{"record":{"id":"fd972300b7d8e183","repo":"projectdiscovery/nuclei","slug":"invalid-kerberoastrequest-w","errorCode":null,"errorMessage":"invalid KerberoastRequest: %w","messagePattern":"invalid KerberoastRequest: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/krbroast/krbroast.go","lineNumber":132,"sourceCode":"//\n//\tconst r = krb.Kerberoast({\n//\t  Username:   'lowpriv',\n//\t  Password:   'P@ss',\n//\t  Domain:     'acme.local',\n//\t  KDCHost:    'dc01.acme.local',\n//\t  SPN:        'MSSQLSvc/sql01.acme.local:1433',\n//\t  TargetUser: 'svc_sql',\n//\t});\n//\n// log(r.Hash);\n// ```\nfunc Kerberoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {\n\tnj := utils.NewNucleiJS(vm)\n\tnj.ObjectSig = \"Kerberoast(request)\"\n\n\tvar req KerberoastRequest\n\tif err := vm.ExportTo(call.Argument(0), &req); err != nil {\n\t\tnj.ThrowError(fmt.Errorf(\"invalid KerberoastRequest: %w\", err))\n\t}\n\tif req.Username == \"\" || req.Domain == \"\" || req.KDCHost == \"\" || req.SPN == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"Username, Domain, KDCHost and SPN are required\")) //nolint\n\t}\n\tif req.Password == \"\" && req.NTHash == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"either Password or NTHash must be supplied\"))\n\t}\n\n\texecID := nj.ExecutionId()\n\tif execID == \"\" {\n\t\tnj.ThrowError(fmt.Errorf(\"krbroast: no executionId on goja runtime\"))\n\t}\n\tif !protocolstate.IsHostAllowed(execID, req.KDCHost) {\n\t\tnj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))\n\t}\n\n\ttarget := req.TargetUser\n\tif target == \"\" {","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/krbroast/krbroast.go#L114-L150","documentation":"Thrown by krbroast.Kerberoast when vm.ExportTo cannot convert call.Argument(0) into the KerberoastRequest struct. The single argument must be a plain object; it fails for non-object values and for fields whose JS types do not map onto the Go struct (all fields are strings).","triggerScenarios":"krb.Kerberoast('svc_sql') or passing a comma-separated argument list instead of one object; {Username: 123} numeric fields; passing an entry object from an LDAP search whose attribute values are arrays.","commonSituations":"Feeding values straight from nuclei/ldap GetADUserKerberoastable entries without unwrapping; using snake_case keys that silently map to empty (that fails later as error 267, not here); passing a JSON string that was not parsed.","solutions":["Pass one object literal with the documented fields: Username, Domain, KDCHost, SPN, Password (or NTHash), optionally TargetUser and Format","Coerce values with String(...) when they originate from extractors or LDAP entries","Unwrap array-valued attributes from search results before building the request"],"exampleFix":"// before\nkrb.Kerberoast('svc_sql', 'acme.local', 'dc01', 'MSSQLSvc/sql01:1433'); // wrong shape\n\n// after\nkrb.Kerberoast({\n  Username: 'user',\n  Password: 'pass',\n  Domain: 'acme.local',\n  KDCHost: 'dc01.acme.local',\n  SPN: 'MSSQLSvc/sql01.acme.local:1433',\n});","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"function isKerberoastRequest(v) {\n  return typeof v === 'object' && v !== null && !Array.isArray(v)\n    && ['Username','Domain','KDCHost','SPN'].every(k => typeof v[k] === 'string')\n    && (!('Password' in v) || typeof v.Password === 'string')\n    && (!('NTHash' in v) || typeof v.NTHash === 'string');\n}\nif (!isKerberoastRequest(req)) throw new Error('bad Kerberoast request');","tryCatchPattern":"try {\n  const r = krb.Kerberoast(req);\n} catch (e) {\n  if (String(e).includes('invalid KerberoastRequest')) {\n    log('request shape invalid: ' + to_json(req));\n  }\n}","preventionTips":["One object argument only; all fields strings","Unwrap arrays from LDAP entries (e.g. entry.sAMAccountName[0])","Validate the shape next to where you build it, not after the failure"],"tags":["javascript","type-mismatch","krbroast","goja","validation","kerberos","active-directory"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}