projectdiscovery/nuclei · error

no objectSid found

Error message

no objectSid found

What it means

Thrown by ldap.Client.GetADDomainSID when the server-trust-account search returned entries but none carried a readable objectSid attribute. The preceding Require already guarantees at least one entry, so reaching this point means the attribute itself is absent or filtered out, most often because the bind identity lacks permission to read it.

Source

Thrown at pkg/js/libs/ldap/adenum.go:258

// ```javascript
// const ldap = require('nuclei/ldap');
// const client = new ldap.Client('ldap://ldap.example.com', 'acme.com');
// const domainSID = client.GetADDomainSID();
// log(domainSID);
// ```
func (c *Client) GetADDomainSID() string {
	r := c.Search(FilterServerTrustAccount, "objectSid")
	c.nj.Require(len(r.Entries) > 0, "no result from GetADDomainSID query")
	for _, entry := range r.Entries {
		if sid, ok := entry.Attributes.Extra["objectSid"]; ok {
			if sid, ok := sid.([]string); ok {
				return DecodeSID(sid[0])
			} else {
				c.nj.HandleError(fmt.Errorf("invalid objectSid type: %T", entry.Attributes.Extra["objectSid"]), "invalid objectSid type")
			}
		}
	}
	c.nj.HandleError(fmt.Errorf("no objectSid found"), "no objectSid found")
	return ""
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Authenticate with real credentials before enumerating: client.Authenticate('user', 'password') or AuthenticateWithNTLMHash
2. Confirm the target is an Active Directory domain controller, not a generic LDAP server
3. Verify with a manual Search for objectSid that the attribute is visible under the current bind
4. Catch the error in the template and mark the 'domain SID' step as unavailable

Example fix

// before
const c = new ldap.Client('ldap://dc01.acme.local', 'ACME');
const sid = c.GetADDomainSID(); // anonymous bind -> objectSid hidden

// after
const c = new ldap.Client('ldap://dc01.acme.local', 'ACME');
c.Authenticate('svc_scan', 'P@ssw0rd');
const sid = c.GetADDomainSID();

// ensure an authenticated bind before AD enumeration
const client = new ldap.Client('ldap://dc01.acme.local', 'ACME');
if (!client.Authenticate(user, pass)) throw new Error('ldap bind failed');
// objectSid is readable now
const sid = client.GetADDomainSID();

try {
  const sid = client.GetADDomainSID();
} catch (e) {
  if (String(e).includes('no objectSid found')) {
    // anonymous bind or non-AD target: skip domain-SID dependent steps
  }
}

When it happens

Trigger: Calling GetADDomainSID after an anonymous or UnauthenticatedBind against AD where ACLs hide objectSid from anonymous reads; searching a non-AD LDAP server that answers the filter but has no objectSid attribute at all.

Common situations: Templates that authenticate with an empty password (unauthenticated bind path) and then enumerate AD; pointing the ldap.Client at OpenLDAP instead of Active Directory.

Related errors

• invalid objectSid type: %T
• invalid ASRepRoastRequest: %w
• Username, Domain and KDCHost are required
• invalid KerberoastRequest: %w
• Username, Domain, KDCHost and SPN are required

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/5665db6980b6be53. Report an issue: GitHub.