{"record":{"id":"2ebcd2611eb2127c","repo":"projectdiscovery/nuclei","slug":"either-password-or-nthash-must-be-supplied","errorCode":null,"errorMessage":"either Password or NTHash must be supplied","messagePattern":"either Password or NTHash must be supplied","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbroast/krbroast.go","lineNumber":138,"sourceCode":"//\t  SPN:        'MSSQLSvc/sql01.acme.local:1433',\n//\t  TargetUser: 'svc_sql',\n//\t});\n//\n// log(r.Hash);\n// ```\nfunc Kerberoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {\n\tnj := utils.NewNucleiJS(vm)\n\tnj.ObjectSig = \"Kerberoast(request)\"\n\n\tvar req KerberoastRequest\n\tif err := vm.ExportTo(call.Argument(0), &req); err != nil {\n\t\tnj.ThrowError(fmt.Errorf(\"invalid KerberoastRequest: %w\", err))\n\t}\n\tif req.Username == \"\" || req.Domain == \"\" || req.KDCHost == \"\" || req.SPN == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"Username, Domain, KDCHost and SPN are required\")) //nolint\n\t}\n\tif req.Password == \"\" && req.NTHash == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"either Password or NTHash must be supplied\"))\n\t}\n\n\texecID := nj.ExecutionId()\n\tif execID == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"krbroast: no executionId on goja runtime\"))\n\t}\n\tif !protocolstate.IsHostAllowed(execID, req.KDCHost) {\n\t\tnj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))\n\t}\n\n\ttarget := req.TargetUser\n\tif target == \"\" {\n\t\ttarget = req.Username\n\t}\n\tres, err := gpkrb.GetTGSWithOptions(gpkrb.TGSOptions{\n\t\tUsername:   req.Username,\n\t\tPassword:   req.Password,\n\t\tNTHash:     req.NTHash,","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbroast/krbroast.go#L120-L156","documentation":"Thrown by krbroast.Kerberoast when both Password and NTHash are empty. Kerberoasting requires valid domain credentials to obtain a TGS, unlike AS-REP roasting which needs none; the library enforces that at least one authenticator is supplied.","triggerScenarios":"krb.Kerberoast({Username, Domain, KDCHost, SPN}) with no Password and no NTHash; credentials passed under a misspelled or snake_case key that failed to map (e.g. password vs Password is fine case-insensitively, but a typo like Passwrd leaves it empty).","commonSituations":"Reusing an ASRepRoast-style call shape (which needs no creds) for Kerberoast; hash value present in the template data but attached to the wrong key; empty credential variables at runtime.","solutions":["Supply either Password: '...' or NTHash: '...' (NT hash hex, e.g. from secretsdump) in the request object","If only a hash is available, pass NTHash and omit Password (they are alternatives, not both required)","Double-check the key spelling and that the credential variable is non-empty before calling"],"exampleFix":"// before\nkrb.Kerberoast({Username: 'u', Domain: 'd', KDCHost: 'dc01', SPN: 'cifs/web01'}); // no creds\n\n// after\nkrb.Kerberoast({Username: 'u', NTHash: '31d6cfe0d16ae931b73c59d7e0c089c0', Domain: 'd', KDCHost: 'dc01', SPN: 'cifs/web01'});","handlingStrategy":"validation","validationCode":"const req = { Username, Domain, KDCHost, SPN };\nif (Password) req.Password = String(Password);\nelse if (NTHash) req.NTHash = String(NTHash);\nelse throw new Error('Kerberoast: supply Password or NTHash');\nconst r = krb.Kerberoast(req);","typeGuard":"const hasCredentials = (r) =>\n  (typeof r.Password === 'string' && r.Password !== '') ||\n  (typeof r.NTHash === 'string' && r.NTHash !== '');","tryCatchPattern":null,"preventionTips":["Remember Kerberoasting needs creds while AS-REP roasting does not — pick the right primitive","Keep the NT hash as a 32-char hex string","Check credential variables are populated before running the template"],"tags":["javascript","krbroast","validation","credentials","kerberos","active-directory"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}