shadow1ng/fscan · error

mssql: unexpected login response packet type %d

Error message

mssql: unexpected login response packet type %d

What it means

During the login-response phase the library received a TDS packet whose type was not REPLY (4). Login responses must arrive in REPLY packets; anything else means the stream is not a valid server response to Login7.

Source

Thrown at plugins/services/mssql_raw.go:276

		put16(offsets[i])
		put16(lengths[i])
	}
	put32(0)

	for _, value := range encoded {
		body.Write(value)
	}
	return mssqlWritePacket(w, tdsPacketLogin7, body.Bytes())
}

func mssqlReadLoginResponse(r io.Reader, result *mssqlRawResult) error {
	for {
		packetType, payload, err := mssqlReadMessage(r)
		if err != nil {
			return err
		}
		if packetType != tdsPacketReply {
			return fmt.Errorf("mssql: unexpected login response packet type %d", packetType)
		}
		done, err := mssqlParseLoginTokens(payload, result)
		if err != nil {
			return err
		}
		if done || result.sawLoginAck || len(result.errors) > 0 {
			return nil
		}
	}
}

func mssqlParseLoginTokens(payload []byte, result *mssqlRawResult) (bool, error) {
	pos := 0
	for pos < len(payload) {
		token := payload[pos]
		pos++
		switch token {
		case tdsTokenError:

View on GitHub (pinned to 95cc12e753)

Solutions

1. Check whether the server requires TLS before login (ENCRYPT_ON) and use a client that performs the TLS handshake.
2. Confirm the port maps to SQL Server, not an HTTP or generic TCP service.
3. Inspect the first response bytes with tcpdump to identify what is actually being sent.
4. Bypass proxies/VPNs to rule out protocol mangling.

// Verify TDS reachability first:
conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, fmt.Sprint(port)), timeout)
if err != nil { return err }
_ = conn.Close()

_, err := mssqlRawLogin(ctx, host, port, user, pass, timeout)
if err != nil && strings.Contains(err.Error(), "unexpected login response packet type") {
    // endpoint replied with non-TDS frames: check TLS requirement or wrong port
}

When it happens

Trigger: mssqlReadLoginResponse's loop reads a packet via mssqlReadMessage whose header[0] != 4 after sending Login7.

Common situations: Connecting to a TLS-only SQL Server whose response is a TLS alert inside a different packet framing; a proxy returning its own protocol frames; server closing with a non-TDS error page/binary.

Related errors

• mssql: unexpected login token 0x%02x
• mssql: login acknowledgement not received
• mssql: invalid prelogin response packet type %d
• mssql: prelogin response missing encryption field
• mssql: truncated done token

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/68a2a32f8b547e55. Report an issue: GitHub.