What causes "credentials: missing custom `search` field" in kgretzky/evilginx2?

Add a `search:` regex capturing the value group, e.g. `search: 'value="([^"]+)"'` for the same entry.

credentials: missing custom `search` field

Error message

credentials: missing custom `search` field

What it means

Each `credentials.custom` entry needs both a `key` (field name regex) and a `search` (regex to extract the value). This error is raised when a custom entry defines `key` but omits `search`, so no extraction pattern exists for that field.

Source

Thrown at core/phishlet.go:676

		return fmt.Errorf("login: `domain` must contain a value of one of the hostnames (`orig_subdomain` + `domain`) defined in `proxy_hosts` section")
	}

	p.login.path = p.paramVal(*fp.LoginItem.Path)
	if p.login.path == "" {
		p.login.path = "/"
	}
	if p.login.path[0] != '/' {
		p.login.path = "/" + p.login.path
	}

	if fp.Credentials.Custom != nil {
		for _, cp := range *fp.Credentials.Custom {
			var err error
			if cp.Key == nil {
				return fmt.Errorf("credentials: missing custom `key` field")
			}
			if cp.Search == nil {
				return fmt.Errorf("credentials: missing custom `search` field")
			}
			o := PostField{}
			o.key, err = regexp.Compile(p.paramVal(*cp.Key))
			if err != nil {
				return fmt.Errorf("credentials: %v", err)
			}
			o.search, err = regexp.Compile(p.paramVal(*cp.Search))
			if err != nil {
				return err
			}
			o.tp = cp.Type
			if o.tp == "" {
				o.tp = "post"
			}
			o.key_s = p.paramVal(*cp.Key)
			p.custom = append(p.custom, o)
		}
	}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add a `search:` regex capturing the value group, e.g. `search: 'value="([^"]+)"'` for the same entry.
Ensure each list item contains both key and search at the same indentation level.
Temporarily remove the incomplete custom entry to get the phishlet loading, then re-add it correctly.
Reload and verify no further custom-field validation errors.

Example fix

// before
custom:
  - key: 'otp'
// after
custom:
  - key: 'otp'
    search: '[otp value="([0-9]+)"']

Defensive patterns

Strategy: validation

Validate before calling

for i, c := range pl.Credentials.Custom {
    if c.Search == nil || *c.Search == "" {
        return fmt.Errorf("credentials.custom[%d] (key=%v) missing search regex", i, c.Key)
    }
}

Type guard

func hasSearch(c *CustomField) bool { return c != nil && c.Search != nil && *c.Search != "" }

Try / catch

if err := pl.Load(cfg); err != nil {
    if strings.Contains(err.Error(), "missing custom `search`") {
        log.Printf("add a search regex next to key %q in %s", keyName, pl.Name)
    }
}

Prevention

Treat key+search as an atomic pair in your phishlet templates.
Include a capture group in every search regex.
Lint custom entries for missing fields in CI.
Avoid leaving half-finished entries in shipped phishlets.

When it happens

Trigger: A `credentials.custom` list item with `key:` present but no `search:` line; indentation errors putting `search` on the wrong item.

Common situations: Half-finished custom field config; author assuming a bare key match suffices; deleting a broken search regex and leaving the entry incomplete.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/c579943ca46d5be3. Report an issue: GitHub.