What causes "auth_tokens: 'path' not found for body auth token" in kgretzky/evilginx2?

Add a `path` field with a valid regular expression to the body auth token entry (e.g. `path: ^/api/login$`).

auth_tokens: 'path' not found for body auth token

Error message

auth_tokens: 'path' not found for body auth token

What it means

This error is thrown when a `body`-type entry in a phishlet's `auth_tokens` section defines `domain` but omits the required `path` field. The path is a regular expression identifying which response endpoint the token is extracted from; without it the entry cannot be matched and the phishlet fails to load.

Source

Thrown at core/phishlet.go:550

				return fmt.Errorf("auth_tokens: 'domain' not found for cookie auth token")
			}
			if at.Keys == nil {
				return fmt.Errorf("auth_tokens: 'keys' not found for cookie auth token")
			}

			for n := range *at.Keys {
				(*at.Keys)[n] = p.paramVal((*at.Keys)[n])
			}
			err := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)
			if err != nil {
				return err
			}
		case "body":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for body auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for body auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for body auth token")
			}
			if at.Search == nil {
				return fmt.Errorf("auth_tokens: 'search' not found for body auth token")
			}

			err := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))
			if err != nil {
				return err
			}
		case "http":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for http auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for http auth token")

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add a `path` field with a valid regular expression to the body auth token entry (e.g. `path: ^/api/login$`).
Verify the regex compiles under Go RE2 syntax to avoid the follow-up invalid-regular-expression error.
Confirm `path` is indented within the same auth_tokens list item as `domain`.

Example fix

// before (phishlet.yml)
auth_tokens:
  - type: body
    domain: api
    name: token
    search: 'token=([A-Za-z0-9]+)'
// after
auth_tokens:
  - type: body
    domain: api
    path: ^/api/login$
    name: token
    search: 'token=([A-Za-z0-9]+)'

Defensive patterns

Strategy: validation

Validate before calling

import "regexp"

for i, at := range cfg.AuthTokens {
    if at.Type != nil && *at.Type == "body" {
        if at.Path == nil {
            return fmt.Errorf("auth_tokens[%d]: 'path' not found for body auth token", i)
        }
        if _, err := regexp.Compile(*at.Path); err != nil {
            return fmt.Errorf("auth_tokens[%d]: invalid path regex: %v", i, err)
        }
    }
}

Type guard

func bodyTokenHasValidPath(at AuthToken) bool {
    if at.Path == nil {
        return false
    }
    _, err := regexp.Compile(*at.Path)
    return err == nil
}

Prevention

Pre-compile the path regex in a test to verify it is valid RE2.
Keep the path anchored (^...$) to the exact endpoint that returns the token.
Check list indentation so `path` sits inside the correct body token entry.

When it happens

Trigger: An auth_tokens entry with `type: body` has `domain` (and possibly `name`/`search`) but no `path:` line.

Common situations: Incomplete body token entry; removing the path while editing; YAML indentation errors so `path` falls into the previous entry.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/d5119c13bfbe4eb3. Report an issue: GitHub.