{"record":{"id":"cae894548c7fe86c","repo":"projectdiscovery/nuclei","slug":"username-domain-and-kdchost-are-required","errorCode":null,"errorMessage":"Username, Domain and KDCHost are required","messagePattern":"Username, Domain and KDCHost are required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbroast/krbroast.go","lineNumber":61,"sourceCode":"//\n//\tconst hash = krb.ASRepRoast({\n//\t  Username: 'svc_jenkins',\n//\t  Domain:   'acme.local',\n//\t  KDCHost:  'dc01.acme.local',\n//\t});\n//\n// log(hash);\n// ```\nfunc ASRepRoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {\n\tnj := utils.NewNucleiJS(vm)\n\tnj.ObjectSig = \"ASRepRoast(request)\"\n\n\tvar req ASRepRoastRequest\n\tif err := vm.ExportTo(call.Argument(0), &req); err != nil {\n\t\tnj.ThrowError(fmt.Errorf(\"invalid ASRepRoastRequest: %w\", err))\n\t}\n\tif req.Username == \"\" || req.Domain == \"\" || req.KDCHost == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"Username, Domain and KDCHost are required\")) //nolint\n\t}\n\n\texecID := nj.ExecutionId()\n\tif execID == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"krbroast: no executionId on goja runtime\"))\n\t}\n\tif !protocolstate.IsHostAllowed(execID, req.KDCHost) {\n\t\tnj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))\n\t}\n\n\thash, err := gpkrb.GetASREPWithDialer(dcerpc.NewExecDialer(execID), req.Username, req.Domain, req.KDCHost, req.Format)\n\tif err != nil {\n\t\tnj.ThrowError(err)\n\t}\n\treturn vm.ToValue(hash)\n}\n\n// KerberoastRequest configures a Kerberoast attempt.","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbroast/krbroast.go#L43-L79","documentation":"Thrown by krbroast.ASRepRoast when one of Username, Domain or KDCHost is the empty string after export. Beyond genuinely missing values, the classic cause is key-casing: goja populates struct fields by (case-insensitive) Go field name, so the snake_case JSON tag 'kdc_host' does NOT match field KDCHost and the field silently stays empty.","triggerScenarios":"krb.ASRepRoast({username: 'u', domain: 'd', kdc_host: 'dc01'}) — kdc_host is ignored (underscore differs from KDCHost even case-insensitively) so KDCHost=='' triggers the error; also any of the three fields set to '' or left out entirely.","commonSituations":"Authors writing snake_case keys because the struct's json tags suggest them; values taken from template variables ({{domain}}) that are empty when the template runs; misreading the doc example and dropping a field.","solutions":["Use the exact documented keys: Username, Domain, KDCHost (PascalCase matching the struct field names in the @example blocks)","Ensure every value is a non-empty string; log the request object before calling when debugging","Default Format is fine to omit; only the three identity fields are mandatory"],"exampleFix":"// before (kdc_host ignored -> KDCHost empty -> error)\nkrb.ASRepRoast({username: 'svc_jenkins', domain: 'acme.local', kdc_host: 'dc01.acme.local'});\n\n// after\nkrb.ASRepRoast({Username: 'svc_jenkins', Domain: 'acme.local', KDCHost: 'dc01.acme.local'});","handlingStrategy":"validation","validationCode":"// use the exact field names goja maps (case-insensitive Go field names)\nconst req = {\n  Username: String(user),\n  Domain: String(domain),\n  KDCHost: String(kdc),\n};\nif (!req.Username || !req.Domain || !req.KDCHost) {\n  throw new Error('ASRepRoast: username, domain and KDC host are all required');\n}","typeGuard":"const hasRequiredFields = (r) =>\n  typeof r.Username === 'string' && r.Username !== '' &&\n  typeof r.Domain === 'string' && r.Domain !== '' &&\n  typeof r.KDCHost === 'string' && r.KDCHost !== '';","tryCatchPattern":null,"preventionTips":["Copy the key spelling from the lib's @example (Username/Domain/KDCHost), not from the struct's json tags","snake_case keys like kdc_host silently map to nothing and cause this error","Log the request object when a chained-enumeration template fails here"],"tags":["javascript","krbroast","validation","field-mapping","kerberos","active-directory"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}