shadow1ng/fscan · error

%s: %d [socks5_unsupported_command]

Error message

%s: %d [socks5_unsupported_command]

What it means

Guard in handleSocks5Request: the SOCKS5 command code (header[1]) is not 0x01 (CONNECT). Only the CONNECT command is supported, so BIND (0x02) or UDP ASSOCIATE (0x03) requests trigger this after a 0x07 'command not supported' reply has been written back to the client.

Source

Thrown at plugins/local/socks5proxy.go:205

}

// handleSocks5Request 处理SOCKS5连接请求
func (p *Socks5ProxyPlugin) handleSocks5Request(clientConn net.Conn, session *common.ScanSession) (net.Conn, int, error) {
	header := make([]byte, 4)
	if _, err := io.ReadFull(clientConn, header); err != nil {
		return nil, 0, fmt.Errorf("%s: %w", i18n.GetText("socks5_request_read_failed"), err)
	}

	if header[0] != 0x05 || header[2] != 0x00 {
		return nil, 0, fmt.Errorf("%s", i18n.GetText("socks5_invalid_request"))
	}

	cmd := header[1]
	if cmd != 0x01 { // 只支持CONNECT命令
		// 发送不支持的命令响应
		response := []byte{0x05, 0x07, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
		_, _ = clientConn.Write(response)
		return nil, 0, fmt.Errorf(i18n.GetText("socks5_unsupported_command")+": %d", cmd)
	}

	// 解析目标地址
	addrType := header[3]
	var targetHost string
	var targetPort int

	switch addrType {
	case 0x01: // IPv4
		addr := make([]byte, 6)
		if _, err := io.ReadFull(clientConn, addr); err != nil {
			return nil, 0, fmt.Errorf("%s", i18n.GetText("ipv4_address_invalid"))
		}
		targetHost = fmt.Sprintf("%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3])
		targetPort = int(addr[4])<<8 + int(addr[5])
	case 0x03: // 域名
		lenBuf := make([]byte, 1)
		if _, err := io.ReadFull(clientConn, lenBuf); err != nil {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Restrict proxy usage to TCP CONNECT-style outbound connections
2. Extend handleSocks5Request to implement BIND or UDP ASSOCIATE if those modes are required
3. Verify the client application is a real SOCKS5 client sending well-formed requests

When it happens

Trigger: Thrown at plugins/local/socks5proxy.go:205 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/18823369cf357f89. Report an issue: GitHub.