kgretzky/evilginx2 · error

credentials: missing password `search` field

Error message

credentials: missing password `search` field

What it means

Thrown when the phishlet's credentials.password block is missing the 'search' field. 'search' is the regex extracting the password value from the POST body; without it captured passwords cannot be parsed, so the phishlet is rejected.

Source

Thrown at core/phishlet.go:601

	for _, au := range fp.AuthUrls {
		re, err := regexp.Compile(p.paramVal(au))
		if err != nil {
			return err
		}
		p.authUrls = append(p.authUrls, re)
	}

	if fp.Credentials.Username.Key == nil {
		return fmt.Errorf("credentials: missing username `key` field")
	}
	if fp.Credentials.Username.Search == nil {
		return fmt.Errorf("credentials: missing username `search` field")
	}
	if fp.Credentials.Password.Key == nil {
		return fmt.Errorf("credentials: missing password `key` field")
	}
	if fp.Credentials.Password.Search == nil {
		return fmt.Errorf("credentials: missing password `search` field")
	}

	p.username.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Key))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.username.search, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Search))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.password.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Password.Key))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.password.search, err = regexp.Compile(p.paramVal(*fp.Credentials.Password.Search))

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add 'search: <capture regex>' under credentials.password
2. Ensure key and search are siblings within credentials.password
3. Re-validate the phishlet after the edit

Example fix

// before
credentials:
  password:
    key: 'password'
// after
credentials:
  password:
    key: 'password'
    search: 'password=([^&]*)'

if cfg.Credentials.Password.Search == nil || *cfg.Credentials.Password.Search == "" {
  return errors.New("credentials: missing password search")
}

func hasPasswordSearch(fp FakePost) bool { return fp.Credentials.Password.Search != nil && *fp.Credentials.Password.Search != "" }

When it happens

Trigger: A phishlet YAML defines credentials.password.key but omits 'search', or 'search' is misplaced by indentation.

Common situations: Writing password block with key only; copy-paste losing the search line; editing that accidentally removed it.

Related errors

• credentials: missing username `key` field
• credentials: missing username `search` field
• credentials: missing password `key` field
• auth_tokens: 'search' not found for body auth token
• auth_tokens: 'domain' not found for http auth token

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/e8366cbfe1c26a95. Report an issue: GitHub.