projectdiscovery/nuclei · error

no response data from KDC %s

Error message

no response data from KDC %s

What it means

The TCP exchange completed structurally but the declared body length was zero: the size header read fine, io.ReadFull of 0 bytes trivially succeeded, and the resulting response is empty. The library refuses to return an empty KDC response as if it were data.

Source

Thrown at pkg/js/libs/kerberos/sendtokdc.go:199

	_, err := conn.Write(b)
	if err != nil {
		return r, fmt.Errorf("error sending to KDC (%s): %v", conn.RemoteAddr().String(), err)
	}

	sh := make([]byte, 4)
	_, err = conn.Read(sh)
	if err != nil {
		return r, fmt.Errorf("error reading response size header: %v", err)
	}
	s := binary.BigEndian.Uint32(sh)

	rb := make([]byte, s)
	_, err = io.ReadFull(conn, rb)
	if err != nil {
		return r, fmt.Errorf("error reading response: %v", err)
	}
	if len(rb) < 1 {
		return r, fmt.Errorf("no response data from KDC %s", conn.RemoteAddr().String())
	}
	return rb, nil
}

// CheckKrbError checks if the response bytes from the KDC are a KRBError.
func CheckKrbError(b []byte) ([]byte, error) {
	var KRBErr messages.KRBError
	if err := KRBErr.Unmarshal(b); err == nil {
		return b, KRBErr
	}
	return b, nil
}

// TGStoHashcat converts a TGS to a hashcat format.
func TGStoHashcat(tgs messages.Ticket, username string) (string, error) {
	return fmt.Sprintf("$krb5tgs$%d$*%s$%s$%s*$%s$%s",
		tgs.EncPart.EType,
		username,

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Retry the exchange against another KDC for the realm
2. Verify with the UDP transport whether real Kerberos service exists on the host
3. Treat hosts that consistently return empty responses as non-Kerberos and skip them

try {
  const resp = kerberos.SendToKDC(client, msg);
} catch (e) {
  // zero-length TCP response from the KDC: treat host as non-Kerberos after a retry
}

When it happens

Trigger: A KDC or middlebox sending a 4-byte zero length header then closing; crafted servers that imitate the Kerberos framing; a race where the server acknowledges then abandons the connection.

Common situations: Honeypots and lab stubs mimicking port 88; DCs under fault conditions; load balancers answering with empty streams.

Related errors

• error reading response: %v
• error sending to a KDC: %s
• no response data from %s
• error sending to KDC (%s): %v
• error reading response size header: %v

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/a4906db8f399b37e. Report an issue: GitHub.