projectdiscovery/nuclei · error

invalid host or port

Error message

invalid host or port

What it means

Connect and ConnectWithDB validate their arguments before dialing: host must be non-empty and port strictly positive. This error is pure input validation — no network I/O has happened yet, and it is returned before the protocolstate host-allowlist check. Because the call goes through memoizedconnect, the failure is also memoized per template execution for the same arguments.

Source

Thrown at pkg/js/libs/mssql/mssql.go:61

// ConnectWithDB connects to MS SQL database using given credentials and database name.
// If connection is successful, it returns true.
// If connection is unsuccessful, it returns false and error.
// The connection is closed after the function returns.
// @example
// ```javascript
// const mssql = require('nuclei/mssql');
// const client = new mssql.MSSQLClient;
// const connected = client.ConnectWithDB('acme.com', 1433, 'username', 'password', 'master');
// ```
func (c *MSSQLClient) ConnectWithDB(ctx context.Context, host string, port int, username, password, dbName string) (bool, error) {
	executionId := ctx.Value("executionId").(string)
	return memoizedconnect(ctx, executionId, host, port, username, password, dbName)
}

// @memo
func connect(ctx context.Context, executionId string, host string, port int, username string, password string, dbName string) (bool, error) {
	if host == "" || port <= 0 {
		return false, fmt.Errorf("invalid host or port")
	}
	if !protocolstate.IsHostAllowed(executionId, host) {
		// host is not valid according to network policy
		return false, protocolstate.ErrHostDenied.Msgf(host)
	}

	target := net.JoinHostPort(host, fmt.Sprintf("%d", port))

	connString := mssqlConnString(target, username, password, dbName)

	db, err := sql.Open("sqlserver", connString)
	if err != nil {
		return false, err
	}
	defer func() {
		_ = db.Close()
	}()

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Log or assert the host/port values right before the call in the template
2. Default the port explicitly: const p = port || 1433
3. Validate extracted variables before use (e.g. check host is non-empty and matches a hostname/IP regex)
4. If port comes from extraction, verify the regex captured digits only

Example fix

// before
const connected = client.ConnectWithDB(host, port, user, pass, 'master');

// after
if (!host || !(port > 0)) {
  log('skipping target: invalid host/port');
} else {
  const connected = client.ConnectWithDB(host, port || 1433, user, pass, 'master');
}

const valid = typeof host === 'string' && host.length > 0 && Number.isInteger(port) && port > 0;
if (!valid) throw new Error('bad target: ' + host + ':' + port);

function isValidMssqlTarget(host, port) {
  return typeof host === 'string' && host.length > 0 && /^[a-zA-Z0-9._:-]+$/.test(host) &&
         typeof port === 'number' && Number.isInteger(port) && port > 0 && port <= 65535;
}

try { const ok = client.ConnectWithDB(host, port || 1433, user, pass, db); }
catch (e) { if (String(e).includes('invalid host or port')) log('skipping malformed target'); else throw e; }

When it happens

Trigger: Calling mssql.Connect / mssql.ConnectWithDB with an empty host string (e.g. an unparsed URL or missing template variable) or with port 0 / negative (e.g. a port variable that failed to parse and defaulted to 0).

Common situations: Nuclei JS templates where host comes from a dynamic extraction that returned empty; passing a port as a string or undefined so the runtime coerces to 0; iterating a target list that contains a bare path or scheme-only entry.

Related errors

• not a mssql service
• invalid host or port
• parse target: %w
• grpc: refusing to dial without executionId
• http: executionId not set

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/d3508aba3570b6dc. Report an issue: GitHub.