{"record":{"id":"8c9048d7f7303e49","repo":"projectdiscovery/nuclei","slug":"domain-controller-denied-by-network-policy","errorCode":null,"errorMessage":"domain controller denied by network policy","messagePattern":"domain controller denied by network policy","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/goexec/errors.go","lineNumber":17,"sourceCode":"package goexec\n\nimport \"errors\"\n\nvar (\n\tErrMissingAuth             = errors.New(\"goexec auth is required\")\n\tErrMissingUsername         = errors.New(\"goexec username is required for this auth mode\")\n\tErrMultipleCredentialModes = errors.New(\"goexec auth selects multiple primary credential modes\")\n\tErrMissingTarget           = errors.New(\"goexec target is required\")\n\tErrMissingCommand          = errors.New(\"goexec command is required\")\n\tErrMissingExecutable       = errors.New(\"goexec executable is required\")\n\tErrUnsupportedModule       = errors.New(\"unsupported goexec module\")\n\tErrUnsupportedMethod       = errors.New(\"unsupported goexec method\")\n\tErrUnsupportedOutputMethod = errors.New(\"unsupported goexec output method\")\n\tErrNetworkPolicyDenied     = errors.New(\"target denied by network policy\")\n\tErrInvalidMethodArguments  = errors.New(\"invalid goexec method arguments\")\n\tErrDomainControllerDenied  = errors.New(\"domain controller denied by network policy\")\n\tErrProxyDenied             = errors.New(\"proxy denied by network policy\")\n\tErrEndpointDenied          = errors.New(\"endpoint denied by network policy\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":21,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/goexec/errors.go#L1-L21","documentation":"Sentinel error from the goexec helper. When auth.domain_controller is set (e.g. for Kerberos-based auth), the adapter additionally policy-checks that controller host: if protocolstate.IsHostAllowed rejects it, the run stops with ErrDomainControllerDenied before any connection is made (adapter_goexec.go:41-43). It protects against a policy being bypassed by routing through the DC.","triggerScenarios":"A goexec request with auth: {domain-controller: 'dc.corp.local', ...} where dc.corp.local resolves to an IP not permitted by the configured network policy.","commonSituations":"Target host is allowed but the domain controller sits on a management subnet that the policy excludes; hardened CI policies that only allow the single target CIDR.","solutions":["Add the domain controller's IP/CIDR to the network policy allow list","Drop the domain-controller option if the selected auth mode does not require it","Pre-check the DC host with protocolstate.IsHostAllowed and fail early with a clear message"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if req.Auth.domainController != \"\" && !protocolstate.IsHostAllowed(executionID, targetHost(req.Auth.domainController)) {\n    return errors.New(\"domain controller blocked by network policy\")\n}","typeGuard":"func isDomainControllerDenied(err error) bool { return errors.Is(err, goexec.ErrDomainControllerDenied) }","tryCatchPattern":null,"preventionTips":["Policy-check the DC host once at scan start, not per request","Keep DCs in the policy allow list when Kerberos modes are used"],"tags":["goexec","network-policy","kerberos","active-directory"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}