shadow1ng/fscan · error

service_no_credentials

Error message

service_no_credentials

What it means

The MSSQL service plugin's Scan first generates candidate credentials for the 'mssql' service. If GenerateCredentials returns an empty list (no usernames/passwords configured or enabled in the config), Scan immediately returns a failed ScanResult with the i18n message 'service_no_credentials'. The scan never attempts a connection in this state.

Source

Thrown at plugins/services/mssql.go:40

		BasePlugin: plugins.NewBasePlugin("mssql"),
	}
}

func (p *MSSQLPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
	config := session.Config
	state := session.State
	if config.DisableBrute {
		return p.identifyService(ctx, info, session)
	}

	target := info.Target()

	credentials := GenerateCredentials("mssql", config)
	if len(credentials) == 0 {
		return &ScanResult{
			Success: false,
			Service: "mssql",
			Error:   fmt.Errorf("%s", i18n.GetText("service_no_credentials")),
		}
	}

	// 使用公共框架进行并发凭据测试
	authFn := p.createAuthFunc(info, config, state)
	testConfig := DefaultConcurrentTestConfigWithTarget(config, info)

	result := TestCredentialsConcurrently(ctx, credentials, authFn, "mssql", testConfig)

	if result.Success {
		session.LogVuln(i18n.Tr("mssql_credential", target, result.Username, result.Password))
	}

	return result
}

// createAuthFunc 创建MSSQL认证函数
func (p *MSSQLPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {

View on GitHub (pinned to 95cc12e753)

Solutions

  1. Add mssql usernames/passwords to the credential configuration
  2. Enable the built-in default credential set for mssql in the config
  3. Verify the service key in the config is exactly 'mssql'
  4. Log the output of GenerateCredentials to debug which lists came back empty

Example fix

// before
config := map[string]interface{}{"targets": []string{"db.local:1433"}}
res := plugin.Scan(info, config, state) // service_no_credentials
// after
config := map[string]interface{}{
    "targets": []string{"db.local:1433"},
    "usernames": []string{"sa"},
    "passwords": []string{"sa", "123456"},
}
res := plugin.Scan(info, config, state)
Defensive patterns

Strategy: validation

Validate before calling

creds := GenerateCredentials("mssql", config)
if len(creds) == 0 {
    return errors.New("no mssql credentials configured: add usernames/passwords to config before scanning")
}

Try / catch

res := plugin.Scan(info, config, state)
if !res.Success && res.Error != nil && strings.Contains(res.Error.Error(), "service_no_credentials") {
    // fix config: supply mssql credentials, then rescan
    return fmt.Errorf("scan aborted, mssql credential list empty: %w", res.Error)
}

Prevention

When it happens

Trigger: Calling Scan with a config that yields zero credentials: both username and password lists empty or the mssql credential set disabled/missing in configuration passed to GenerateCredentials("mssql", config).

Common situations: Config file omits the mssql credential section; user intended to use default credentials but they are disabled; wrong service key used so no matching credentials are generated.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/e2d822787222fd24. Report an issue: GitHub.