sqlmapproject/sqlmap · error · KerberosError

malformed KDC reply

Error message

malformed KDC reply

What it means

Error "malformed KDC reply" thrown in sqlmapproject/sqlmap.

Source

Thrown at extra/kerberos/client.py:229

        raise KerberosError(-1, "KDC advertised an out-of-policy string-to-key iteration count (%d)" % iterations)
    return iterations

def _hintFor(hints, etype, salt, chosenSalt):
    """Apply the hint for 'etype': its salt (unless the caller pinned one) and its work factor."""

    advertisedSalt, iterations = hints.get(etype, (None, None))
    if salt is None and advertisedSalt is not None:
        chosenSalt = advertisedSalt
    return chosenSalt, _validatedIterations(iterations)

def _replyEtype(response):
    """Return the etype of a KDC-REP's enc-part (which etype the KDC used for the client's key)."""

    try:
        rep = _fields(der.peel(der.peel(response)[1])[1])
        return _expInteger(_expFields(rep[6])[0])
    except (KeyError, IndexError, ValueError, struct.error):
        raise KerberosError(-1, "malformed KDC reply")

def _parseRep(response, key, usage, expectedNonce, expectedType):
    """Parse an AS-REP / TGS-REP: decrypt its enc-part with 'key' under 'usage', returning the
    opaque ticket and the freshly issued session key. The two replies are structurally identical.
    The reply's application tag MUST match the expected message type, and the nonce carried in the
    (integrity-protected) enc-part MUST equal the request nonce (RFC 4120)."""

    try:                                                   # any structural defect in a hostile/truncated reply -> KerberosError
        tag, repContent = _raiseIfError(response)
        if tag != der.applicationTag(expectedType):
            raise KerberosError(-1, "unexpected reply message type (tag 0x%02x)" % tag)
        rep = _fields(der.peel(repContent)[1])
        encData = _expFields(rep[6])                        # enc-part (EncryptedData)
        repEtype = _expInteger(encData[0])
        try:
            encRepPart = _enctype(repEtype).decrypt(key, usage, _expOctet(encData[2]))
        except ValueError:                                 # HMAC mismatch -> we hold the wrong long-term key
            raise KerberosError(-1, "reply decryption failed (wrong password or salt)")

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at extra/kerberos/client.py:229 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/3e98e500429bbd90. Report an issue: GitHub.