{"record":{"id":"c58535b483af3cce","repo":"projectdiscovery/nuclei","slug":"username-domain-kdchost-and-spn-are-required","errorCode":null,"errorMessage":"Username, Domain, KDCHost and SPN are required","messagePattern":"Username, Domain, KDCHost and SPN are required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbroast/krbroast.go","lineNumber":135,"sourceCode":"//\t  Password:   'P@ss',\n//\t  Domain:     'acme.local',\n//\t  KDCHost:    'dc01.acme.local',\n//\t  SPN:        'MSSQLSvc/sql01.acme.local:1433',\n//\t  TargetUser: 'svc_sql',\n//\t});\n//\n// log(r.Hash);\n// ```\nfunc Kerberoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {\n\tnj := utils.NewNucleiJS(vm)\n\tnj.ObjectSig = \"Kerberoast(request)\"\n\n\tvar req KerberoastRequest\n\tif err := vm.ExportTo(call.Argument(0), &req); err != nil {\n\t\tnj.ThrowError(fmt.Errorf(\"invalid KerberoastRequest: %w\", err))\n\t}\n\tif req.Username == \"\" || req.Domain == \"\" || req.KDCHost == \"\" || req.SPN == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"Username, Domain, KDCHost and SPN are required\")) //nolint\n\t}\n\tif req.Password == \"\" && req.NTHash == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"either Password or NTHash must be supplied\"))\n\t}\n\n\texecID := nj.ExecutionId()\n\tif execID == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"krbroast: no executionId on goja runtime\"))\n\t}\n\tif !protocolstate.IsHostAllowed(execID, req.KDCHost) {\n\t\tnj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))\n\t}\n\n\ttarget := req.TargetUser\n\tif target == \"\" {\n\t\ttarget = req.Username\n\t}\n\tres, err := gpkrb.GetTGSWithOptions(gpkrb.TGSOptions{","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbroast/krbroast.go#L117-L153","documentation":"Thrown by krbroast.Kerberoast when Username, Domain, KDCHost or SPN is empty after export. As with ASRepRoast, the most common cause is not a missing value but a mismatched key: goja maps by Go field name (case-insensitive), so 'kdc_host' or 'spn' style snake_case JSON-tag keys do not populate KDCHost/SPN.","triggerScenarios":"krb.Kerberoast({Username:..., Domain:..., kdc_host:..., SPN:...}) where kdc_host is ignored and KDCHost stays ''; any of the four fields set from a template variable that rendered empty; SPN built from an empty extractor output.","commonSituations":"Templates generating the SPN dynamically (service class + host + port) where one component is empty; values copied from LDAP entries with unwrapped arrays; authors following the struct's json tags instead of the doc example keys.","solutions":["Use the exact PascalCase keys from the docs: Username, Domain, KDCHost, SPN","Verify all four values are non-empty strings before the call (log or assert when authoring)","When composing SPN from parts, guard each part and skip/fail fast with a clear template message"],"exampleFix":"// before\nkrb.Kerberoast({Username: 'u', Password: 'p', Domain: 'd', kdc_host: 'dc01', SPN: 'cifs/web01'}); // kdc_host ignored\n\n// after\nkrb.Kerberoast({Username: 'u', Password: 'p', Domain: 'd', KDCHost: 'dc01', SPN: 'cifs/web01'});","handlingStrategy":"validation","validationCode":"const req = {\n  Username: String(u),\n  Domain: String(d),\n  KDCHost: String(kdc),\n  SPN: String(spnClass + '/' + host + ':' + port),\n};\nif ([req.Username, req.Domain, req.KDCHost, req.SPN].some(s => !s)) {\n  throw new Error('Kerberoast: Username, Domain, KDCHost and SPN all required');\n}","typeGuard":"const hasKerberoastRequired = (r) =>\n  ['Username','Domain','KDCHost','SPN'].every(k => typeof r[k] === 'string' && r[k] !== '');","tryCatchPattern":null,"preventionTips":["Use PascalCase keys matching the docs; kdc_host/spn snake_case keys are silently dropped","Guard each SPN component when composing it dynamically","Assert non-empty template variables before the call"],"tags":["javascript","krbroast","validation","field-mapping","kerberos","active-directory"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}