kgretzky/evilginx2 · error

auth_tokens: 'domain' not found for body auth token

Error message

auth_tokens: 'domain' not found for body auth token

What it means

This error is thrown when a `body`-type entry in a phishlet's `auth_tokens` section lacks the required `domain` field. Body auth tokens are extracted from HTTP response bodies and still need a domain to scope where the token is captured. The phishlet is rejected at load time.

Source

Thrown at core/phishlet.go:547

		switch ttype {
		case "cookie":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for cookie auth token")
			}
			if at.Keys == nil {
				return fmt.Errorf("auth_tokens: 'keys' not found for cookie auth token")
			}

			for n := range *at.Keys {
				(*at.Keys)[n] = p.paramVal((*at.Keys)[n])
			}
			err := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)
			if err != nil {
				return err
			}
		case "body":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for body auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for body auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for body auth token")
			}
			if at.Search == nil {
				return fmt.Errorf("auth_tokens: 'search' not found for body auth token")
			}

			err := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))
			if err != nil {
				return err
			}
		case "http":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for http auth token")

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add a `domain` field to the body auth token entry (e.g. `domain: api`).
2. Use a wildcard domain if the token can originate from any subdomain, per the phishlet format rules.
3. Check YAML indentation to ensure `domain` is a child of the same list item as the body token's other fields.

Example fix

// before (phishlet.yml)
auth_tokens:
  - type: body
    path: ^/api/session$
    name: token
    search: 'token=([A-Za-z0-9]+)'
// after
auth_tokens:
  - type: body
    domain: api
    path: ^/api/session$
    name: token
    search: 'token=([A-Za-z0-9]+)'

for i, at := range cfg.AuthTokens {
    if at.Type != nil && *at.Type == "body" && at.Domain == nil {
        return fmt.Errorf("auth_tokens[%d]: 'domain' not found for body auth token", i)
    }
}

func bodyTokenHasDomain(at AuthToken) bool {
    return at.Type != nil && *at.Type == "body" && at.Domain != nil
}

When it happens

Trigger: An auth_tokens entry with `type: body` defines `path`, `name`, and/or `search` but omits the `domain:` key.

Common situations: Copying a body token entry from an example and deleting domain by accident; assuming body tokens do not need a domain; mis-indented YAML placing domain in a sibling entry.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• auth_tokens: invalid token type: %s
• auth_tokens: 'domain' not found for cookie auth token
• auth_tokens: 'keys' not found for cookie auth token
• auth_tokens: 'path' not found for body auth token
• auth_tokens: 'name' not found for body auth token

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/f6765a4d2cdee07b. Report an issue: GitHub.