{"record":{"id":"fedb87880f581ff1","repo":"projectdiscovery/nuclei","slug":"error-sending-to-kdc-s-v","errorCode":null,"errorMessage":"error sending to KDC (%s): %v","messagePattern":"error sending to KDC \\((.+?)\\): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/kerberos/sendtokdc.go","lineNumber":183,"sourceCode":"\t\treturn r, fmt.Errorf(\"no response data from %s\", conn.RemoteAddr().String())\n\t}\n\treturn r, nil\n}\n\n// sendTCP sends bytes to connection over TCP.\nfunc sendTCP(conn *net.TCPConn, b []byte) ([]byte, error) {\n\tdefer func() {\n\t\t_ = conn.Close()\n\t}()\n\tvar r []byte\n\t// RFC 4120 7.2.2 specifies the first 4 bytes indicate the length of the message in big endian order.\n\thb := make([]byte, 4)\n\tbinary.BigEndian.PutUint32(hb, uint32(len(b)))\n\tb = append(hb, b...)\n\n\t_, err := conn.Write(b)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error sending to KDC (%s): %v\", conn.RemoteAddr().String(), err)\n\t}\n\n\tsh := make([]byte, 4)\n\t_, err = conn.Read(sh)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error reading response size header: %v\", err)\n\t}\n\ts := binary.BigEndian.Uint32(sh)\n\n\trb := make([]byte, s)\n\t_, err = io.ReadFull(conn, rb)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error reading response: %v\", err)\n\t}\n\tif len(rb) < 1 {\n\t\treturn r, fmt.Errorf(\"no response data from KDC %s\", conn.RemoteAddr().String())\n\t}\n\treturn rb, nil","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/kerberos/sendtokdc.go#L165-L201","documentation":"The innermost TCP send in sendTCP failed at conn.Write: after dialing a KDC successfully, writing the length-prefixed message (RFC 4120 7.2.2 4-byte big-endian length plus body) failed. The remote address is included in the message. The error propagates into the per-KDC list aggregated by sendToKDCTcp.","triggerScenarios":"The KDC reset the connection immediately after accept (some drop malformed AS-REQ/TGS-REQ this way); a middlebox RST-ing the flow; the connection torn down between dial and write.","commonSituations":"IDS/IPS sending resets for Kerberos traffic; KDCs that close connections from untrusted sources; race between dialer pool reuse and server-side timeouts.","solutions":["Verify the outgoing message is a correctly encoded Kerberos PDU","Check whether a security device is resetting TCP/88 flows","Retry; a fresh dial often succeeds after a transient reset"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const resp = kerberos.SendToKDC(client, msg);\n} catch (e) {\n  // TCP write to the KDC in the message failed: check for RST-injecting middleboxes and message encoding\n}","preventionTips":["Validate the Kerberos PDU encoding before sending","Watch for IPS devices resetting TCP/88 flows"],"tags":["kerberos","tcp","network"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}