{"record":{"id":"4dd585e095fc1581","repo":"projectdiscovery/nuclei","slug":"unexpected-tds-status-0x-02x","errorCode":null,"errorMessage":"unexpected TDS status 0x%02x","messagePattern":"unexpected TDS status 0x%02x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/mssql/fingerprint.go","lineNumber":187,"sourceCode":"\tMajorVersion    int\n\tMinorVersion    int\n\tBuildNumber     int\n\tEncryption      int\n\tEncryptionMode  string\n\tMars            bool\n\tInstanceMatches bool\n}\n\nfunc parsePreloginResponse(response []byte) (preloginData, error) {\n\tvar out preloginData\n\tif len(response) < 8 {\n\t\treturn out, fmt.Errorf(\"response too short for TDS header\")\n\t}\n\tif response[0] != tdsTypeTabularResult {\n\t\treturn out, fmt.Errorf(\"unexpected TDS type 0x%02x\", response[0])\n\t}\n\tif response[1] != tdsStatusEOM {\n\t\treturn out, fmt.Errorf(\"unexpected TDS status 0x%02x\", response[1])\n\t}\n\tpacketLength := int(binary.BigEndian.Uint16(response[2:4]))\n\tif len(response) != packetLength {\n\t\treturn out, fmt.Errorf(\"packet length mismatch: header=%d body=%d\", packetLength, len(response))\n\t}\n\n\ttype optionToken struct {\n\t\ttoken  byte\n\t\toffset uint16\n\t\tlength uint16\n\t\tdata   []byte\n\t}\n\n\tposition := 8\n\tvar tokens []optionToken\n\tfor position < len(response) {\n\t\tif response[position] == tdsTerminator {\n\t\t\tbreak","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/mssql/fingerprint.go#L169-L205","documentation":"Returned by parsePreloginResponse when the second response byte is not 0x01 (TDSSTATUS_EOM, end-of-message), wrapped into errNotMssql by FingerprintMssql. After confirming type 0x04, the parser requires the status byte to mark a complete message; anything else means the packet is a fragment or simply not a conforming pre-login reply.","triggerScenarios":"A multi-packet TDS response where the first chunk lacks the EOM bit; a non-MSSQL service whose first byte coincidentally equals 0x04 but whose second byte differs (e.g. binary protocols, DPI-mangled replies).","commonSituations":"Middleboxes/IPS rewriting or truncating TDS streams; unusual SQL Server dialects or appliances that answer pre-login non-standardly; false positives on other binary protocols that begin 04 xx.","solutions":["Treat as 'not a standard MSSQL pre-login reply' and skip, or use mssql.IsMssql for boolean semantics","Verify network path integrity (no DPI/proxy altering payloads) when MSSQL is definitely expected","Capture the raw reply (info.Raw on success / packet dump while debugging) and compare against a known-good 04 01 pre-login response"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const info = mssql.FingerprintMssql(host, port);\n} catch (e) {\n  if (String(e).includes('not a mssql service')) return; // non-conforming reply => skip\n  throw e;\n}","preventionTips":["Consider DPI/proxy interference when MSSQL is certain but the status byte is off","Capture raw packets while debugging non-standard appliances","Default handling: classify as not-MSSQL and continue the scan"],"tags":["mssql","protocol","tds","fingerprinting","service-detection"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}