{"record":{"id":"58973e9fd7890469","repo":"projectdiscovery/nuclei","slug":"krbroast-no-executionid-on-goja-runtime","errorCode":null,"errorMessage":"krbroast: no executionId on goja runtime","messagePattern":"krbroast: no executionId on goja runtime","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbroast/krbroast.go","lineNumber":66,"sourceCode":"//\t});\n//\n// log(hash);\n// ```\nfunc ASRepRoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {\n\tnj := utils.NewNucleiJS(vm)\n\tnj.ObjectSig = \"ASRepRoast(request)\"\n\n\tvar req ASRepRoastRequest\n\tif err := vm.ExportTo(call.Argument(0), &req); err != nil {\n\t\tnj.ThrowError(fmt.Errorf(\"invalid ASRepRoastRequest: %w\", err))\n\t}\n\tif req.Username == \"\" || req.Domain == \"\" || req.KDCHost == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"Username, Domain and KDCHost are required\")) //nolint\n\t}\n\n\texecID := nj.ExecutionId()\n\tif execID == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"krbroast: no executionId on goja runtime\"))\n\t}\n\tif !protocolstate.IsHostAllowed(execID, req.KDCHost) {\n\t\tnj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))\n\t}\n\n\thash, err := gpkrb.GetASREPWithDialer(dcerpc.NewExecDialer(execID), req.Username, req.Domain, req.KDCHost, req.Format)\n\tif err != nil {\n\t\tnj.ThrowError(err)\n\t}\n\treturn vm.ToValue(hash)\n}\n\n// KerberoastRequest configures a Kerberoast attempt.\n//\n// One of Password / NTHash must be set. SPN is the service principal name to\n// roast (e.g. \"MSSQLSvc/sql01.acme.local:1433\"). TargetUser, when set, is the\n// account name embedded in the resulting hash string (defaults to Username).\ntype KerberoastRequest struct {","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbroast/krbroast.go#L48-L84","documentation":"Thrown by krbroast.ASRepRoast when the goja runtime carries no execution ID. The nuclei JS engine stamps an executionId onto each runtime so that network dials (dcerpc.NewExecDialer) can be routed through the protocol-state dialers and network policy; an empty ID means the library was invoked outside a properly initialized nuclei execution context.","triggerScenarios":"Executing the krbroast JS binding from a hand-rolled goja runtime or a unit test that never registered an executionId; SDK embedding that creates a runtime without the nuclei execution plumbing; edge cases in old nuclei versions that predate execution-id binding.","commonSituations":"Developers prototyping nuclei JS libs outside the scanner; library consumers wiring goja directly; not reproducible from a normally launched nuclei template run (there it indicates an engine bug worth reporting).","solutions":["Run the template through the nuclei engine (nuclei -t ... or the standard runner) so the JS protocol initializes the runtime with an execution ID","Upgrade to the current nuclei release in case the execution-id plumbing changed","SDK/embedding users: ensure the JS protocol setup (protocolstate/dialers initialization) runs before template execution","If it fires during a normal nuclei run, report it as a bug with the template and version"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const hash = krb.ASRepRoast(req);\n} catch (e) {\n  if (String(e).includes('no executionId')) {\n    // engine/runtime misconfiguration, not a template bug: abort cleanly\n    throw new Error('krbroast requires a nuclei-initialized runtime');\n  }\n  throw e;\n}","preventionTips":["Run JS templates through the nuclei engine, not ad-hoc goja hosts","Keep nuclei and its bundled JS libs version-aligned (rebuild/upgrade together)","When embedding, initialize protocolstate/dialers before executing templates"],"tags":["runtime","internal","krbroast","goja","initialization","kerberos"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}