projectdiscovery/nuclei · error

either Password or NTHash must be supplied

Error message

either Password or NTHash must be supplied

What it means

Thrown by krbroast.Kerberoast when both Password and NTHash are empty. Kerberoasting requires valid domain credentials to obtain a TGS, unlike AS-REP roasting which needs none; the library enforces that at least one authenticator is supplied.

Source

Thrown at pkg/js/libs/krbroast/krbroast.go:138

//	  SPN:        'MSSQLSvc/sql01.acme.local:1433',
//	  TargetUser: 'svc_sql',
//	});
//
// log(r.Hash);
// ```
func Kerberoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {
	nj := utils.NewNucleiJS(vm)
	nj.ObjectSig = "Kerberoast(request)"

	var req KerberoastRequest
	if err := vm.ExportTo(call.Argument(0), &req); err != nil {
		nj.ThrowError(fmt.Errorf("invalid KerberoastRequest: %w", err))
	}
	if req.Username == "" || req.Domain == "" || req.KDCHost == "" || req.SPN == "" {
		nj.ThrowError(fmt.Errorf("Username, Domain, KDCHost and SPN are required")) //nolint
	}
	if req.Password == "" && req.NTHash == "" {
		nj.ThrowError(fmt.Errorf("either Password or NTHash must be supplied"))
	}

	execID := nj.ExecutionId()
	if execID == "" {
		nj.ThrowError(fmt.Errorf("krbroast: no executionId on goja runtime"))
	}
	if !protocolstate.IsHostAllowed(execID, req.KDCHost) {
		nj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))
	}

	target := req.TargetUser
	if target == "" {
		target = req.Username
	}
	res, err := gpkrb.GetTGSWithOptions(gpkrb.TGSOptions{
		Username:   req.Username,
		Password:   req.Password,
		NTHash:     req.NTHash,

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Supply either Password: '...' or NTHash: '...' (NT hash hex, e.g. from secretsdump) in the request object
2. If only a hash is available, pass NTHash and omit Password (they are alternatives, not both required)
3. Double-check the key spelling and that the credential variable is non-empty before calling

Example fix

// before
krb.Kerberoast({Username: 'u', Domain: 'd', KDCHost: 'dc01', SPN: 'cifs/web01'}); // no creds

// after
krb.Kerberoast({Username: 'u', NTHash: '31d6cfe0d16ae931b73c59d7e0c089c0', Domain: 'd', KDCHost: 'dc01', SPN: 'cifs/web01'});

const req = { Username, Domain, KDCHost, SPN };
if (Password) req.Password = String(Password);
else if (NTHash) req.NTHash = String(NTHash);
else throw new Error('Kerberoast: supply Password or NTHash');
const r = krb.Kerberoast(req);

const hasCredentials = (r) =>
  (typeof r.Password === 'string' && r.Password !== '') ||
  (typeof r.NTHash === 'string' && r.NTHash !== '');

When it happens

Trigger: krb.Kerberoast({Username, Domain, KDCHost, SPN}) with no Password and no NTHash; credentials passed under a misspelled or snake_case key that failed to map (e.g. password vs Password is fine case-insensitively, but a typo like Passwrd leaves it empty).

Common situations: Reusing an ASRepRoast-style call shape (which needs no creds) for Kerberoast; hash value present in the template data but attached to the wrong key; empty credential variables at runtime.

Related errors

• invalid ASRepRoastRequest: %w
• Username, Domain and KDCHost are required
• invalid KerberoastRequest: %w
• Username, Domain, KDCHost and SPN are required
• invalid TicketRequest: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/2ebcd2611eb2127c. Report an issue: GitHub.