shadow1ng/fscan · error

%s

Error message

%s

What it means

The Kafka plugin's Scan returns a ScanResult whose Error field carries the i18n 'no credentials' message when GenerateCredentials("kafka", config) returns an empty slice. Scan refuses to run the SASL credential test loop with zero candidates. Purely a config/input issue.

Source

Thrown at plugins/services/kafka.go:44

		BasePlugin: plugins.NewBasePlugin("kafka"),
	}
}

func (p *KafkaPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
	config := session.Config
	state := session.State
	if config.DisableBrute {
		return p.identifyService(ctx, info, session)
	}

	target := info.Target()

	credentials := GenerateCredentials("kafka", config)
	if len(credentials) == 0 {
		return &ScanResult{
			Success: false,
			Service: "kafka",
			Error:   fmt.Errorf("%s", i18n.GetText("service_no_credentials")),
		}
	}

	authFn := p.createAuthFunc(info, config, state)
	testConfig := DefaultConcurrentTestConfigWithTarget(config, info)

	result := TestCredentialsConcurrently(ctx, credentials, authFn, "kafka", testConfig)

	if result.Success {
		session.LogVuln(i18n.Tr("kafka_credential", target, result.Username, result.Password))
	}

	return result
}

func (p *KafkaPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {
	return func(ctx context.Context, cred Credential) *AuthResult {
		return p.doKafkaAuth(ctx, info, cred, config, state)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Add username/password entries to the kafka credentials config
2. If the broker allows anonymous access, skip SASL testing rather than invoking this Scan path
3. Pre-validate credential lists are non-empty before starting the scan
4. Confirm the config file was actually loaded (check for silent parse failures yielding empty config)

Example fix

// before
credentials := GenerateCredentials("kafka", config) // may be empty
// after
credentials := GenerateCredentials("kafka", config)
if len(credentials) == 0 {
    return nil, fmt.Errorf("kafka scan requires credentials in config (or use anonymous mode)")
}

kcfg := loadKafkaConfig(config)
if len(kcfg.Usernames) == 0 || len(kcfg.Passwords) == 0 {
    return fmt.Errorf("kafka config must contain credentials or use anonymous mode")
}

func kafkaCredsConfigured(c map[string][]string) bool {
    return len(c["usernames"]) > 0 && len(c["passwords"]) > 0
}

res := plugin.Scan(info, config, state)
if res != nil && res.Error != nil && strings.Contains(res.Error.Error(), i18n.GetText("service_no_credentials")) {
    log.Println("kafka: no credentials configured; supply user/pass pairs or skip SASL testing")
    return
}

When it happens

Trigger: Scan (public) on the Kafka plugin: GenerateCredentials("kafka", config) yields len(credentials) == 0 — no usernames/passwords configured for the Kafka target.

Common situations: Kafka section of the config left empty or with wrong keys; user assumed anonymous/unauthenticated Kafka access is handled here but provided no credential list; YAML/JSON config loaded but credentials block omitted.

Related errors

• %s
• SASL authenticate error: %d
• i18n.GetText("service_no_credentials")
• service_no_credentials
• service_no_credentials

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/fbfc9d08670abd75. Report an issue: GitHub.