projectdiscovery/nuclei · error

Username, Domain and KDCHost are required

Error message

Username, Domain and KDCHost are required

What it means

Thrown by krbroast.ASRepRoast when one of Username, Domain or KDCHost is the empty string after export. Beyond genuinely missing values, the classic cause is key-casing: goja populates struct fields by (case-insensitive) Go field name, so the snake_case JSON tag 'kdc_host' does NOT match field KDCHost and the field silently stays empty.

Source

Thrown at pkg/js/libs/krbroast/krbroast.go:61

//
//	const hash = krb.ASRepRoast({
//	  Username: 'svc_jenkins',
//	  Domain:   'acme.local',
//	  KDCHost:  'dc01.acme.local',
//	});
//
// log(hash);
// ```
func ASRepRoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {
	nj := utils.NewNucleiJS(vm)
	nj.ObjectSig = "ASRepRoast(request)"

	var req ASRepRoastRequest
	if err := vm.ExportTo(call.Argument(0), &req); err != nil {
		nj.ThrowError(fmt.Errorf("invalid ASRepRoastRequest: %w", err))
	}
	if req.Username == "" || req.Domain == "" || req.KDCHost == "" {
		nj.ThrowError(fmt.Errorf("Username, Domain and KDCHost are required")) //nolint
	}

	execID := nj.ExecutionId()
	if execID == "" {
		nj.ThrowError(fmt.Errorf("krbroast: no executionId on goja runtime"))
	}
	if !protocolstate.IsHostAllowed(execID, req.KDCHost) {
		nj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))
	}

	hash, err := gpkrb.GetASREPWithDialer(dcerpc.NewExecDialer(execID), req.Username, req.Domain, req.KDCHost, req.Format)
	if err != nil {
		nj.ThrowError(err)
	}
	return vm.ToValue(hash)
}

// KerberoastRequest configures a Kerberoast attempt.

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Use the exact documented keys: Username, Domain, KDCHost (PascalCase matching the struct field names in the @example blocks)
2. Ensure every value is a non-empty string; log the request object before calling when debugging
3. Default Format is fine to omit; only the three identity fields are mandatory

Example fix

// before (kdc_host ignored -> KDCHost empty -> error)
krb.ASRepRoast({username: 'svc_jenkins', domain: 'acme.local', kdc_host: 'dc01.acme.local'});

// after
krb.ASRepRoast({Username: 'svc_jenkins', Domain: 'acme.local', KDCHost: 'dc01.acme.local'});

// use the exact field names goja maps (case-insensitive Go field names)
const req = {
  Username: String(user),
  Domain: String(domain),
  KDCHost: String(kdc),
};
if (!req.Username || !req.Domain || !req.KDCHost) {
  throw new Error('ASRepRoast: username, domain and KDC host are all required');
}

const hasRequiredFields = (r) =>
  typeof r.Username === 'string' && r.Username !== '' &&
  typeof r.Domain === 'string' && r.Domain !== '' &&
  typeof r.KDCHost === 'string' && r.KDCHost !== '';

When it happens

Trigger: krb.ASRepRoast({username: 'u', domain: 'd', kdc_host: 'dc01'}) — kdc_host is ignored (underscore differs from KDCHost even case-insensitively) so KDCHost=='' triggers the error; also any of the three fields set to '' or left out entirely.

Common situations: Authors writing snake_case keys because the struct's json tags suggest them; values taken from template variables ({{domain}}) that are empty when the template runs; misreading the doc example and dropping a field.

Related errors

• Username, Domain, KDCHost and SPN are required
• invalid ASRepRoastRequest: %w
• invalid KerberoastRequest: %w
• either Password or NTHash must be supplied
• invalid TicketRequest: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/cae894548c7fe86c. Report an issue: GitHub.