{"record":{"id":"de877ebf924de38a","repo":"kgretzky/evilginx2","slug":"credentials-missing-password-section","errorCode":null,"errorMessage":"credentials: missing `password` section","messagePattern":"credentials: missing `password` section","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":390,"sourceCode":"\t\t\t\t\tp.customParams[param.Name] = param.Default\n\t\t\t\t}\n\t\t\t}*/\n\t}\n\n\tif fp.ProxyHosts == nil {\n\t\treturn fmt.Errorf(\"missing `proxy_hosts` section\")\n\t}\n\tif fp.AuthTokens == nil {\n\t\treturn fmt.Errorf(\"missing `auth_tokens` section\")\n\t}\n\tif fp.Credentials == nil {\n\t\treturn fmt.Errorf(\"missing `credentials` section\")\n\t}\n\tif fp.Credentials.Username == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `username` section\")\n\t}\n\tif fp.Credentials.Password == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `password` section\")\n\t}\n\tif fp.LoginItem == nil {\n\t\treturn fmt.Errorf(\"missing `login` section\")\n\t}\n\n\tfor _, ph := range *fp.ProxyHosts {\n\t\tif ph.PhishSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `phish_sub` field\")\n\t\t}\n\t\tif ph.OrigSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `orig_sub` field\")\n\t\t}\n\t\tif ph.Domain == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `domain` field\")\n\t\t}\n\t\tauto_filter := true\n\t\tif ph.AutoFilter != nil {\n\t\t\tauto_filter = *ph.AutoFilter","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L372-L408","documentation":"Thrown during phishlet validation when `credentials` exists and has `username` but no `password` sub-section. The password sub-section identifies the password form input so the reverse proxy can capture it when the victim submits the login form. A phishlet missing it cannot harvest credentials and fails validation.","triggerScenarios":"A phishlet YAML where `credentials:` contains only `username:` (or password is misspelled/mis-indented), so fp.Credentials.Password stays nil in Validate().","commonSituations":"Copy-paste truncation of a working phishlet; typo like `passwod:`; nested `password:` inside `username:` due to wrong indentation.","solutions":["Add a `password:` sub-section inside `credentials:`","Set `key:` to the actual password input name/id and optionally `search:`","Confirm both `username:` and `password:` are direct children of `credentials:`"],"exampleFix":"// before\ncredentials:\n  username:\n    key: email\n    search: any\n// after\ncredentials:\n  username:\n    key: email\n    search: any\n  password:\n    key: password\n    search: any","handlingStrategy":"validation","validationCode":"var fp struct {\n\tCredentials *struct {\n\t\tPassword *struct{} `yaml:\"password\"`\n\t} `yaml:\"credentials\"`\n}\nyaml.Unmarshal(data, &fp)\nif fp.Credentials == nil || fp.Credentials.Password == nil {\n\treturn errors.New(\"phishlet credentials must include a `password:` sub-section\")\n}","typeGuard":"func hasPassword(fp *PhishletConfig) bool {\n\treturn fp != nil && fp.Credentials != nil && fp.Credentials.Password != nil\n}","tryCatchPattern":"err := cfg.AddPhishlet(\"local\", name)\nif err != nil {\n\tif strings.Contains(err.Error(), \"missing `password` section\") {\n\t\tlog.Fatalf(\"phishlet %s: add credentials.password with key/search fields\", name)\n\t}\n\treturn err\n}","preventionTips":["Check the target login form's password input name and use it in `key:`","Never indent password under username; both belong directly to credentials","Diff against a known-good phishlet after edits","Keep search: any unless you know the input lookup type"],"tags":["phishlet","config-validation","credentials"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}