shadow1ng/fscan · warning

service_no_credentials

Error message

service_no_credentials

What it means

The Neo4j plugin's Scan generates its credential list via GenerateCredentials("neo4j", config). If the result is empty there is nothing to brute-force, so Scan returns a failed ScanResult carrying the localized 'service_no_credentials' message.

Source

Thrown at plugins/services/neo4j.go:46

	config := session.Config
	target := info.Target()

	if config.DisableBrute {
		return p.identifyService(ctx, info, session)
	}

	// 先测试未授权访问
	if result := p.testUnauthorizedAccess(ctx, info, session); result != nil && result.Success {
		session.LogVuln(i18n.Tr("neo4j_unauth", target))
		return result
	}

	credentials := GenerateCredentials("neo4j", config)
	if len(credentials) == 0 {
		return &ScanResult{
			Success: false,
			Service: "neo4j",
			Error:   fmt.Errorf("%s", i18n.GetText("service_no_credentials")),
		}
	}

	// 使用公共框架进行并发凭据测试
	authFn := p.createAuthFunc(info, session)
	testConfig := DefaultConcurrentTestConfigWithTarget(config, info)

	result := TestCredentialsConcurrently(ctx, credentials, authFn, "neo4j", testConfig)

	if result.Success {
		session.LogVuln(i18n.Tr("neo4j_credential", target, result.Username, result.Password))
	}

	return result
}

// createAuthFunc 创建Neo4j认证函数
func (p *Neo4jPlugin) createAuthFunc(info *common.HostInfo, session *common.ScanSession) AuthFunc {

View on GitHub (pinned to 95cc12e753)

Solutions

  1. Provide neo4j usernames/passwords in the config (include the neo4j default account).
  2. Verify the credential dictionary file exists and is non-empty and readable.
  3. Re-enable built-in default credential lists if they were intentionally disabled.
  4. Emit the credential count in scan logs to catch empty lists early.

Example fix

// before
neo4j: {}
// after
neo4j:
  users: ["neo4j"]
  passwords: ["neo4j", "password"]
Defensive patterns

Strategy: validation

Validate before calling

creds := GenerateCredentials("neo4j", config)
if len(creds) == 0 {
    return fmt.Errorf("no neo4j credentials configured: add users/passwords or enable defaults")
}

Try / catch

result := plugin.Scan(ctx, info, session)
if result.Error != nil && strings.Contains(result.Error.Error(), "service_no_credentials") {
    // report a configuration problem, not a target problem
}

Prevention

When it happens

Trigger: Scan invoked with a Config whose neo4j credential sources yield zero entries — empty custom username/password lists, a missing or empty dictionary file, or defaults turned off in brute-force settings.

Common situations: Users supply a custom credential file that is empty or has a wrong path; configuration keys for neo4j credentials are misspelled so none load; a scoped scan config that disables default wordlists without replacements.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c175b0dd4e3c244b. Report an issue: GitHub.