projectdiscovery/nuclei · error

error sending to a KDC: %s

Error message

error sending to a KDC: %s

What it means

sendToKDCTcp resolves every KDC for the realm (from krb5 config or DNS SRV), tries each over TCP, and collects a failure string per attempt. When none succeed it returns the joined list. This error is the aggregate TCP-side verdict; SendToKDC then attempts UDP as a fallback.

Source

Thrown at pkg/js/libs/kerberos/sendtokdc.go:101

		}
		tcpConn, err := dialers.Fastdialer.Dial(dialCtx, "tcp", net.JoinHostPort(host, port))
		if err != nil {
			errs = append(errs, fmt.Sprintf("error establishing connection to %s: %v", kdcs[i], err))
			continue
		}
		defer func() {
			_ = tcpConn.Close()
		}()
		_ = tcpConn.SetDeadline(time.Now().Add(time.Duration(kclient.config.timeout) * time.Second)) //read and write deadline
		rb, err := sendTCP(tcpConn.(*net.TCPConn), []byte(msg))
		if err != nil {
			errs = append(errs, fmt.Sprintf("error sending to %s: %v", kdcs[i], err))
			continue
		}
		return rb, nil
	}
	if len(errs) > 0 {
		return nil, fmt.Errorf("error sending to a KDC: %s", strings.Join(errs, "; "))
	}
	return nil, nil
}

// sendToKDCUdp sends a message to the KDC via UDP.
func sendToKDCUdp(kclient *Client, msg string) ([]byte, error) {
	_, kdcs, err := kclient.Krb5Config.GetKDCs(kclient.Realm, true)
	kclient.nj.HandleError(err, "error getting KDCs")
	kclient.nj.Require(len(kdcs) > 0, "no KDCs found")

	executionId := kclient.nj.ExecutionId()
	dialers := protocolstate.GetDialersWithId(executionId)
	if dialers == nil {
		return nil, fmt.Errorf("dialers not initialized for %s", executionId)
	}
	dialCtx := kclient.nj.Context()
	var errs []string
	for i := 1; i <= len(kdcs); i++ {

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Confirm the realm string matches the AD domain and that _kerberos._tcp.<REALM> SRV records resolve to live DCs
2. Allow outbound TCP/88 to the domain controllers
3. Let the automatic UDP fallback run; if UDP also fails, check firewalling of UDP/88
4. Raise the client timeout above the 5s default for remote or slow KDCs

try {
  const resp = kerberos.SendToKDC(client, msg);
} catch (e) {
  // all TCP KDC attempts failed; the library already tries UDP as fallback - check realm, DNS SRV records, and TCP/88 egress
}

When it happens

Trigger: Outbound TCP/88 blocked to every domain controller; a misspelled realm yielding unreachable SRV targets; every KDC behind a firewall that silently drops SYN packets so each dial times out; the 5s default deadline expiring on each attempt.

Common situations: Scanning Active Directory segments from networks without KDC reachability; stale DNS SRV records pointing at decommissioned DCs; egress-filtered container/CI environments; VPN split-tunnel setups missing the DC routes.

Related errors

• error sending to KDC (%s): %v
• error reading response size header: %v
• error reading response: %v
• dialers not initialized for %s
• error sending to (%s): %v

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/4f0213bd9f7773fa. Report an issue: GitHub.