{"record":{"id":"ba843d14dc705170","repo":"projectdiscovery/nuclei","slug":"invalid-objectsid-type-t","errorCode":null,"errorMessage":"invalid objectSid type: %T","messagePattern":"invalid objectSid type: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/ldap/adenum.go","lineNumber":254,"sourceCode":"}\n\n// GetADDomainSID returns the SID of the AD domain\n// @example\n// ```javascript\n// const ldap = require('nuclei/ldap');\n// const client = new ldap.Client('ldap://ldap.example.com', 'acme.com');\n// const domainSID = client.GetADDomainSID();\n// log(domainSID);\n// ```\nfunc (c *Client) GetADDomainSID() string {\n\tr := c.Search(FilterServerTrustAccount, \"objectSid\")\n\tc.nj.Require(len(r.Entries) > 0, \"no result from GetADDomainSID query\")\n\tfor _, entry := range r.Entries {\n\t\tif sid, ok := entry.Attributes.Extra[\"objectSid\"]; ok {\n\t\t\tif sid, ok := sid.([]string); ok {\n\t\t\t\treturn DecodeSID(sid[0])\n\t\t\t} else {\n\t\t\t\tc.nj.HandleError(fmt.Errorf(\"invalid objectSid type: %T\", entry.Attributes.Extra[\"objectSid\"]), \"invalid objectSid type\")\n\t\t\t}\n\t\t}\n\t}\n\tc.nj.HandleError(fmt.Errorf(\"no objectSid found\"), \"no objectSid found\")\n\treturn \"\"\n}\n","sourceCodeStart":236,"sourceCodeEnd":261,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/ldap/adenum.go#L236-L261","documentation":"Thrown by ldap.Client.GetADDomainSID when a returned entry does contain an objectSid attribute but its Go value is not []string, which is the type go-ldap normally produces for attributes. It indicates the server (or an intermediary/controls path) returned the SID in an unexpected representation, so DecodeSID cannot be applied.","triggerScenarios":"Calling GetADDomainSID against a directory whose objectSid comes back as a single string or raw bytes instead of the normal string slice; unusual LDAP proxies or rewritten attribute payloads between client and server.","commonSituations":"Non-Active-Directory directories or AD-Lite emulations that answer the server-trust-account filter but format objectSid differently; essentially never seen against a genuine AD over the stock go-ldap path.","solutions":["Inspect the raw values first: run client.Search(FilterServerTrustAccount-like filter, 'objectSid') and log typeof entry.Attributes.Extra['objectSid'] to see what the server actually returns","If the value is a string/hex form, decode it manually (SID from hex/decimal string) instead of using GetADDomainSID","Point the template at a real Active Directory domain controller and retry","Wrap the call in try/catch and treat failure as 'target not standard AD'"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const sid = client.GetADDomainSID();\n} catch (e) {\n  if (String(e).includes('invalid objectSid type')) {\n    // non-standard attribute encoding: fetch raw and decode manually\n    const r = client.Search('(userAccountControl:1.2.840.113556.1.4.803:=8192)', 'objectSid');\n    // inspect r.Entries[0].Attributes.Extra['objectSid'] and decode per its actual type\n  }\n}","preventionTips":["Target real Active Directory DCs for AD-specific enumeration helpers","Prefer authenticated binds so attributes come back in standard form","Treat odd objectSid encodings as a signal the endpoint is not stock AD"],"tags":["ldap","active-directory","data-format","javascript","adenum"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}