{"record":{"id":"efb3fb9501fcaed7","repo":"kgretzky/evilginx2","slug":"credentials-missing-username-section","errorCode":null,"errorMessage":"credentials: missing `username` section","messagePattern":"credentials: missing `username` section","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":387,"sourceCode":"\t\t\t\tp.customParams = *customParams\n\t\t\t} else {\n\t\t\t\tfor _, param := range *fp.Params {\n\t\t\t\t\tp.customParams[param.Name] = param.Default\n\t\t\t\t}\n\t\t\t}*/\n\t}\n\n\tif fp.ProxyHosts == nil {\n\t\treturn fmt.Errorf(\"missing `proxy_hosts` section\")\n\t}\n\tif fp.AuthTokens == nil {\n\t\treturn fmt.Errorf(\"missing `auth_tokens` section\")\n\t}\n\tif fp.Credentials == nil {\n\t\treturn fmt.Errorf(\"missing `credentials` section\")\n\t}\n\tif fp.Credentials.Username == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `username` section\")\n\t}\n\tif fp.Credentials.Password == nil {\n\t\treturn fmt.Errorf(\"credentials: missing `password` section\")\n\t}\n\tif fp.LoginItem == nil {\n\t\treturn fmt.Errorf(\"missing `login` section\")\n\t}\n\n\tfor _, ph := range *fp.ProxyHosts {\n\t\tif ph.PhishSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `phish_sub` field\")\n\t\t}\n\t\tif ph.OrigSub == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `orig_sub` field\")\n\t\t}\n\t\tif ph.Domain == nil {\n\t\t\treturn fmt.Errorf(\"proxy_hosts: missing `domain` field\")\n\t\t}","sourceCodeStart":369,"sourceCodeEnd":405,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L369-L405","documentation":"Thrown during phishlet validation when the `credentials` section exists but lacks a `username` sub-section. The username sub-section tells Evilginx which form input holds the victim's username (via its `key` field) so credentials can be captured on submit and replayed later. Without it the phishlet is considered incomplete and is rejected.","triggerScenarios":"A phishlet YAML defines `credentials:` but only includes `password:` (or neither field), leaving fp.Credentials.Username nil when Validate() runs.","commonSituations":"Deleting the username block while editing captured inputs; a phishlet ported from another tool that only captures passwords; indentation error putting `username:` under `password:`.","solutions":["Add a `username:` sub-section inside `credentials:`","Give it a `key:` matching the username input's name/id and an optional `search:` (e.g. `any`, `id`, `name`)","Reload the phishlet with `config phishlets/local <name>` after editing"],"exampleFix":"// before\ncredentials:\n  password:\n    key: password\n    search: any\n// after\ncredentials:\n  username:\n    key: username\n    search: any\n  password:\n    key: password\n    search: any","handlingStrategy":"validation","validationCode":"var fp struct {\n\tCredentials *struct {\n\t\tUsername *struct{} `yaml:\"username\"`\n\t} `yaml:\"credentials\"`\n}\nyaml.Unmarshal(data, &fp)\nif fp.Credentials == nil || fp.Credentials.Username == nil {\n\treturn errors.New(\"phishlet credentials must include a `username:` sub-section\")\n}","typeGuard":"func hasUsername(fp *PhishletConfig) bool {\n\treturn fp != nil && fp.Credentials != nil && fp.Credentials.Username != nil\n}","tryCatchPattern":"err := cfg.AddPhishlet(\"local\", name)\nif err != nil {\n\tif strings.Contains(err.Error(), \"missing `username` section\") {\n\t\tlog.Fatalf(\"phishlet %s: add credentials.username with key/search fields\", name)\n\t}\n\treturn err\n}","preventionTips":["Always pair username and password sub-sections together in credentials","Match `key:` to the real login form input name (inspect the site's HTML)","Keep username at the same indentation level as password","Test the phishlet by loading it before deploying"],"tags":["phishlet","config-validation","credentials"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}