projectdiscovery/nuclei · error

invalid ASRepRoastRequest: %w

Error message

invalid ASRepRoastRequest: %w

What it means

Thrown by krbroast.ASRepRoast when goja's vm.ExportTo cannot convert call.Argument(0) into the ASRepRoastRequest struct. The argument must be a plain JS object; it fails on non-objects and on fields with incompatible types (all four fields, Username/Domain/KDCHost/Format, must be strings).

Source

Thrown at pkg/js/libs/krbroast/krbroast.go:58

// @example
// ```javascript
// const krb = require('nuclei/krbroast');
//
//	const hash = krb.ASRepRoast({
//	  Username: 'svc_jenkins',
//	  Domain:   'acme.local',
//	  KDCHost:  'dc01.acme.local',
//	});
//
// log(hash);
// ```
func ASRepRoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {
	nj := utils.NewNucleiJS(vm)
	nj.ObjectSig = "ASRepRoast(request)"

	var req ASRepRoastRequest
	if err := vm.ExportTo(call.Argument(0), &req); err != nil {
		nj.ThrowError(fmt.Errorf("invalid ASRepRoastRequest: %w", err))
	}
	if req.Username == "" || req.Domain == "" || req.KDCHost == "" {
		nj.ThrowError(fmt.Errorf("Username, Domain and KDCHost are required")) //nolint
	}

	execID := nj.ExecutionId()
	if execID == "" {
		nj.ThrowError(fmt.Errorf("krbroast: no executionId on goja runtime"))
	}
	if !protocolstate.IsHostAllowed(execID, req.KDCHost) {
		nj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))
	}

	hash, err := gpkrb.GetASREPWithDialer(dcerpc.NewExecDialer(execID), req.Username, req.Domain, req.KDCHost, req.Format)
	if err != nil {
		nj.ThrowError(err)
	}
	return vm.ToValue(hash)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Pass a single object literal: krb.ASRepRoast({Username: 'svc_jenkins', Domain: 'acme.local', KDCHost: 'dc01.acme.local'})
2. Coerce every field to string with String(...) when values come from extractors or search entries
3. Unwrap array values from LDAP entries before use (entry.Username[0] style data)

Example fix

// before
krb.ASRepRoast('svc_jenkins', 'acme.local'); // wrong shape

// after
krb.ASRepRoast({
  Username: 'svc_jenkins',
  Domain: 'acme.local',
  KDCHost: 'dc01.acme.local',
});

function isASRepRoastRequest(v) {
  return typeof v === 'object' && v !== null && !Array.isArray(v)
    && ['Username','Domain','KDCHost'].every(k => typeof v[k] === 'string' && v[k] !== '')
    && (!('Format' in v) || typeof v.Format === 'string');
}
if (!isASRepRoastRequest(req)) throw new Error('bad ASRepRoast request');

try {
  const hash = krb.ASRepRoast(req);
} catch (e) {
  if (String(e).includes('invalid ASRepRoastRequest')) {
    log('request shape invalid: ' + to_json(req));
  }
}

When it happens

Trigger: krb.ASRepRoast('svc_jenkins') (string instead of object); krb.ASRepRoast({Username: 123, ...}) (numeric username); passing an array or the result of a JSON string that was never parsed.

Common situations: Chaining from a nuclei extractor that returns strings and assigning them to non-string fields; building the request from LDAP search entries whose values are arrays; copy-pasting a call from the Kerberoast example and mangling the shape.

Related errors

• invalid KerberoastRequest: %w
• invalid TicketRequest: %w
• Username, Domain and KDCHost are required
• Username, Domain, KDCHost and SPN are required
• either Password or NTHash must be supplied

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/f258b9ea96553e66. Report an issue: GitHub.