projectdiscovery/nuclei · warning

not a mssql service

Error message

not a mssql service

What it means

ExecuteQuery first probes the target with IsMssql, which sends a TDS pre-login packet and tries to parse the reply; any parse failure there is classified as errNotMssql and IsMssql returns (false, nil). This error is then raised by ExecuteQuery itself: the port answered, but the reply did not validate as MSSQL, so credentials are never tried. It is a clean negative detection, not a connection failure.

Source

Thrown at pkg/js/libs/mssql/mssql.go:155

// const result = client.ExecuteQuery('acme.com', 1433, 'username', 'password', 'master', 'SELECT @@version');
// log(to_json(result));
// ```
func (c *MSSQLClient) ExecuteQuery(ctx context.Context, host string, port int, username, password, dbName, query string) (*utils.SQLResult, error) {
	executionId := ctx.Value("executionId").(string)
	if host == "" || port <= 0 {
		return nil, fmt.Errorf("invalid host or port")
	}
	if !protocolstate.IsHostAllowed(executionId, host) {
		// host is not valid according to network policy
		return nil, protocolstate.ErrHostDenied.Msgf(host)
	}

	ok, err := c.IsMssql(ctx, host, port)
	if err != nil {
		return nil, err
	}
	if !ok {
		return nil, fmt.Errorf("not a mssql service")
	}

	target := net.JoinHostPort(host, fmt.Sprintf("%d", port))
	connString := mssqlConnString(target, username, password, dbName)

	db, err := sql.Open("sqlserver", connString)
	if err != nil {
		return nil, err
	}
	defer func() {
		_ = db.Close()
	}()

	db.SetMaxOpenConns(1)
	db.SetMaxIdleConns(0)

	rows, err := db.QueryContext(ctx, query)
	if err != nil {

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Confirm what really runs on the port: nmap -sV -p <port> or a manual pre-login with sqlcmd
2. If the target is MSSQL, check for TLS-first endpoints or middleboxes that break plaintext pre-login
3. Call mssql.IsMssql yourself and only run ExecuteQuery when it returns true
4. Restrict the template to inputs already known to be MSSQL (service tags, prior port-scan results)

Example fix

// before
const result = client.ExecuteQuery(host, 1433, user, pass, 'master', 'SELECT @@version');

// after
const isMssql = mssql.IsMssql(host, 1433);
if (isMssql) {
  const result = client.ExecuteQuery(host, 1433, user, pass, 'master', 'SELECT @@version');
} else {
  log(host + ':1433 is not mssql, skipping');
}

const isMssql = mssql.IsMssql(host, port);
if (!isMssql) { log(host + ':' + port + ' not mssql, skipping query'); return; }

try { const res = client.ExecuteQuery(host, port, user, pass, db, q); }
catch (e) { if (String(e) === 'not a mssql service') log('probe negative: ' + host); else throw e; }

When it happens

Trigger: client.ExecuteQuery(...) (or the higher-level flow) against a TCP port that is not SQL Server — MySQL/PostgreSQL/HTTP on 1433, a generic banner service, or an MSSQL endpoint whose pre-login reply fails the strict TDS checks (type 0x04, status 0x01, length match, option table).

Common situations: Templates run against port lists without service validation; SQL Server behind a proxy that mangles the pre-login reply; TLS-only listeners where the probe reads the TLS alert as a TDS frame; honeypots.

Related errors

• invalid host or port
• not a mssql service
• grpc: refusing to dial without executionId
• http: executionId not set
• invalid host or port

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/23805c48e0524fae. Report an issue: GitHub.