kgretzky/evilginx2 · error

auth_tokens: 'search' not found for body auth token

Error message

auth_tokens: 'search' not found for body auth token

What it means

This phishlet validation error is thrown while parsing a phishlet YAML file. An auth_tokens entry with type 'body' must define a 'search' field (the regex used to extract the token from the response body), and it was nil. The library refuses to load the phishlet because it cannot know where to find the token in the body.

Source

Thrown at core/phishlet.go:556

			for n := range *at.Keys {
				(*at.Keys)[n] = p.paramVal((*at.Keys)[n])
			}
			err := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)
			if err != nil {
				return err
			}
		case "body":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for body auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for body auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for body auth token")
			}
			if at.Search == nil {
				return fmt.Errorf("auth_tokens: 'search' not found for body auth token")
			}

			err := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))
			if err != nil {
				return err
			}
		case "http":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for http auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for http auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for http auth token")
			}
			if at.Header == nil {
				return fmt.Errorf("auth_tokens: 'header' not found for http auth token")

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add a 'search:' regex field to the body auth_tokens entry in the phishlet YAML
2. Verify YAML indentation so 'search' is a sibling of 'type: body' within the same list item
3. Validate the phishlet with the tool's phishlet validation/CLI check before use

Example fix

// before
auth_tokens:
  - domain: '.example.com'
    path: '/'
    name: session
    type: body
// after
auth_tokens:
  - domain: '.example.com'
    path: '/'
    name: session
    type: body
    search: '"token":"([^"]+)"'

for i, at := range cfg.AuthTokens {
  if at.Type == "body" && (at.Search == nil || *at.Search == "") {
    return fmt.Errorf("auth_tokens[%d]: body token missing 'search'", i)
  }
}

func hasSearch(at AuthToken) bool { return at.Search != nil && *at.Search != "" }

When it happens

Trigger: Loading a phishlet whose auth_tokens list contains an entry with type: body that sets domain/path/name but omits the 'search' key (or YAML indentation places 'search' outside the entry).

Common situations: Hand-edited phishlet YAML missing the search regex; copy-pasted token config from a cookie-type token where 'search' is not used; wrong indentation causing keys to attach to the wrong token entry.

Related errors

• auth_tokens: 'domain' not found for http auth token
• auth_tokens: 'path' not found for http auth token
• auth_tokens: 'name' not found for http auth token
• auth_tokens: 'header' not found for http auth token
• credentials: missing username `key` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/f37d1c2f3ed03777. Report an issue: GitHub.