{"record":{"id":"4837ceb600866632","repo":"sqlmapproject/sqlmap","slug":"kerberoserror-code-expstring-errorfields-11-if","errorCode":null,"errorMessage":"KerberosError(code, _expString(errorFields[11]) if 11 in errorFields else None)","messagePattern":"KerberosError\\(code, _expString\\(errorFields\\[11\\]\\) if 11 in errorFields else None\\)","errorType":"exception","errorClass":"KerberosError","httpStatus":null,"severity":"error","filePath":"extra/kerberos/client.py","lineNumber":351,"sourceCode":"    # 1) probe without pre-auth to discover the etype/salt/iterations (or get the TGT outright)\n    nonce = _nonce()\n    response = _sendReceive(kdcHost, kdcPort, _asReq(realm, username, etypes, nonce))\n    tag = der.peel(response)[0]\n\n    if tag == der.applicationTag(AS_REP):                  # KDC issued the ticket without pre-auth\n        etype = _replyEtype(response)                      # derive the key for the etype the KDC actually used\n        rep = _fields(der.peel(der.peel(response)[1])[1])\n        # the reply's own padata can still carry the salt/iterations of a non-default principal\n        chosenSalt, iterations = _hintFor(_etypeHints(rep[2]) if 2 in rep else {}, etype, salt, chosenSalt)\n        clientKey = _enctype(etype).string2key(password, chosenSalt, iterations)\n        return _parseRep(response, clientKey, USAGE_AS_REP_ENCPART, nonce, AS_REP)\n\n    etype, iterations = etypes[0], None\n    if tag == der.applicationTag(KRB_ERROR):\n        errorFields = _fields(der.peel(der.peel(response)[1])[1])\n        code = _expInteger(errorFields[6]) if 6 in errorFields else -1\n        if code != KDC_ERR_PREAUTH_REQUIRED:\n            raise KerberosError(code, _expString(errorFields[11]) if 11 in errorFields else None)\n        # the hint is unauthenticated, so it may only choose among the etypes we actually offered, and\n        # in *our* order of preference rather than the KDC's (otherwise it could force a downgrade)\n        hints = _preauthHints(errorFields)\n        etype = _selectEtype(etypes, hints)\n        chosenSalt, iterations = _hintFor(hints, etype, salt, chosenSalt)\n\n    enc = _enctype(etype)\n    clientKey = enc.string2key(password, chosenSalt, iterations)\n\n    # 2) authenticated request with PA-ENC-TIMESTAMP under the discovered etype/salt\n    patime, pausec = _timestamp()\n    paTsEnc = der.sequence(der.tagged(0, der.generalizedTime(patime)), der.tagged(1, der.integer(pausec)))\n    cipher = enc.encrypt(clientKey, USAGE_AS_REQ_PA_ENC_TIMESTAMP, paTsEnc)\n    paData = der.sequence(\n        der.tagged(1, der.integer(PA_ENC_TIMESTAMP)),\n        der.tagged(2, der.octetString(_encryptedData(etype, cipher))),\n    )\n    nonce = _nonce()","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/extra/kerberos/client.py#L333-L369","documentation":"Error \"KerberosError(code, _expString(errorFields[11]) if 11 in errorFields else None)\" thrown in sqlmapproject/sqlmap.","triggerScenarios":"Thrown at extra/kerberos/client.py:351 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","schemaVersion":2},"datasetVersion":"2026-08-27T03:17:27.898Z"}