{"record":{"id":"dfe6f7ea7211279a","repo":"shadow1ng/fscan","slug":"mssql-invalid-prelogin-response-packet-type-d","errorCode":null,"errorMessage":"mssql: invalid prelogin response packet type %d","messagePattern":"mssql: invalid prelogin response packet type (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/mssql_raw.go","lineNumber":154,"sourceCode":"\t\t_ = binary.Write(payload, binary.BigEndian, offset)\n\t\t_ = binary.Write(payload, binary.BigEndian, uint16(len(value)))\n\t\toffset += uint16(len(value))\n\t}\n\tpayload.WriteByte(tdsPreloginTerminator)\n\tfor _, key := range keys {\n\t\tpayload.Write(fields[byte(key)])\n\t}\n\n\treturn mssqlWritePacket(w, tdsPacketPrelogin, payload.Bytes())\n}\n\nfunc mssqlReadPrelogin(r io.Reader) error {\n\tpacketType, payload, err := mssqlReadMessage(r)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif packetType != tdsPacketReply {\n\t\treturn fmt.Errorf(\"mssql: invalid prelogin response packet type %d\", packetType)\n\t}\n\tif len(payload) == 0 {\n\t\treturn fmt.Errorf(\"mssql: empty prelogin response\")\n\t}\n\n\tfields, err := mssqlParsePreloginFields(payload)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif _, ok := fields[tdsPreloginEncryption]; !ok {\n\t\treturn fmt.Errorf(\"mssql: prelogin response missing encryption field\")\n\t}\n\treturn nil\n}\n\nfunc mssqlParsePreloginFields(payload []byte) (map[byte][]byte, error) {\n\tfields := make(map[byte][]byte)\n\tfor pos := 0; ; pos += 5 {","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mssql_raw.go#L136-L172","documentation":"The first packet of the prelogin response was not a TDS REPLY packet (type 4). After sending a prelogin packet the library expects the server to answer with packet type 4; any other type indicates the endpoint is not behaving like SQL Server or the stream is desynchronized.","triggerScenarios":"mssqlReadPrelogin gets a packet type other than 4 from mssqlReadMessage, e.g. the remote peer sent a data packet, an RST-adjacent protocol banner, or a redirect packet.","commonSituations":"Connecting to the wrong port (another service that echoes bytes); SQL Server Browser endpoints (UDP vs TCP confusion); TLS-wrapped SQL Server where the first bytes are a TLS record instead of a TDS packet.","solutions":["Confirm the port is a TCP SQL Server instance port (1433 or the instance's dynamic port), not UDP 1434 or a TLS-only frontend.","If the server requires encryption, the client must negotiate TLS — prelogin response may differ; use a driver supporting ENCRYPT_ON.","Check for proxies/load balancers that alter the first packet.","Re-run with a packet capture to see the actual first byte of the response."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate the target speaks TDS before deep handshakes:\nconn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, strconv.Itoa(port)), timeout)\nif err != nil { /* not reachable */ }\n_ = conn.Close()","typeGuard":null,"tryCatchPattern":"res, err := mssqlRawLogin(ctx, host, port, user, pass, timeout)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"mssql: invalid prelogin response packet type\") {\n        // endpoint is not SQL Server or requires TLS; try alternate port/driver\n    }\n}","preventionTips":["Confirm the port is a TCP SQL Server endpoint (not UDP 1434 browser service).","Check whether the instance requires forced encryption before using a plain prelogin.","Test with sqlcmd/go-mssqldb to validate the endpoint first."],"tags":["mssql","tds","prelogin","protocol"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}