kgretzky/evilginx2 · error

credentials: missing password `key` field

Error message

credentials: missing password `key` field

What it means

Thrown when the phishlet's credentials.password block is missing the 'key' field. 'key' is the regex identifying the password input field; the library requires both username and password key/search pairs, so the phishlet fails to load.

Source

Thrown at core/phishlet.go:598

			}
		}
	}
	for _, au := range fp.AuthUrls {
		re, err := regexp.Compile(p.paramVal(au))
		if err != nil {
			return err
		}
		p.authUrls = append(p.authUrls, re)
	}

	if fp.Credentials.Username.Key == nil {
		return fmt.Errorf("credentials: missing username `key` field")
	}
	if fp.Credentials.Username.Search == nil {
		return fmt.Errorf("credentials: missing username `search` field")
	}
	if fp.Credentials.Password.Key == nil {
		return fmt.Errorf("credentials: missing password `key` field")
	}
	if fp.Credentials.Password.Search == nil {
		return fmt.Errorf("credentials: missing password `search` field")
	}

	p.username.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Key))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.username.search, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Search))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.password.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Password.Key))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add 'key: <regex>' under credentials.password in the phishlet YAML
2. Ensure the password block mirrors the username block structure (key + search)
3. Validate against an example phishlet's credentials section

Example fix

// before
credentials:
  password:
    search: 'pass=([^&]*)'
// after
credentials:
  password:
    key: 'password'
    search: 'pass=([^&]*)'

if cfg.Credentials.Password.Key == nil || *cfg.Credentials.Password.Key == "" {
  return errors.New("credentials: missing password key")
}

func hasPasswordKey(fp FakePost) bool { return fp.Credentials.Password.Key != nil && *fp.Credentials.Password.Key != "" }

When it happens

Trigger: A phishlet YAML defines credentials.password.search (or nothing) but omits 'key', or the password block is mis-indented under credentials.

Common situations: Incomplete password block in hand-written phishlets; copying only the username block structure and forgetting to fill password.key; YAML merging mistakes.

Related errors

• credentials: missing username `key` field
• credentials: missing username `search` field
• credentials: missing password `search` field
• auth_tokens: 'search' not found for body auth token
• auth_tokens: 'domain' not found for http auth token

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/a2954736c6ffe4a6. Report an issue: GitHub.