What causes "mssql: invalid token size" in shadow1ng/fscan?

Retry the login and check whether the error reproduces deterministically.

mssql: invalid token size

Error message

mssql: invalid token size

What it means

mssqlSkipLen16 read a token's 2-byte length and computed the next token position, but pos+2+size exceeds the payload length — the token body claims more bytes than the response actually contains. The library throws 'invalid token size' rather than skipping into nonexistent bytes.

Source

Thrown at plugins/services/mssql_raw.go:391

		if pos+length > end {
			return fmt.Errorf("mssql: invalid string in error token")
		}
		pos += length
	}
	if pos+4 > end {
		return fmt.Errorf("mssql: truncated error line number")
	}
	return nil
}

func mssqlSkipLen16(payload []byte, pos int) (int, error) {
	if pos+2 > len(payload) {
		return pos, fmt.Errorf("mssql: truncated token")
	}
	size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
	next := pos + 2 + size
	if next > len(payload) {
		return pos, fmt.Errorf("mssql: invalid token size")
	}
	return next, nil
}

func mssqlReadUSVarChar(payload []byte, pos int) (string, int, error) {
	if pos+2 > len(payload) {
		return "", pos, fmt.Errorf("mssql: truncated us varchar")
	}
	chars := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
	pos += 2
	size := chars * 2
	if pos+size > len(payload) {
		return "", pos, fmt.Errorf("mssql: invalid us varchar size")
	}
	return mssqlDecodeUCS2(payload[pos : pos+size]), pos + size, nil
}

func mssqlWritePacket(w io.Writer, packetType byte, payload []byte) error {

View on GitHub (pinned to 95cc12e753)

Solutions

Retry the login and check whether the error reproduces deterministically.
Packet-capture the response and validate the token's declared size against the actual byte count.
Check MTU/fragmentation issues or proxies that may drop trailing bytes.
Treat the response as corrupt: abort the connection instead of continuing to parse.

Defensive patterns

Strategy: validation

Validate before calling

size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
if pos+2+size > len(payload) {
    return fmt.Errorf("token size %d overruns payload end %d", size, len(payload))
}

Try / catch

next, err := mssqlSkipLen16(payload, pos)
if err != nil {
    conn.Close()
    return fmt.Errorf("server response framing violated: %w", err)
}

Prevention

Validate every declared length against remaining payload bytes.
Check MTU/fragmentation handling in your TCP read loop.
Isolate whether a middlebox is splicing TCP segments incorrectly.
Abort parsing after any overrun; token stream integrity is broken.

When it happens

Trigger: A length-prefixed token in the login response declares a size that overruns the end of the payload (pos+2+size > len(payload)).

Common situations: Truncated TCP stream with a corrupted trailing length; fuzzer or hostile server inflating the length field to trigger over-reads; middlebox splicing segments incorrectly.

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/1826192e0d4308f7. Report an issue: GitHub.