{"record":{"id":"68a2a32f8b547e55","repo":"shadow1ng/fscan","slug":"mssql-unexpected-login-response-packet-type-d","errorCode":null,"errorMessage":"mssql: unexpected login response packet type %d","messagePattern":"mssql: unexpected login response packet type (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/mssql_raw.go","lineNumber":276,"sourceCode":"\t\tput16(offsets[i])\n\t\tput16(lengths[i])\n\t}\n\tput32(0)\n\n\tfor _, value := range encoded {\n\t\tbody.Write(value)\n\t}\n\treturn mssqlWritePacket(w, tdsPacketLogin7, body.Bytes())\n}\n\nfunc mssqlReadLoginResponse(r io.Reader, result *mssqlRawResult) error {\n\tfor {\n\t\tpacketType, payload, err := mssqlReadMessage(r)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif packetType != tdsPacketReply {\n\t\t\treturn fmt.Errorf(\"mssql: unexpected login response packet type %d\", packetType)\n\t\t}\n\t\tdone, err := mssqlParseLoginTokens(payload, result)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif done || result.sawLoginAck || len(result.errors) > 0 {\n\t\t\treturn nil\n\t\t}\n\t}\n}\n\nfunc mssqlParseLoginTokens(payload []byte, result *mssqlRawResult) (bool, error) {\n\tpos := 0\n\tfor pos < len(payload) {\n\t\ttoken := payload[pos]\n\t\tpos++\n\t\tswitch token {\n\t\tcase tdsTokenError:","sourceCodeStart":258,"sourceCodeEnd":294,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mssql_raw.go#L258-L294","documentation":"During the login-response phase the library received a TDS packet whose type was not REPLY (4). Login responses must arrive in REPLY packets; anything else means the stream is not a valid server response to Login7.","triggerScenarios":"mssqlReadLoginResponse's loop reads a packet via mssqlReadMessage whose header[0] != 4 after sending Login7.","commonSituations":"Connecting to a TLS-only SQL Server whose response is a TLS alert inside a different packet framing; a proxy returning its own protocol frames; server closing with a non-TDS error page/binary.","solutions":["Check whether the server requires TLS before login (ENCRYPT_ON) and use a client that performs the TLS handshake.","Confirm the port maps to SQL Server, not an HTTP or generic TCP service.","Inspect the first response bytes with tcpdump to identify what is actually being sent.","Bypass proxies/VPNs to rule out protocol mangling."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify TDS reachability first:\nconn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, fmt.Sprint(port)), timeout)\nif err != nil { return err }\n_ = conn.Close()","typeGuard":null,"tryCatchPattern":"_, err := mssqlRawLogin(ctx, host, port, user, pass, timeout)\nif err != nil && strings.Contains(err.Error(), \"unexpected login response packet type\") {\n    // endpoint replied with non-TDS frames: check TLS requirement or wrong port\n}","preventionTips":["Check forced-encryption settings on the server before plain-text probes.","Confirm port mappings with the DBA or SQL Server error log.","Bypass proxies when diagnosing protocol-level failures."],"tags":["mssql","tds","login","protocol"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}