{"record":{"id":"d1410753c28bf82d","repo":"kgretzky/evilginx2","slug":"proxy-hosts-missing-domain-field","errorCode":null,"errorMessage":"proxy_hosts: missing `domain` field","messagePattern":"proxy_hosts: missing `domain` field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":404,"sourceCode":"\tif fp.Credentials.Username == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `username` section\")\n\t}\n\tif fp.Credentials.Password == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `password` section\")\n\t}\n\tif fp.LoginItem == nil {\n\t\treturn fmt.Errorf(\"missing `login` section\")\n\t}\n\n\tfor _, ph := range *fp.ProxyHosts {\n\t\tif ph.PhishSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `phish_sub` field\")\n\t\t}\n\t\tif ph.OrigSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `orig_sub` field\")\n\t\t}\n\t\tif ph.Domain == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `domain` field\")\n\t\t}\n\t\tauto_filter := true\n\t\tif ph.AutoFilter != nil {\n\t\t\tauto_filter = *ph.AutoFilter\n\t\t}\n\t\tp.addProxyHost(p.paramVal(*ph.PhishSub), p.paramVal(*ph.OrigSub), p.paramVal(*ph.Domain), ph.Session, ph.IsLanding, auto_filter)\n\t}\n\tif len(p.proxyHosts) == 0 {\n\t\treturn fmt.Errorf(\"proxy_hosts: list cannot be empty\")\n\t}\n\tsession_set := false\n\tfor _, ph := range p.proxyHosts {\n\t\tif ph.handle_session {\n\t\t\tsession_set = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !session_set {","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L386-L422","documentation":"Thrown during proxy_hosts validation when an entry lacks the `domain` field. `domain` is the base domain of the real target site for that host (e.g. example.com); combined with orig_sub it forms the full upstream hostname the proxy forwards to. Without it the proxy cannot resolve the backend host and the phishlet fails validation.","triggerScenarios":"A `proxy_hosts:` entry containing phish_sub and orig_sub but no `domain`, or a misspelled/mis-indented `domain` key so the struct field stays nil.","commonSituations":"Omitting domain when duplicating an entry for another subdomain; typo like `domains:`; line accidentally deleted while editing.","solutions":["Add `domain:` with the target's base domain to each proxy_hosts entry","Ensure phish_sub.orig_sub.domain triplets are complete on every entry","Note this domain must NOT be your phishing domain; the phishing hostname is derived from phish_sub + your phishing domain"],"exampleFix":"// before\nproxy_hosts:\n  - phish_sub: login\n    orig_sub: login\n// after\nproxy_hosts:\n  - phish_sub: login\n    orig_sub: login\n    domain: example.com","handlingStrategy":"validation","validationCode":"type proxyHost struct {\n\tPhishSub *string `yaml:\"phish_sub\"`\n\tOrigSub  *string `yaml:\"orig_sub\"`\n\tDomain   *string `yaml:\"domain\"`\n}\nvar fp struct { ProxyHosts *[]proxyHost `yaml:\"proxy_hosts\"` }\nyaml.Unmarshal(data, &fp)\nfor i, ph := range *fp.ProxyHosts {\n\tif ph.Domain == nil {\n\t\treturn fmt.Errorf(\"proxy_hosts[%d]: missing domain\", i)\n\t}\n}","typeGuard":"func hasDomain(ph ProxyHost) bool {\n\treturn ph.Domain != nil\n}","tryCatchPattern":"err := cfg.AddPhishlet(\"local\", name)\nif err != nil {\n\tif strings.Contains(err.Error(), \"missing `domain` field\") {\n\t\tlog.Fatalf(\"phishlet %s: each proxy_hosts entry needs the target base domain\", name)\n\t}\n\treturn err\n}","preventionTips":["Set domain to the target site's base domain (no subdomain, no scheme)","Keep domain and phish domain separate; domain is always the real site","Complete each entry on one block: phish_sub, orig_sub, domain","Cross-check the trio against the real hostname phish_sub.orig_sub.domain"],"tags":["phishlet","proxy-hosts","config-validation"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}