sqlmapproject/sqlmap · error · KerberosError

reply nonce does not match the request (possible replay)

Error message

reply nonce does not match the request (possible replay)

What it means

Error "reply nonce does not match the request (possible replay)" thrown in sqlmapproject/sqlmap.

Source

Thrown at extra/kerberos/client.py:252

    The reply's application tag MUST match the expected message type, and the nonce carried in the
    (integrity-protected) enc-part MUST equal the request nonce (RFC 4120)."""

    try:                                                   # any structural defect in a hostile/truncated reply -> KerberosError
        tag, repContent = _raiseIfError(response)
        if tag != der.applicationTag(expectedType):
            raise KerberosError(-1, "unexpected reply message type (tag 0x%02x)" % tag)
        rep = _fields(der.peel(repContent)[1])
        encData = _expFields(rep[6])                        # enc-part (EncryptedData)
        repEtype = _expInteger(encData[0])
        try:
            encRepPart = _enctype(repEtype).decrypt(key, usage, _expOctet(encData[2]))
        except ValueError:                                 # HMAC mismatch -> we hold the wrong long-term key
            raise KerberosError(-1, "reply decryption failed (wrong password or salt)")

        # Enc*RepPart = [APPLICATION 25/26] EncKDCRepPart ; key is field [0], nonce is field [2]
        encKdcRep = _fields(der.peel(der.peel(encRepPart)[1])[1])
        if _expInteger(encKdcRep[2]) != expectedNonce:
            raise KerberosError(-1, "reply nonce does not match the request (possible replay)")
        keyFields = _expFields(encKdcRep[0])

        return {
            "ticket": bytes(rep[5]),
            "sessionKey": _expOctet(keyFields[1]),
            "sessionKeyType": _expInteger(keyFields[0]),
            "etype": repEtype,
            "crealm": _expString(rep[3]),
            # EncKDCRepPart endtime [7]; a scan can outlive the ticket, so the caller can re-fetch
            "endtime": _expTime(encKdcRep[7]) if 7 in encKdcRep else None,
        }
    except (KeyError, IndexError, ValueError, struct.error):
        raise KerberosError(-1, "malformed KDC reply")

def _reqBody(realm, snameType, snameComponents, etypes, nonce, cnameComponents=None):
    parts = [der.tagged(0, der.bitString(b"\x00\x00\x00\x00"))]                      # kdc-options
    if cnameComponents is not None:
        parts.append(der.tagged(1, _principalName(NT_PRINCIPAL, cnameComponents)))  # cname (AS only)

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at extra/kerberos/client.py:252 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/c3ccbcdcde93d8a7. Report an issue: GitHub.