sqlmapproject/sqlmap · error · KerberosError

KerberosError(code, _expString(errorFields[11]) if 11 in err

Error message

KerberosError(code, _expString(errorFields[11]) if 11 in errorFields else None)

What it means

Error "KerberosError(code, _expString(errorFields[11]) if 11 in errorFields else None)" thrown in sqlmapproject/sqlmap.

Source

Thrown at extra/kerberos/client.py:351

    # 1) probe without pre-auth to discover the etype/salt/iterations (or get the TGT outright)
    nonce = _nonce()
    response = _sendReceive(kdcHost, kdcPort, _asReq(realm, username, etypes, nonce))
    tag = der.peel(response)[0]

    if tag == der.applicationTag(AS_REP):                  # KDC issued the ticket without pre-auth
        etype = _replyEtype(response)                      # derive the key for the etype the KDC actually used
        rep = _fields(der.peel(der.peel(response)[1])[1])
        # the reply's own padata can still carry the salt/iterations of a non-default principal
        chosenSalt, iterations = _hintFor(_etypeHints(rep[2]) if 2 in rep else {}, etype, salt, chosenSalt)
        clientKey = _enctype(etype).string2key(password, chosenSalt, iterations)
        return _parseRep(response, clientKey, USAGE_AS_REP_ENCPART, nonce, AS_REP)

    etype, iterations = etypes[0], None
    if tag == der.applicationTag(KRB_ERROR):
        errorFields = _fields(der.peel(der.peel(response)[1])[1])
        code = _expInteger(errorFields[6]) if 6 in errorFields else -1
        if code != KDC_ERR_PREAUTH_REQUIRED:
            raise KerberosError(code, _expString(errorFields[11]) if 11 in errorFields else None)
        # the hint is unauthenticated, so it may only choose among the etypes we actually offered, and
        # in *our* order of preference rather than the KDC's (otherwise it could force a downgrade)
        hints = _preauthHints(errorFields)
        etype = _selectEtype(etypes, hints)
        chosenSalt, iterations = _hintFor(hints, etype, salt, chosenSalt)

    enc = _enctype(etype)
    clientKey = enc.string2key(password, chosenSalt, iterations)

    # 2) authenticated request with PA-ENC-TIMESTAMP under the discovered etype/salt
    patime, pausec = _timestamp()
    paTsEnc = der.sequence(der.tagged(0, der.generalizedTime(patime)), der.tagged(1, der.integer(pausec)))
    cipher = enc.encrypt(clientKey, USAGE_AS_REQ_PA_ENC_TIMESTAMP, paTsEnc)
    paData = der.sequence(
        der.tagged(1, der.integer(PA_ENC_TIMESTAMP)),
        der.tagged(2, der.octetString(_encryptedData(etype, cipher))),
    )
    nonce = _nonce()

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at extra/kerberos/client.py:351 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/4837ceb600866632. Report an issue: GitHub.