{"record":{"id":"a2954736c6ffe4a6","repo":"kgretzky/evilginx2","slug":"credentials-missing-password-key-field","errorCode":null,"errorMessage":"credentials: missing password `key` field","messagePattern":"credentials: missing password `key` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":598,"sourceCode":"\t\t\t}\n\t\t}\n\t}\n\tfor _, au := range fp.AuthUrls {\n\t\tre, err := regexp.Compile(p.paramVal(au))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tp.authUrls = append(p.authUrls, re)\n\t}\n\n\tif fp.Credentials.Username.Key == nil {\n\t\treturn fmt.Errorf(\"credentials: missing username `key` field\")\n\t}\n\tif fp.Credentials.Username.Search == nil {\n\t\treturn fmt.Errorf(\"credentials: missing username `search` field\")\n\t}\n\tif fp.Credentials.Password.Key == nil {\n\t\treturn fmt.Errorf(\"credentials: missing password `key` field\")\n\t}\n\tif fp.Credentials.Password.Search == nil {\n\t\treturn fmt.Errorf(\"credentials: missing password `search` field\")\n\t}\n\n\tp.username.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Key))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"credentials: %v\", err)\n\t}\n\n\tp.username.search, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Search))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"credentials: %v\", err)\n\t}\n\n\tp.password.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Password.Key))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"credentials: %v\", err)","sourceCodeStart":580,"sourceCodeEnd":616,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L580-L616","documentation":"Thrown when the phishlet's credentials.password block is missing the 'key' field. 'key' is the regex identifying the password input field; the library requires both username and password key/search pairs, so the phishlet fails to load.","triggerScenarios":"A phishlet YAML defines credentials.password.search (or nothing) but omits 'key', or the password block is mis-indented under credentials.","commonSituations":"Incomplete password block in hand-written phishlets; copying only the username block structure and forgetting to fill password.key; YAML merging mistakes.","solutions":["Add 'key: <regex>' under credentials.password in the phishlet YAML","Ensure the password block mirrors the username block structure (key + search)","Validate against an example phishlet's credentials section"],"exampleFix":"// before\ncredentials:\n  password:\n    search: 'pass=([^&]*)'\n// after\ncredentials:\n  password:\n    key: 'password'\n    search: 'pass=([^&]*)'","handlingStrategy":"validation","validationCode":"if cfg.Credentials.Password.Key == nil || *cfg.Credentials.Password.Key == \"\" {\n  return errors.New(\"credentials: missing password key\")\n}","typeGuard":"func hasPasswordKey(fp FakePost) bool { return fp.Credentials.Password.Key != nil && *fp.Credentials.Password.Key != \"\" }","tryCatchPattern":null,"preventionTips":["Mirror the username block structure for password","Check the target site's password input name/id before writing key","Lint YAML nesting under credentials"],"tags":["phishlet","config","credentials","validation"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}