{"record":{"id":"6b5937209b69996b","repo":"kgretzky/evilginx2","slug":"proxy-hosts-missing-orig-sub-field","errorCode":null,"errorMessage":"proxy_hosts: missing `orig_sub` field","messagePattern":"proxy_hosts: missing `orig_sub` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":401,"sourceCode":"\tif fp.Credentials == nil {\n\t\treturn fmt.Errorf(\"missing `credentials` section\")\n\t}\n\tif fp.Credentials.Username == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `username` section\")\n\t}\n\tif fp.Credentials.Password == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `password` section\")\n\t}\n\tif fp.LoginItem == nil {\n\t\treturn fmt.Errorf(\"missing `login` section\")\n\t}\n\n\tfor _, ph := range *fp.ProxyHosts {\n\t\tif ph.PhishSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `phish_sub` field\")\n\t\t}\n\t\tif ph.OrigSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `orig_sub` field\")\n\t\t}\n\t\tif ph.Domain == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `domain` field\")\n\t\t}\n\t\tauto_filter := true\n\t\tif ph.AutoFilter != nil {\n\t\t\tauto_filter = *ph.AutoFilter\n\t\t}\n\t\tp.addProxyHost(p.paramVal(*ph.PhishSub), p.paramVal(*ph.OrigSub), p.paramVal(*ph.Domain), ph.Session, ph.IsLanding, auto_filter)\n\t}\n\tif len(p.proxyHosts) == 0 {\n\t\treturn fmt.Errorf(\"proxy_hosts: list cannot be empty\")\n\t}\n\tsession_set := false\n\tfor _, ph := range p.proxyHosts {\n\t\tif ph.handle_session {\n\t\t\tsession_set = true\n\t\t\tbreak","sourceCodeStart":383,"sourceCodeEnd":419,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L383-L419","documentation":"Thrown during proxy_hosts validation when an entry lacks the `orig_sub` field. `orig_sub` names the subdomain on the real target site that this host proxies (e.g. `login` for login.example.com), letting the reverse proxy map phishing URLs to legitimate backend hosts. Missing it makes routing ambiguous and the entry is rejected.","triggerScenarios":"A `proxy_hosts:` entry with `phish_sub` and `domain` but no `orig_sub`, or `orig_sub` misspelled/mis-indented so the YAML key does not bind to ph.OrigSub.","commonSituations":"Forgetting orig_sub when mirroring an entry; typo `orign_sub`; indentation placing orig_sub as a child of another key.","solutions":["Add `orig_sub:` to each proxy_hosts entry","Match it to the real subdomain on the target (e.g. login.example.com -> `login`)","Use `''` when the target host itself has no subdomain"],"exampleFix":"// before\nproxy_hosts:\n  - phish_sub: login\n    domain: example.com\n// after\nproxy_hosts:\n  - phish_sub: login\n    orig_sub: login\n    domain: example.com","handlingStrategy":"validation","validationCode":"type proxyHost struct {\n\tPhishSub *string `yaml:\"phish_sub\"`\n\tOrigSub  *string `yaml:\"orig_sub\"`\n\tDomain   *string `yaml:\"domain\"`\n}\nvar fp struct { ProxyHosts *[]proxyHost `yaml:\"proxy_hosts\"` }\nyaml.Unmarshal(data, &fp)\nfor i, ph := range *fp.ProxyHosts {\n\tif ph.OrigSub == nil {\n\t\treturn fmt.Errorf(\"proxy_hosts[%d]: missing orig_sub\", i)\n\t}\n}","typeGuard":"func hasOrigSub(ph ProxyHost) bool {\n\treturn ph.OrigSub != nil\n}","tryCatchPattern":"err := cfg.AddPhishlet(\"local\", name)\nif err != nil {\n\tif strings.Contains(err.Error(), \"missing `orig_sub` field\") {\n\t\tlog.Fatalf(\"phishlet %s: set orig_sub to the target site's real subdomain\", name)\n\t}\n\treturn err\n}","preventionTips":["Set orig_sub to the real target subdomain (login.example.com -> login)","Use '' for hosts without a subdomain","Mirror phish_sub to orig_sub initially, then adjust phishing labels","Verify key spelling: orig_sub, not orign_sub"],"tags":["phishlet","proxy-hosts","config-validation"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}