kgretzky/evilginx2 · error

credentials: missing `password` section

Error message

credentials: missing `password` section

What it means

Thrown during phishlet validation when `credentials` exists and has `username` but no `password` sub-section. The password sub-section identifies the password form input so the reverse proxy can capture it when the victim submits the login form. A phishlet missing it cannot harvest credentials and fails validation.

Source

Thrown at core/phishlet.go:390

					p.customParams[param.Name] = param.Default
				}
			}*/
	}

	if fp.ProxyHosts == nil {
		return fmt.Errorf("missing `proxy_hosts` section")
	}
	if fp.AuthTokens == nil {
		return fmt.Errorf("missing `auth_tokens` section")
	}
	if fp.Credentials == nil {
		return fmt.Errorf("missing `credentials` section")
	}
	if fp.Credentials.Username == nil {
		return fmt.Errorf("credentials: missing `username` section")
	}
	if fp.Credentials.Password == nil {
		return fmt.Errorf("credentials: missing `password` section")
	}
	if fp.LoginItem == nil {
		return fmt.Errorf("missing `login` section")
	}

	for _, ph := range *fp.ProxyHosts {
		if ph.PhishSub == nil {
			return fmt.Errorf("proxy_hosts: missing `phish_sub` field")
		}
		if ph.OrigSub == nil {
			return fmt.Errorf("proxy_hosts: missing `orig_sub` field")
		}
		if ph.Domain == nil {
			return fmt.Errorf("proxy_hosts: missing `domain` field")
		}
		auto_filter := true
		if ph.AutoFilter != nil {
			auto_filter = *ph.AutoFilter

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add a `password:` sub-section inside `credentials:`
2. Set `key:` to the actual password input name/id and optionally `search:`
3. Confirm both `username:` and `password:` are direct children of `credentials:`

Example fix

// before
credentials:
  username:
    key: email
    search: any
// after
credentials:
  username:
    key: email
    search: any
  password:
    key: password
    search: any

var fp struct {
	Credentials *struct {
		Password *struct{} `yaml:"password"`
	} `yaml:"credentials"`
}
yaml.Unmarshal(data, &fp)
if fp.Credentials == nil || fp.Credentials.Password == nil {
	return errors.New("phishlet credentials must include a `password:` sub-section")
}

func hasPassword(fp *PhishletConfig) bool {
	return fp != nil && fp.Credentials != nil && fp.Credentials.Password != nil
}

err := cfg.AddPhishlet("local", name)
if err != nil {
	if strings.Contains(err.Error(), "missing `password` section") {
		log.Fatalf("phishlet %s: add credentials.password with key/search fields", name)
	}
	return err
}

When it happens

Trigger: A phishlet YAML where `credentials:` contains only `username:` (or password is misspelled/mis-indented), so fp.Credentials.Password stays nil in Validate().

Common situations: Copy-paste truncation of a working phishlet; typo like `passwod:`; nested `password:` inside `username:` due to wrong indentation.

Related errors

• credentials: missing `username` section
• missing `credentials` section
• missing `login` section
• proxy_hosts: missing `phish_sub` field
• proxy_hosts: missing `orig_sub` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/de877ebf924de38a. Report an issue: GitHub.