{"record":{"id":"d0c1241ea5bb1b01","repo":"projectdiscovery/nuclei","slug":"kerberos-client-is-not-initialized","errorCode":null,"errorMessage":"kerberos client is not initialized","messagePattern":"kerberos client is not initialized","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/kerberos/sendtokdc.go","lineNumber":31,"sourceCode":"\t\"strings\"\n\t\"time\"\n\n\t\"github.com/jcmturner/gokrb5/v8/messages\"\n\t\"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolstate\"\n)\n\n// sendtokdc.go deals with actual sending and receiving responses from KDC\n// SendToKDC sends a message to the KDC and returns the response.\n// It first tries to send the message over TCP, and if that fails, it falls back to UDP.(and vice versa)\n// @example\n// ```javascript\n// const kerberos = require('nuclei/kerberos');\n// const client = new kerberos.Client('acme.com');\n// const response = kerberos.SendToKDC(client, 'message');\n// ```\nfunc SendToKDC(kclient *Client, msg string) (string, error) {\n\tif kclient == nil || kclient.nj == nil || kclient.Krb5Config == nil || kclient.Realm == \"\" {\n\t\treturn \"\", fmt.Errorf(\"kerberos client is not initialized\")\n\t}\n\tif kclient.config.timeout == 0 {\n\t\tkclient.config.timeout = 5 // default timeout 5 seconds\n\t}\n\tvar response []byte\n\tvar err error\n\n\tresponse, err = sendToKDCTcp(kclient, msg)\n\tif err == nil {\n\t\t// if it related to tcp\n\t\tbin, err := CheckKrbError(response)\n\t\tif err == nil {\n\t\t\treturn string(bin), nil\n\t\t}\n\t\t// if it is krb error no need to do udp\n\t\tif e, ok := err.(messages.KRBError); ok {\n\t\t\treturn string(response), e\n\t\t}","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/kerberos/sendtokdc.go#L13-L49","documentation":"kerberos.SendToKDC requires a fully constructed Client: a non-nil goja runtime hook (nj), a parsed Krb5Config, and a non-empty Realm. The guard fails when the client is nil or any internal field is unset, which in practice means the Client was not created through new kerberos.Client(domain) inside a nuclei JavaScript execution.","triggerScenarios":"kerberos.SendToKDC(null, msg); creating the client with an empty domain string so Realm stays empty; passing a plain JS object or re-hydrated JSON instead of a constructor-built Client; calling SendToKDC before the constructor finished initialization.","commonSituations":"Templates that deserialize a saved client state; refactoring that inlines the send call and drops the constructor; passing the domain with a trailing dot or '@' format the constructor does not normalize.","solutions":["Create the client first: const client = new kerberos.Client('acme.com'); then call kerberos.SendToKDC(client, msg)","Pass a non-empty, plain domain (FQDN) so the Realm resolves during construction","Never rebuild the Client from plain data; always go through the constructor so Krb5Config and runtime hooks initialize"],"exampleFix":"// before\nconst resp = kerberos.SendToKDC(client, msg); // client was a plain object or undefined\n\n// after\nconst client = new kerberos.Client('acme.com');\nconst resp = kerberos.SendToKDC(client, msg);","handlingStrategy":"validation","validationCode":"const kerberos = require('nuclei/kerberos');\nconst domain = 'acme.com';\nif (!domain) throw new Error('domain is required');\nconst client = new kerberos.Client(domain);\nconst resp = kerberos.SendToKDC(client, msg);","typeGuard":"function isKerberosClient(c) {\n  return c instanceof require('nuclei/kerberos').Client;\n}","tryCatchPattern":null,"preventionTips":["Construct the Client once with a non-empty FQDN domain right before use","Never pass a plain object or re-hydrated JSON where a Client is expected"],"tags":["kerberos","initialization","javascript"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}