What causes "credentials: missing username `search` field" in kgretzky/evilginx2?

Add a 'search:' regex under credentials.username that captures the username value

credentials: missing username `search` field

Error message

credentials: missing username `search` field

What it means

Thrown when the phishlet's credentials.username block is missing the 'search' field. 'search' is the regex used to extract the submitted username value from the login POST body; without it credentials cannot be captured, so the phishlet is rejected.

Source

Thrown at core/phishlet.go:595

			err := p.addHttpAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Header))
			if err != nil {
				return err
			}
		}
	}
	for _, au := range fp.AuthUrls {
		re, err := regexp.Compile(p.paramVal(au))
		if err != nil {
			return err
		}
		p.authUrls = append(p.authUrls, re)
	}

	if fp.Credentials.Username.Key == nil {
		return fmt.Errorf("credentials: missing username `key` field")
	}
	if fp.Credentials.Username.Search == nil {
		return fmt.Errorf("credentials: missing username `search` field")
	}
	if fp.Credentials.Password.Key == nil {
		return fmt.Errorf("credentials: missing password `key` field")
	}
	if fp.Credentials.Password.Search == nil {
		return fmt.Errorf("credentials: missing password `search` field")
	}

	p.username.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Key))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.username.search, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Search))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add a 'search:' regex under credentials.username that captures the username value
Keep 'key' and 'search' as siblings under credentials.username
Re-run phishlet validation after editing

Example fix

// before
credentials:
  username:
    key: 'username'
// after
credentials:
  username:
    key: 'username'
    search: 'username=([^&]*)'

Defensive patterns

Strategy: validation

Validate before calling

if cfg.Credentials.Username.Search == nil || *cfg.Credentials.Username.Search == "" {
  return errors.New("credentials: missing username search")
}

Type guard

func hasUsernameSearch(fp FakePost) bool { return fp.Credentials.Username.Search != nil && *fp.Credentials.Username.Search != "" }

Prevention

Pair every key with a matching search capture regex
Test that the search regex matches the real login POST body
Validate the phishlet after edits

When it happens

Trigger: A phishlet YAML defines credentials.username.key but omits 'search', or 'search' is misplaced by indentation.

Common situations: Adding key but forgetting search when writing a new phishlet; copy-paste dropping the search line; renamed field mismatch after editing.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/0da2e463e0a203e5. Report an issue: GitHub.