{"record":{"id":"cd4f07b6de8d7c36","repo":"shadow1ng/fscan","slug":"mssql-login-acknowledgement-not-received","errorCode":null,"errorMessage":"mssql: login acknowledgement not received","messagePattern":"mssql: login acknowledgement not received","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/mssql_raw.go","lineNumber":111,"sourceCode":"\tif err := mssqlSendPrelogin(conn); err != nil {\n\t\treturn result, err\n\t}\n\tif err := mssqlReadPrelogin(conn); err != nil {\n\t\treturn result, err\n\t}\n\tresult.sawPrelogin = true\n\n\tif err := mssqlSendLogin7(conn, host, username, password); err != nil {\n\t\treturn result, err\n\t}\n\tif err := mssqlReadLoginResponse(conn, result); err != nil {\n\t\treturn result, err\n\t}\n\tif len(result.errors) > 0 {\n\t\treturn result, result.errors[len(result.errors)-1]\n\t}\n\tif !result.sawLoginAck {\n\t\treturn result, fmt.Errorf(\"mssql: login acknowledgement not received\")\n\t}\n\treturn result, nil\n}\n\nfunc mssqlSendPrelogin(w io.Writer) error {\n\tfields := map[byte][]byte{\n\t\ttdsPreloginVersion:    {0, 0, 0, 0, 0, 0},\n\t\ttdsPreloginEncryption: {tdsEncryptNotSupported},\n\t\ttdsPreloginInstOpt:    {0},\n\t\ttdsPreloginThreadID:   {0, 0, 0, 0},\n\t\ttdsPreloginMARS:       {0},\n\t}\n\n\tkeys := make([]int, 0, len(fields))\n\tfor k := range fields {\n\t\tkeys = append(keys, int(k))\n\t}\n\tsort.Ints(keys)","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mssql_raw.go#L93-L129","documentation":"This error means the TDS login handshake completed without the server sending a LoginAck token (0xAD). The library performs a raw prelogin + Login7 exchange and treats a missing LoginAck as a failed/indeterminate login — typically authentication or protocol negotiation did not conclude successfully even though no explicit error token was parsed.","triggerScenarios":"Calling mssqlRawLogin where mssqlReadLoginResponse returns without result.sawLoginAck set: the server returned a response stream containing only env-change/done tokens, the stream ended after an early done token, or parsing stopped after an info token.","commonSituations":"Server requires encryption or a newer TDS version and silently rejects the plain Login7; connection to a non-SQL-Server service that replies with a malformed token stream; network middleboxes truncating the response.","solutions":["Verify the username/password is correct and the account is not locked — retry with known-good credentials via a full driver (go-mssqldb) to confirm.","Enable TLS on the login (send encryption-not-supported vs require correctly) or point the check at a server supporting TDS 7.4.","Capture the raw packet stream (tcpdump/Wireshark) and inspect whether a 0xAD token was actually sent but skipped by the parser.","Check that the target host:port really is SQL Server and not a proxy/other TDS-speaking service."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Before trusting a positive result, require both prelogin and loginack:\nres, err := mssqlRawLogin(ctx, host, port, user, pass, timeout)\nif err == nil && (!res.sawPrelogin || !res.sawLoginAck) {\n    // treat as failed login\n}","typeGuard":"func loginFullyAcknowledged(r *mssqlRawResult) bool {\n    return r != nil && r.sawPrelogin && r.sawLoginAck && len(r.errors) == 0\n}","tryCatchPattern":"res, err := mssqlRawLogin(ctx, host, port, user, pass, 5*time.Second)\nif err != nil {\n    if strings.Contains(err.Error(), \"login acknowledgement not received\") {\n        // fall back to a full driver or surface 'authentication/protocol failed'\n    }\n    return err\n}","preventionTips":["Always check both sawPrelogin and sawLoginAck, not just err == nil.","Set a realistic deadline so half-open handshakes don't hang.","Test credentials with a full driver before relying on the raw prober.","Capture packets when diagnosing missing LoginAck."],"tags":["mssql","tds","authentication","protocol"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}