sqlmapproject/sqlmap · error · KerberosError

KDC advertised an out-of-policy string-to-key iteration…

Error message

KDC advertised an out-of-policy string-to-key iteration count (%d)

What it means

_validatedIterations rejects a string-to-key iteration count advertised by the KDC (via pre-auth e-data) because it falls outside local policy. The hint is unauthenticated, so an implausibly low count could make key derivation cheap for an attacker and an absurdly high one a DoS; the guard refuses both and the caller aborts.

Solutions

1. Check whether the KDC's configured etype iteration count matches your local policy bounds and align one side.
2. If policy changed legitimately, update the accepted min/max iteration bounds in the client.
3. Pin the salt/iterations explicitly so the unauthenticated hint is ignored.
4. Verify you are talking to the real KDC (spoofed hints are a known attack vector).

When it happens

Trigger: Thrown at extra/kerberos/client.py:211 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/60299452b1e04786. Report an issue: GitHub.

Appendix: source

Thrown at extra/kerberos/client.py:211

    return hints

def _preauthHints(errorFields):
    """The etype hints carried by a KDC_ERR_PREAUTH_REQUIRED error's e-data (best effort)."""

    if 12 not in errorFields:                              # no e-data
        return {}
    try:
        return _etypeHints(der.peel(errorFields[12])[1])   # e-data OCTET STRING -> METHOD-DATA
    except (KeyError, IndexError, ValueError, struct.error):
        return {}

def _validatedIterations(iterations):
    """Refuse a string-to-key work factor outside local policy. The hint is unauthenticated, so a
    spoofed count could either cheapen an offline attack on the PA-ENC-TIMESTAMP we are about to send
    or stall the scan for hours; failing loudly beats doing either silently."""

    if iterations is not None and not MIN_PBKDF2_ITERATIONS <= iterations <= MAX_PBKDF2_ITERATIONS:
        raise KerberosError(-1, "KDC advertised an out-of-policy string-to-key iteration count (%d)" % iterations)
    return iterations

def _hintFor(hints, etype, salt, chosenSalt):
    """Apply the hint for 'etype': its salt (unless the caller pinned one) and its work factor."""

    advertisedSalt, iterations = hints.get(etype, (None, None))
    if salt is None and advertisedSalt is not None:
        chosenSalt = advertisedSalt
    return chosenSalt, _validatedIterations(iterations)

def _replyEtype(response):
    """Return the etype of a KDC-REP's enc-part (which etype the KDC used for the client's key)."""

    try:
        rep = _fields(der.peel(der.peel(response)[1])[1])
        return _expInteger(_expFields(rep[6])[0])
    except (KeyError, IndexError, ValueError, struct.error):
        raise KerberosError(-1, "malformed KDC reply")

View on GitHub (pinned to 0a35b20e39)