projectdiscovery/nuclei · error

invalid objectSid type: %T

Error message

invalid objectSid type: %T

What it means

Thrown by ldap.Client.GetADDomainSID when a returned entry does contain an objectSid attribute but its Go value is not []string, which is the type go-ldap normally produces for attributes. It indicates the server (or an intermediary/controls path) returned the SID in an unexpected representation, so DecodeSID cannot be applied.

Source

Thrown at pkg/js/libs/ldap/adenum.go:254

}

// GetADDomainSID returns the SID of the AD domain
// @example
// ```javascript
// const ldap = require('nuclei/ldap');
// const client = new ldap.Client('ldap://ldap.example.com', 'acme.com');
// const domainSID = client.GetADDomainSID();
// log(domainSID);
// ```
func (c *Client) GetADDomainSID() string {
	r := c.Search(FilterServerTrustAccount, "objectSid")
	c.nj.Require(len(r.Entries) > 0, "no result from GetADDomainSID query")
	for _, entry := range r.Entries {
		if sid, ok := entry.Attributes.Extra["objectSid"]; ok {
			if sid, ok := sid.([]string); ok {
				return DecodeSID(sid[0])
			} else {
				c.nj.HandleError(fmt.Errorf("invalid objectSid type: %T", entry.Attributes.Extra["objectSid"]), "invalid objectSid type")
			}
		}
	}
	c.nj.HandleError(fmt.Errorf("no objectSid found"), "no objectSid found")
	return ""
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Inspect the raw values first: run client.Search(FilterServerTrustAccount-like filter, 'objectSid') and log typeof entry.Attributes.Extra['objectSid'] to see what the server actually returns
2. If the value is a string/hex form, decode it manually (SID from hex/decimal string) instead of using GetADDomainSID
3. Point the template at a real Active Directory domain controller and retry
4. Wrap the call in try/catch and treat failure as 'target not standard AD'

try {
  const sid = client.GetADDomainSID();
} catch (e) {
  if (String(e).includes('invalid objectSid type')) {
    // non-standard attribute encoding: fetch raw and decode manually
    const r = client.Search('(userAccountControl:1.2.840.113556.1.4.803:=8192)', 'objectSid');
    // inspect r.Entries[0].Attributes.Extra['objectSid'] and decode per its actual type
  }
}

When it happens

Trigger: Calling GetADDomainSID against a directory whose objectSid comes back as a single string or raw bytes instead of the normal string slice; unusual LDAP proxies or rewritten attribute payloads between client and server.

Common situations: Non-Active-Directory directories or AD-Lite emulations that answer the server-trust-account filter but format objectSid differently; essentially never seen against a genuine AD over the stock go-ldap path.

Related errors

• no objectSid found
• invalid ASRepRoastRequest: %w
• Username, Domain and KDCHost are required
• invalid KerberoastRequest: %w
• Username, Domain, KDCHost and SPN are required

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/ba843d14dc705170. Report an issue: GitHub.