What causes "invalid host or port" in projectdiscovery/nuclei?

Validate host is a non-empty string and port an integer in 1-65536 before calling ExecuteQuery

invalid host or port

Error message

invalid host or port

What it means

Returned by OracleClient.ExecuteQuery as an input guard: host must be a non-empty string and port a positive integer before any probe or connection is attempted. Note the doc comment above it wrongly says 'MS SQL' — the check is for Oracle targets. It fires before IsOracle, so no network traffic happens when it triggers.

Source

Thrown at pkg/js/libs/oracle/oracle.go:201

	if err != nil {
		return false, err
	}

	return true, nil
}

// ExecuteQuery connects to MS SQL database using given credentials and executes a query.
// It returns the results of the query or an error if something goes wrong.
// @example
// ```javascript
// const oracle = require('nuclei/oracle');
// const client = new oracle.OracleClient;
// const result = client.ExecuteQuery('acme.com', 1521, 'username', 'password', 'XE', 'SELECT @@version');
// log(to_json(result));
// ```
func (c *OracleClient) ExecuteQuery(ctx context.Context, host string, port int, username, password, dbName, query string) (*utils.SQLResult, error) {
	if host == "" || port <= 0 {
		return nil, fmt.Errorf("invalid host or port")
	}

	isOracleResp, err := c.IsOracle(ctx, host, port)
	if err != nil {
		return nil, err
	}
	if !isOracleResp.IsOracle {
		return nil, fmt.Errorf("not a oracle service")
	}

	connStr := goora.BuildUrl(host, port, dbName, username, password, nil)

	return c.ExecuteQueryWithDSN(ctx, connStr, query)
}

// ExecuteQueryWithDSN executes a query on an Oracle database using a DSN
// @example
// ```javascript

View on GitHub (pinned to 265b3a3dec)

Solutions

Validate host is a non-empty string and port an integer in 1-65536 before calling ExecuteQuery
Default the port to 1521 when the template assumes Oracle but has no port data
Skip the target instead of calling when inputs are invalid
Log offending inputs to find which extractor produced the empty/zero value

Example fix

// before
const res = client.ExecuteQuery('', 0, 'user', 'pass', 'XE', 'SELECT * FROM v$version');

// after
if (host && port > 0) {
  const res = client.ExecuteQuery(host, port, 'user', 'pass', 'XE', 'SELECT * FROM v$version');
} else {
  log('invalid target, skipping');
}

Defensive patterns

Strategy: validation

Validate before calling

if (typeof host !== 'string' || host.length === 0 || !Number.isInteger(port) || port <= 0 || port > 65535) {
  throw new Error('valid host and port required');
}
client.ExecuteQuery(host, port, user, pass, dbName, query);

Type guard

function isValidOracleTarget(host, port) {
  return typeof host === 'string' && host.length > 0 && Number.isInteger(port) && port > 0 && port <= 65535;
}

Try / catch

try { client.ExecuteQuery(host, port, user, pass, dbName, query); } catch (e) { if (String(e) === 'invalid host or port') { /* skip bad row */ } else { throw e; } }

Prevention

Validate host non-empty and port 1-65536 before every call
Default the port to 1521 when only host data is available
Skip rows with missing host/port instead of calling with garbage
Log the failing inputs to trace which extractor emitted empties

When it happens

Trigger: Calling client.ExecuteQuery(host, port, ...) with host='' (e.g. an extractor produced an empty match) or port<=0 (unset variable, bad parse, 0 default). Passing a port as a string or letting JS coerce undefined to NaN→0 also lands here.

Common situations: Templates building arguments from extractor/variable output where a step produced nothing; copy-paste from docs with placeholders left; iterating service lists where some rows lack a port.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/8f05aac0e11841fe. Report an issue: GitHub.