{"record":{"id":"5665db6980b6be53","repo":"projectdiscovery/nuclei","slug":"no-objectsid-found","errorCode":null,"errorMessage":"no objectSid found","messagePattern":"no objectSid found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/ldap/adenum.go","lineNumber":258,"sourceCode":"// ```javascript\n// const ldap = require('nuclei/ldap');\n// const client = new ldap.Client('ldap://ldap.example.com', 'acme.com');\n// const domainSID = client.GetADDomainSID();\n// log(domainSID);\n// ```\nfunc (c *Client) GetADDomainSID() string {\n\tr := c.Search(FilterServerTrustAccount, \"objectSid\")\n\tc.nj.Require(len(r.Entries) > 0, \"no result from GetADDomainSID query\")\n\tfor _, entry := range r.Entries {\n\t\tif sid, ok := entry.Attributes.Extra[\"objectSid\"]; ok {\n\t\t\tif sid, ok := sid.([]string); ok {\n\t\t\t\treturn DecodeSID(sid[0])\n\t\t\t} else {\n\t\t\t\tc.nj.HandleError(fmt.Errorf(\"invalid objectSid type: %T\", entry.Attributes.Extra[\"objectSid\"]), \"invalid objectSid type\")\n\t\t\t}\n\t\t}\n\t}\n\tc.nj.HandleError(fmt.Errorf(\"no objectSid found\"), \"no objectSid found\")\n\treturn \"\"\n}\n","sourceCodeStart":240,"sourceCodeEnd":261,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/ldap/adenum.go#L240-L261","documentation":"Thrown by ldap.Client.GetADDomainSID when the server-trust-account search returned entries but none carried a readable objectSid attribute. The preceding Require already guarantees at least one entry, so reaching this point means the attribute itself is absent or filtered out, most often because the bind identity lacks permission to read it.","triggerScenarios":"Calling GetADDomainSID after an anonymous or UnauthenticatedBind against AD where ACLs hide objectSid from anonymous reads; searching a non-AD LDAP server that answers the filter but has no objectSid attribute at all.","commonSituations":"Templates that authenticate with an empty password (unauthenticated bind path) and then enumerate AD; pointing the ldap.Client at OpenLDAP instead of Active Directory.","solutions":["Authenticate with real credentials before enumerating: client.Authenticate('user', 'password') or AuthenticateWithNTLMHash","Confirm the target is an Active Directory domain controller, not a generic LDAP server","Verify with a manual Search for objectSid that the attribute is visible under the current bind","Catch the error in the template and mark the 'domain SID' step as unavailable"],"exampleFix":"// before\nconst c = new ldap.Client('ldap://dc01.acme.local', 'ACME');\nconst sid = c.GetADDomainSID(); // anonymous bind -> objectSid hidden\n\n// after\nconst c = new ldap.Client('ldap://dc01.acme.local', 'ACME');\nc.Authenticate('svc_scan', 'P@ssw0rd');\nconst sid = c.GetADDomainSID();","handlingStrategy":"try-catch","validationCode":"// ensure an authenticated bind before AD enumeration\nconst client = new ldap.Client('ldap://dc01.acme.local', 'ACME');\nif (!client.Authenticate(user, pass)) throw new Error('ldap bind failed');\n// objectSid is readable now\nconst sid = client.GetADDomainSID();","typeGuard":null,"tryCatchPattern":"try {\n  const sid = client.GetADDomainSID();\n} catch (e) {\n  if (String(e).includes('no objectSid found')) {\n    // anonymous bind or non-AD target: skip domain-SID dependent steps\n  }\n}","preventionTips":["Authenticate with valid credentials before GetADDomainSID","Confirm the endpoint is Active Directory, not OpenLDAP","Make downstream steps tolerate a missing domain SID"],"tags":["ldap","active-directory","permissions","adenum","javascript"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}