sqlmapproject/sqlmap · error · KerberosError

reply nonce does not match the request (possible replay)

Error message

reply nonce does not match the request (possible replay)

What it means

_parseRep found that the nonce inside the successfully decrypted enc-part does not equal the nonce sent in the request. Because the enc-part is integrity-protected with the client key, a mismatch indicates a replayed or fabricated reply (or a client bug reusing nonce state), so the reply is rejected per RFC 4120.

Solutions

  1. Generate a fresh random nonce per request; never reuse or hardcode it.
  2. Check for request multiplexing bugs where replies are paired with the wrong request.
  3. Investigate possible man-in-the-middle/replay on the path to the KDC.
  4. If a proxy retries requests transparently, disable that and retry once.
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at extra/kerberos/client.py:252 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/c3ccbcdcde93d8a7. Report an issue: GitHub.

Appendix: source

Thrown at extra/kerberos/client.py:252

    The reply's application tag MUST match the expected message type, and the nonce carried in the
    (integrity-protected) enc-part MUST equal the request nonce (RFC 4120)."""

    try:                                                   # any structural defect in a hostile/truncated reply -> KerberosError
        tag, repContent = _raiseIfError(response)
        if tag != der.applicationTag(expectedType):
            raise KerberosError(-1, "unexpected reply message type (tag 0x%02x)" % tag)
        rep = _fields(der.peel(repContent)[1])
        encData = _expFields(rep[6])                        # enc-part (EncryptedData)
        repEtype = _expInteger(encData[0])
        try:
            encRepPart = _enctype(repEtype).decrypt(key, usage, _expOctet(encData[2]))
        except ValueError:                                 # HMAC mismatch -> we hold the wrong long-term key
            raise KerberosError(-1, "reply decryption failed (wrong password or salt)")

        # Enc*RepPart = [APPLICATION 25/26] EncKDCRepPart ; key is field [0], nonce is field [2]
        encKdcRep = _fields(der.peel(der.peel(encRepPart)[1])[1])
        if _expInteger(encKdcRep[2]) != expectedNonce:
            raise KerberosError(-1, "reply nonce does not match the request (possible replay)")
        keyFields = _expFields(encKdcRep[0])

        return {
            "ticket": bytes(rep[5]),
            "sessionKey": _expOctet(keyFields[1]),
            "sessionKeyType": _expInteger(keyFields[0]),
            "etype": repEtype,
            "crealm": _expString(rep[3]),
            # EncKDCRepPart endtime [7]; a scan can outlive the ticket, so the caller can re-fetch
            "endtime": _expTime(encKdcRep[7]) if 7 in encKdcRep else None,
        }
    except (KeyError, IndexError, ValueError, struct.error):
        raise KerberosError(-1, "malformed KDC reply")

def _reqBody(realm, snameType, snameComponents, etypes, nonce, cnameComponents=None):
    parts = [der.tagged(0, der.bitString(b"\x00\x00\x00\x00"))]                      # kdc-options
    if cnameComponents is not None:
        parts.append(der.tagged(1, _principalName(NT_PRINCIPAL, cnameComponents)))  # cname (AS only)

View on GitHub (pinned to 0a35b20e39)