{"record":{"id":"f37d1c2f3ed03777","repo":"kgretzky/evilginx2","slug":"auth-tokens-search-not-found-for-body-auth-toke","errorCode":null,"errorMessage":"auth_tokens: 'search' not found for body auth token","messagePattern":"auth_tokens: 'search' not found for body auth token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":556,"sourceCode":"\t\t\tfor n := range *at.Keys {\n\t\t\t\t(*at.Keys)[n] = p.paramVal((*at.Keys)[n])\n\t\t\t}\n\t\t\terr := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase \"body\":\n\t\t\tif at.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Path == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Name == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'name' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Search == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'search' not found for body auth token\")\n\t\t\t}\n\n\t\t\terr := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase \"http\":\n\t\t\tif at.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Path == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Name == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'name' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Header == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'header' not found for http auth token\")","sourceCodeStart":538,"sourceCodeEnd":574,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L538-L574","documentation":"This phishlet validation error is thrown while parsing a phishlet YAML file. An auth_tokens entry with type 'body' must define a 'search' field (the regex used to extract the token from the response body), and it was nil. The library refuses to load the phishlet because it cannot know where to find the token in the body.","triggerScenarios":"Loading a phishlet whose auth_tokens list contains an entry with type: body that sets domain/path/name but omits the 'search' key (or YAML indentation places 'search' outside the entry).","commonSituations":"Hand-edited phishlet YAML missing the search regex; copy-pasted token config from a cookie-type token where 'search' is not used; wrong indentation causing keys to attach to the wrong token entry.","solutions":["Add a 'search:' regex field to the body auth_tokens entry in the phishlet YAML","Verify YAML indentation so 'search' is a sibling of 'type: body' within the same list item","Validate the phishlet with the tool's phishlet validation/CLI check before use"],"exampleFix":"// before\nauth_tokens:\n  - domain: '.example.com'\n    path: '/'\n    name: session\n    type: body\n// after\nauth_tokens:\n  - domain: '.example.com'\n    path: '/'\n    name: session\n    type: body\n    search: '\"token\":\"([^\"]+)\"'","handlingStrategy":"validation","validationCode":"for i, at := range cfg.AuthTokens {\n  if at.Type == \"body\" && (at.Search == nil || *at.Search == \"\") {\n    return fmt.Errorf(\"auth_tokens[%d]: body token missing 'search'\", i)\n  }\n}","typeGuard":"func hasSearch(at AuthToken) bool { return at.Search != nil && *at.Search != \"\" }","tryCatchPattern":null,"preventionTips":["Keep a template phishlet with all required fields for each token type","Run the tool's phishlet validation CLI before deploying","Use consistent YAML indentation and a YAML linter"],"tags":["phishlet","config","yaml","validation"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}