What causes "mssql: invalid info token size" in shadow1ng/fscan?

Inspect the raw login response with a packet sniffer to see the malformed INFO token.

mssql: invalid info token size

Error message

mssql: invalid info token size

What it means

mssqlSkipUSVarError read an INFO token's 2-byte length and found the token structurally invalid: size below the 6-byte minimum, the token body extending past the payload, or the fixed header crossing the payload end. The library refuses to skip such a token because the declared framing contradicts the actual bytes available.

Source

Thrown at plugins/services/mssql_raw.go:360

	pos += 2
	number := int32(binary.LittleEndian.Uint32(payload[pos : pos+4]))
	pos += 4
	pos += 2
	message, next, err := mssqlReadUSVarChar(payload, pos)
	if err != nil {
		return mssqlRawError{}, pos, err
	}
	return mssqlRawError{number: number, message: message}, end, mssqlEnsureSkipBVarStrings(payload, next, end)
}

func mssqlSkipUSVarError(payload []byte, pos int) (int, error) {
	if pos+2 > len(payload) {
		return pos, fmt.Errorf("mssql: truncated info token")
	}
	size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
	end := pos + 2 + size
	if size < 6 || end > len(payload) || pos+8 > len(payload) {
		return pos, fmt.Errorf("mssql: invalid info token size")
	}
	_, _, err := mssqlReadUSVarChar(payload, pos+8)
	return end, err
}

func mssqlEnsureSkipBVarStrings(payload []byte, pos, end int) error {
	for i := 0; i < 2; i++ {
		if pos >= end {
			return fmt.Errorf("mssql: truncated string in error token")
		}
		length := int(payload[pos]) * 2
		pos++
		if pos+length > end {
			return fmt.Errorf("mssql: invalid string in error token")
		}
		pos += length
	}
	if pos+4 > end {

View on GitHub (pinned to 95cc12e753)

Solutions

Inspect the raw login response with a packet sniffer to see the malformed INFO token.
Remove or reconfigure any TDS-aware proxy between client and server.
Retry against the server directly (bypass proxies) to isolate the corruption source.
Harden the caller to abort the connection on this error instead of continuing to parse.

Defensive patterns

Strategy: validation

Validate before calling

size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
if size < 6 || pos+2+size > len(payload) || pos+8 > len(payload) {
    return fmt.Errorf("INFO token framing invalid at offset %d", pos)
}

Try / catch

next, err := mssqlSkipUSVarError(payload, pos)
if err != nil {
    conn.Close()
    return fmt.Errorf("malformed INFO token from server: %w", err)
}

Prevention

Validate declared sizes against actual payload bounds before skipping.
Bypass suspicious proxies to isolate who corrupts the stream.
Abort the connection after framing violations; never continue parsing.
Record offending payloads for server-side bug reports.

When it happens

Trigger: mssqlParseLoginTokens encounters an INFO token where size < 6, or pos+2+size > len(payload), or pos+8 > len(payload).

Common situations: Malicious or fuzzed server sends an under-sized INFO token length to confuse parsers; corrupted reassembly by middleboxes; mixed TDS protocol versions where token layouts differ.

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/aafbbb986fe3226e. Report an issue: GitHub.