{"record":{"id":"f258b9ea96553e66","repo":"projectdiscovery/nuclei","slug":"invalid-asreproastrequest-w","errorCode":null,"errorMessage":"invalid ASRepRoastRequest: %w","messagePattern":"invalid ASRepRoastRequest: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbroast/krbroast.go","lineNumber":58,"sourceCode":"// @example\n// ```javascript\n// const krb = require('nuclei/krbroast');\n//\n//\tconst hash = krb.ASRepRoast({\n//\t  Username: 'svc_jenkins',\n//\t  Domain:   'acme.local',\n//\t  KDCHost:  'dc01.acme.local',\n//\t});\n//\n// log(hash);\n// ```\nfunc ASRepRoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {\n\tnj := utils.NewNucleiJS(vm)\n\tnj.ObjectSig = \"ASRepRoast(request)\"\n\n\tvar req ASRepRoastRequest\n\tif err := vm.ExportTo(call.Argument(0), &req); err != nil {\n\t\tnj.ThrowError(fmt.Errorf(\"invalid ASRepRoastRequest: %w\", err))\n\t}\n\tif req.Username == \"\" || req.Domain == \"\" || req.KDCHost == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"Username, Domain and KDCHost are required\")) //nolint\n\t}\n\n\texecID := nj.ExecutionId()\n\tif execID == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"krbroast: no executionId on goja runtime\"))\n\t}\n\tif !protocolstate.IsHostAllowed(execID, req.KDCHost) {\n\t\tnj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))\n\t}\n\n\thash, err := gpkrb.GetASREPWithDialer(dcerpc.NewExecDialer(execID), req.Username, req.Domain, req.KDCHost, req.Format)\n\tif err != nil {\n\t\tnj.ThrowError(err)\n\t}\n\treturn vm.ToValue(hash)","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbroast/krbroast.go#L40-L76","documentation":"Thrown by krbroast.ASRepRoast when goja's vm.ExportTo cannot convert call.Argument(0) into the ASRepRoastRequest struct. The argument must be a plain JS object; it fails on non-objects and on fields with incompatible types (all four fields, Username/Domain/KDCHost/Format, must be strings).","triggerScenarios":"krb.ASRepRoast('svc_jenkins') (string instead of object); krb.ASRepRoast({Username: 123, ...}) (numeric username); passing an array or the result of a JSON string that was never parsed.","commonSituations":"Chaining from a nuclei extractor that returns strings and assigning them to non-string fields; building the request from LDAP search entries whose values are arrays; copy-pasting a call from the Kerberoast example and mangling the shape.","solutions":["Pass a single object literal: krb.ASRepRoast({Username: 'svc_jenkins', Domain: 'acme.local', KDCHost: 'dc01.acme.local'})","Coerce every field to string with String(...) when values come from extractors or search entries","Unwrap array values from LDAP entries before use (entry.Username[0] style data)"],"exampleFix":"// before\nkrb.ASRepRoast('svc_jenkins', 'acme.local'); // wrong shape\n\n// after\nkrb.ASRepRoast({\n  Username: 'svc_jenkins',\n  Domain: 'acme.local',\n  KDCHost: 'dc01.acme.local',\n});","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"function isASRepRoastRequest(v) {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n    && ['Username','Domain','KDCHost'].every(k => typeof v[k] === 'string' && v[k] !== '')\n    && (!('Format' in v) || typeof v.Format === 'string');\n}\nif (!isASRepRoastRequest(req)) throw new Error('bad ASRepRoast request');","tryCatchPattern":"try {\n  const hash = krb.ASRepRoast(req);\n} catch (e) {\n  if (String(e).includes('invalid ASRepRoastRequest')) {\n    log('request shape invalid: ' + to_json(req));\n  }\n}","preventionTips":["Pass exactly one object argument with string fields","Unwrap LDAP entry array values and String()-coerce extractor output before building the object","Do not pass a JSON string; parse it first if that is the source"],"tags":["javascript","type-mismatch","krbroast","goja","validation","kerberos","active-directory"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}