{"record":{"id":"5ccb3f3924d8b291","repo":"projectdiscovery/nuclei","slug":"spn-is-required-for-silver-ticket","errorCode":null,"errorMessage":"spn is required for silver ticket","messagePattern":"spn is required for silver ticket","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbforge/krbforge.go","lineNumber":145,"sourceCode":"\n\toutputFile, err := exportOutputFile(call.Argument(1))\n\tif err != nil {\n\t\tnj.ThrowError(err)\n\t\treturn goja.Undefined()\n\t}\n\n\tticket, err := createSilverTicket(nj.ExecutionId(), req, outputFile)\n\tif err != nil {\n\t\tnj.ThrowError(err)\n\t\treturn goja.Undefined()\n\t}\n\n\treturn vm.ToValue(ticket)\n}\n\nfunc createSilverTicket(executionID string, req TicketRequest, outputFile string) (*Ticket, error) {\n\tif req.SPN == \"\" {\n\t\treturn nil, fmt.Errorf(\"spn is required for silver ticket\")\n\t}\n\n\tcfg, err := buildConfig(executionID, req, outputFile)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif cfg.OutputFile == \"\" {\n\t\tcfg.OutputFile = \"-\"\n\t}\n\n\treturn createTicket(cfg)\n}\n\nfunc createTicket(cfg *gpkrb.TicketConfig) (*Ticket, error) {\n\tres, err := gpkrb.CreateTicket(cfg)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbforge/krbforge.go#L127-L163","documentation":"createSilverTicket refuses requests whose SPN field is empty. A silver ticket is a service ticket encrypted with the service account's key for one specific SPN; without an SPN there is nothing to forge against, so the request is rejected before any config is built.","triggerScenarios":"Calling krb.CreateSilverTicket({username, domain, domain_sid, nthash}) with no spn key; passing an object whose spn property is an empty string or undefined; copy-pasting a golden-ticket example (which needs no SPN) into CreateSilverTicket.","commonSituations":"Confusing golden (TGT, krbtgt hash, no SPN) with silver (TGS, service hash, SPN required) workflows; JSON-driven templates where the spn key is optional in the schema and omitted.","solutions":["Add the target SPN in service/class format, e.g. spn: 'cifs/server01.acme.local'","If you intended a TGT, use CreateGoldenTicket instead, which takes no SPN","Supply the NT hash or AES key of the service account that owns the SPN (machine account for cifs/host SPNs)"],"exampleFix":"// before\nconst t = krb.CreateSilverTicket({\n  username: 'Administrator',\n  domain: 'acme.local',\n  domain_sid: 'S-1-5-21-...',\n  nthash: '31d6cfe0d16ae931b73c59d7e0c089c0',\n});\n\n// after\nconst t = krb.CreateSilverTicket({\n  username: 'Administrator',\n  domain: 'acme.local',\n  domain_sid: 'S-1-5-21-...',\n  nthash: '31d6cfe0d16ae931b73c59d7e0c089c0',\n  spn: 'cifs/server01.acme.local',\n});","handlingStrategy":"validation","validationCode":"if (!req.spn) {\n  throw new Error('a silver ticket needs the target SPN, e.g. cifs/server01.acme.local');\n}\nconst t = krb.CreateSilverTicket(req);","typeGuard":"function isValidSilverRequest(r) {\n  return r != null && typeof r.spn === 'string' && r.spn.length > 0 && /^[a-z0-9-]+\\//i.test(r.spn);\n}","tryCatchPattern":null,"preventionTips":["Remember the golden/silver split: golden needs no SPN, silver always does","Validate the spn key is present and non-empty before calling CreateSilverTicket","Use SPNs in service/class format like cifs/host or host/fqdn"],"tags":["kerberos","krbforge","silver-ticket","validation"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}