{"record":{"id":"786043cff800e565","repo":"kgretzky/evilginx2","slug":"missing-credentials-section","errorCode":null,"errorMessage":"missing `credentials` section","messagePattern":"missing `credentials` section","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":384,"sourceCode":"\n\t\t/*\n\t\t\tif customParams != nil {\n\t\t\t\tp.customParams = *customParams\n\t\t\t} else {\n\t\t\t\tfor _, param := range *fp.Params {\n\t\t\t\t\tp.customParams[param.Name] = param.Default\n\t\t\t\t}\n\t\t\t}*/\n\t}\n\n\tif fp.ProxyHosts == nil {\n\t\treturn fmt.Errorf(\"missing `proxy_hosts` section\")\n\t}\n\tif fp.AuthTokens == nil {\n\t\treturn fmt.Errorf(\"missing `auth_tokens` section\")\n\t}\n\tif fp.Credentials == nil {\n\t\treturn fmt.Errorf(\"missing `credentials` section\")\n\t}\n\tif fp.Credentials.Username == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `username` section\")\n\t}\n\tif fp.Credentials.Password == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `password` section\")\n\t}\n\tif fp.LoginItem == nil {\n\t\treturn fmt.Errorf(\"missing `login` section\")\n\t}\n\n\tfor _, ph := range *fp.ProxyHosts {\n\t\tif ph.PhishSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `phish_sub` field\")\n\t\t}\n\t\tif ph.OrigSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `orig_sub` field\")\n\t\t}","sourceCodeStart":366,"sourceCodeEnd":402,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L366-L402","documentation":"This error is thrown by the phishlet loader during Validate() when the phishlet YAML config has no top-level `credentials` section, or it is explicitly set to null. Evilginx3 phishlets must define `credentials` (with username/password sub-sections) so the framework knows which form fields to capture and inject during a phishing session. The nil-check on fp.Credentials fails before any sub-fields are inspected.","triggerScenarios":"Loading a phishlet (config add phishlet / site load) whose YAML omits the `credentials:` block entirely, or contains only `credentials:` with no mapping beneath it, causing fp.Credentials to remain nil.","commonSituations":"Hand-writing a phishlet from scratch and forgetting the credentials block; copying only the proxy_hosts part of a template; a YAML indentation mistake that nests credentials under another key so it never binds to the struct.","solutions":["Add a top-level `credentials:` section to the phishlet YAML","Add `username:` and `password:` sub-sections under it with at least a `key:` form input each","Verify indentation with a YAML linter so credentials binds to the top-level struct"],"exampleFix":"# before\nproxy_hosts:\n  - phish_sub: login\n    orig_sub: login\n    domain: example.com\n# after\nproxy_hosts:\n  - phish_sub: login\n    orig_sub: login\n    domain: example.com\ncredentials:\n  username:\n    key: username\n    search: any\n  password:\n    key: password\n    search: any","handlingStrategy":"validation","validationCode":"data, _ := ioutil.ReadFile(phishletPath)\nvar fp struct {\n\tCredentials *struct{} `yaml:\"credentials\"`\n}\nyaml.Unmarshal(data, &fp)\nif fp.Credentials == nil {\n\treturn errors.New(\"phishlet must define a top-level `credentials:` section\")\n}","typeGuard":"func hasCredentials(fp *PhishletConfig) bool {\n\treturn fp != nil && fp.Credentials != nil\n}","tryCatchPattern":"err := cfg.AddPhishlet(\"local\", name)\nif err != nil {\n\tif strings.Contains(err.Error(), \"missing `credentials` section\") {\n\t\tlog.Fatalf(\"phishlet %s: add a credentials block with username and password sub-sections\", name)\n\t}\n\treturn err\n}","preventionTips":["Start every phishlet from an official template that includes credentials","Run a YAML linter to confirm top-level indentation of credentials","Check that `credentials:` has child keys, not just a bare key with no value","Reload the phishlet in evilginx after every edit to catch errors immediately"],"tags":["phishlet","config-validation","evilginx"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}