{"record":{"id":"23805c48e0524fae","repo":"projectdiscovery/nuclei","slug":"not-a-mssql-service-23805c","errorCode":null,"errorMessage":"not a mssql service","messagePattern":"not a mssql service","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/mssql/mssql.go","lineNumber":155,"sourceCode":"// const result = client.ExecuteQuery('acme.com', 1433, 'username', 'password', 'master', 'SELECT @@version');\n// log(to_json(result));\n// ```\nfunc (c *MSSQLClient) ExecuteQuery(ctx context.Context, host string, port int, username, password, dbName, query string) (*utils.SQLResult, error) {\n\texecutionId := ctx.Value(\"executionId\").(string)\n\tif host == \"\" || port <= 0 {\n\t\treturn nil, fmt.Errorf(\"invalid host or port\")\n\t}\n\tif !protocolstate.IsHostAllowed(executionId, host) {\n\t\t// host is not valid according to network policy\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(host)\n\t}\n\n\tok, err := c.IsMssql(ctx, host, port)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"not a mssql service\")\n\t}\n\n\ttarget := net.JoinHostPort(host, fmt.Sprintf(\"%d\", port))\n\tconnString := mssqlConnString(target, username, password, dbName)\n\n\tdb, err := sql.Open(\"sqlserver\", connString)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer func() {\n\t\t_ = db.Close()\n\t}()\n\n\tdb.SetMaxOpenConns(1)\n\tdb.SetMaxIdleConns(0)\n\n\trows, err := db.QueryContext(ctx, query)\n\tif err != nil {","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/mssql/mssql.go#L137-L173","documentation":"ExecuteQuery first probes the target with IsMssql, which sends a TDS pre-login packet and tries to parse the reply; any parse failure there is classified as errNotMssql and IsMssql returns (false, nil). This error is then raised by ExecuteQuery itself: the port answered, but the reply did not validate as MSSQL, so credentials are never tried. It is a clean negative detection, not a connection failure.","triggerScenarios":"client.ExecuteQuery(...) (or the higher-level flow) against a TCP port that is not SQL Server — MySQL/PostgreSQL/HTTP on 1433, a generic banner service, or an MSSQL endpoint whose pre-login reply fails the strict TDS checks (type 0x04, status 0x01, length match, option table).","commonSituations":"Templates run against port lists without service validation; SQL Server behind a proxy that mangles the pre-login reply; TLS-only listeners where the probe reads the TLS alert as a TDS frame; honeypots.","solutions":["Confirm what really runs on the port: nmap -sV -p <port> or a manual pre-login with sqlcmd","If the target is MSSQL, check for TLS-first endpoints or middleboxes that break plaintext pre-login","Call mssql.IsMssql yourself and only run ExecuteQuery when it returns true","Restrict the template to inputs already known to be MSSQL (service tags, prior port-scan results)"],"exampleFix":"// before\nconst result = client.ExecuteQuery(host, 1433, user, pass, 'master', 'SELECT @@version');\n\n// after\nconst isMssql = mssql.IsMssql(host, 1433);\nif (isMssql) {\n  const result = client.ExecuteQuery(host, 1433, user, pass, 'master', 'SELECT @@version');\n} else {\n  log(host + ':1433 is not mssql, skipping');\n}","handlingStrategy":"validation","validationCode":"const isMssql = mssql.IsMssql(host, port);\nif (!isMssql) { log(host + ':' + port + ' not mssql, skipping query'); return; }","typeGuard":null,"tryCatchPattern":"try { const res = client.ExecuteQuery(host, port, user, pass, db, q); }\ncatch (e) { if (String(e) === 'not a mssql service') log('probe negative: ' + host); else throw e; }","preventionTips":["Call mssql.IsMssql before ExecuteQuery and skip on false","Feed templates from service-validated port data instead of raw port sweeps","Remember a false probe means 'reply failed TDS validation' — check for proxies/TLS endpoints before assuming the port is clean"],"tags":["mssql","service-detection","javascript","nuclei-template","go"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}