{"record":{"id":"a4906db8f399b37e","repo":"projectdiscovery/nuclei","slug":"no-response-data-from-kdc-s","errorCode":null,"errorMessage":"no response data from KDC %s","messagePattern":"no response data from KDC (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/kerberos/sendtokdc.go","lineNumber":199,"sourceCode":"\t_, err := conn.Write(b)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error sending to KDC (%s): %v\", conn.RemoteAddr().String(), err)\n\t}\n\n\tsh := make([]byte, 4)\n\t_, err = conn.Read(sh)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error reading response size header: %v\", err)\n\t}\n\ts := binary.BigEndian.Uint32(sh)\n\n\trb := make([]byte, s)\n\t_, err = io.ReadFull(conn, rb)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error reading response: %v\", err)\n\t}\n\tif len(rb) < 1 {\n\t\treturn r, fmt.Errorf(\"no response data from KDC %s\", conn.RemoteAddr().String())\n\t}\n\treturn rb, nil\n}\n\n// CheckKrbError checks if the response bytes from the KDC are a KRBError.\nfunc CheckKrbError(b []byte) ([]byte, error) {\n\tvar KRBErr messages.KRBError\n\tif err := KRBErr.Unmarshal(b); err == nil {\n\t\treturn b, KRBErr\n\t}\n\treturn b, nil\n}\n\n// TGStoHashcat converts a TGS to a hashcat format.\nfunc TGStoHashcat(tgs messages.Ticket, username string) (string, error) {\n\treturn fmt.Sprintf(\"$krb5tgs$%d$*%s$%s$%s*$%s$%s\",\n\t\ttgs.EncPart.EType,\n\t\tusername,","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/kerberos/sendtokdc.go#L181-L217","documentation":"The TCP exchange completed structurally but the declared body length was zero: the size header read fine, io.ReadFull of 0 bytes trivially succeeded, and the resulting response is empty. The library refuses to return an empty KDC response as if it were data.","triggerScenarios":"A KDC or middlebox sending a 4-byte zero length header then closing; crafted servers that imitate the Kerberos framing; a race where the server acknowledges then abandons the connection.","commonSituations":"Honeypots and lab stubs mimicking port 88; DCs under fault conditions; load balancers answering with empty streams.","solutions":["Retry the exchange against another KDC for the realm","Verify with the UDP transport whether real Kerberos service exists on the host","Treat hosts that consistently return empty responses as non-Kerberos and skip them"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const resp = kerberos.SendToKDC(client, msg);\n} catch (e) {\n  // zero-length TCP response from the KDC: treat host as non-Kerberos after a retry\n}","preventionTips":["Treat repeated zero-length replies as a broken or fake KDC","Prefer KDC selection with multiple candidates so one bad DC does not end the probe"],"tags":["kerberos","tcp","protocol"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}