == nil {
			state.IncrementTCPSuccessPacketCount()
			return &AuthResult{Success: true}
		}

		errorType := classifyOracleErrorType(err)
		if errorType == ErrorTypeAuth {
			return &AuthResult{Success: false, ErrorType: errorType, Error: err}
		}
	}

	state.IncrementTCPFailedPacketCount()
	return &AuthResult{
		Success:   false,
		ErrorType: ErrorTypeNetwork,
		Error:     fmt.Errorf("%s", i18n.GetText("oracle_connect_failed")),
	}
}


// classifyOracleErrorType Oracle错误分类
func classifyOracleErrorType(err error) ErrorType {
	if err == nil {
		return ErrorTypeUnknown
	}

	oracleAuthErrors := []string{
		"invalid username/password",
		"logon denied",
		"ora-01017",
		"ora-01045",
		"ora-28000",
		"ora-28001",
		"authentication failed",

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the Oracle listener is up: telnet/nc to host:port and check lsnrctl status
Confirm the SERVICE_NAME configured matches the target database
Check firewall and Oracle's VALID_NODE_CHECKING/INVITED_NODES settings
Rerun with retries — transient network failures set ErrorTypeNetwork so an outer retry loop may already handle them

Example fix

// before
doOracleAuth(host, port) // listener down
// after
if err := ensureListenerUp(host, port); err != nil {
    return fmt.Errorf("oracle listener unreachable: %w", err)
}
doOracleAuth(host, port)

Defensive patterns

Strategy: retry

Validate before calling

conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, strconv.Itoa(port)), 3*time.Second)
if err != nil {
    return fmt.Errorf("oracle port unreachable before auth: %w", err)
}
conn.Close()

Try / catch

res := doOracleAuth(host, port, svc)
if res.ErrorType == ErrorTypeNetwork {
    // transient/infra failure: backoff and retry, not a credential problem
    time.Sleep(backoff)
    res = doOracleAuth(host, port, svc)
}

Prevention

TCP-check the listener port before running the auth flow
Confirm SERVICE_NAME with the DBA or via lsnrctl status
Account for Oracle valid-node-checking/firewalls that refuse scanner IPs
Use exponential backoff for ErrorTypeNetwork results

When it happens

Trigger: testUnauthorizedAccess (or the anonymous auth wrapper) invokes doOracleAuth and the inner s.connect / handshake returns an error such as TCP refusal, timeout, or TNS refuse packet.

Common situations: Oracle listener not running on the scanned port; firewall dropping TCP; wrong service name in config; listener configured to refuse connections from the scanner's IP (node checking / valid node checking).

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c5cf751762986df4. Report an issue: GitHub.