kgretzky/evilginx2 · error

credentials: %v

Error message

credentials: %v

What it means

Wrapper error for regexp compilation failures of the credentials key/search patterns. After the presence checks pass, each credentials regex is compiled with regexp.Compile and any Go regexp syntax error is wrapped as 'credentials: <compile error>'. Common causes are unbalanced parentheses, stray backslashes, or invalid quantifiers in the YAML regex.

Source

Thrown at core/phishlet.go:606

		p.authUrls = append(p.authUrls, re)
	}

	if fp.Credentials.Username.Key == nil {
		return fmt.Errorf("credentials: missing username `key` field")
	}
	if fp.Credentials.Username.Search == nil {
		return fmt.Errorf("credentials: missing username `search` field")
	}
	if fp.Credentials.Password.Key == nil {
		return fmt.Errorf("credentials: missing password `key` field")
	}
	if fp.Credentials.Password.Search == nil {
		return fmt.Errorf("credentials: missing password `search` field")
	}

	p.username.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Key))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.username.search, err = regexp.Compile(p.paramVal(*fp.Credentials.Username.Search))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.password.key, err = regexp.Compile(p.paramVal(*fp.Credentials.Password.Key))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.password.search, err = regexp.Compile(p.paramVal(*fp.Credentials.Password.Search))
	if err != nil {
		return fmt.Errorf("credentials: %v", err)
	}

	p.username.tp = fp.Credentials.Username.Type

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Read the wrapped '%v' message to identify the exact regex and syntax error
2. Fix the regex to valid Go RE2 syntax (no lookaheads/backreferences; escape special chars)
3. Quote the regex in YAML (single quotes) so special characters survive parsing
4. Test the regex in a Go-compatible regex tester (RE2) before editing the phishlet

Example fix

// before (invalid RE2: lookahead)
credentials:
  username:
    key: 'username(?=.*)'
    search: 'username=([^&]*)'
// after
credentials:
  username:
    key: 'username'
    search: 'username=([^&]*)'

for _, re := range []string{*uKey, *uSearch, *pKey, *pSearch} {
  if _, err := regexp.Compile(re); err != nil {
    return fmt.Errorf("credentials regex %q invalid: %v", re, err)
  }
}

func isValidRegex(s string) bool { _, err := regexp.Compile(s); return err == nil }

When it happens

Trigger: A phishlet's credentials username/password key or search value contains invalid Go RE2 syntax, e.g. '(user' (unclosed group), '*x' (quantifier without operand), or unsupported constructs like backreferences or lookaheads.

Common situations: Copying PCRE/JS-style regexes with lookaheads into the phishlet; unescaped special characters like '(' or '+'; missing quotes in YAML causing truncation of the pattern before compilation.

Related errors

• credentials: missing username `key` field
• credentials: missing username `search` field
• credentials: missing password `key` field
• credentials: missing password `search` field
• phishlet '%s' can't be deleted - you can only delete child p

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/5346a60757e50013. Report an issue: GitHub.