What causes "force_post: missing force `key` field" in kgretzky/evilginx2?

Add `key:` to every item in the `force` list

force_post: missing force `key` field

Error message

force_post: missing force `key` field

What it means

Thrown when an entry inside a force_post operation's `force` list lacks the `key` field. Each force item must specify which POST body parameter to override (`key`) and the replacement (`value`); a missing key makes the forcing rule unaplicable, so validation rejects the phishlet.

Source

Thrown at core/phishlet.go:739

					if op_s.Search == nil {
						return fmt.Errorf("force_post: missing search `search` field")
					}

					f_s := ForcePostSearch{}
					f_s.key, err = regexp.Compile(p.paramVal(*op_s.Key))
					if err != nil {
						return err
					}
					f_s.search, err = regexp.Compile(p.paramVal(*op_s.Search))
					if err != nil {
						return err
					}
					fpf.search = append(fpf.search, f_s)
				}
			}
			for _, op_f := range *op.Force {
				if op_f.Key == nil {
					return fmt.Errorf("force_post: missing force `key` field")
				}
				if op_f.Value == nil {
					return fmt.Errorf("force_post: missing force `value` field")
				}

				f_f := ForcePostForce{
					key:   p.paramVal(*op_f.Key),
					value: p.paramVal(*op_f.Value),
				}
				fpf.force = append(fpf.force, f_f)
			}
			p.forcePost = append(p.forcePost, fpf)
		}
	}

	if fp.LandingPath != nil {
		p.landing_path = *fp.LandingPath
		for n := range p.landing_path {

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add `key:` to every item in the `force` list
Fix key-name typos to match the force schema (key + value)
Remove malformed force items that are not needed

Example fix

# before
force:
  - value: '{password}'
# after
force:
  - key: 'password'
    value: '{password}'

Defensive patterns

Strategy: validation

Validate before calling

for _, op := range forcePosts {
    if op.Force == nil { continue }
    for j, f := range *op.Force {
        if f.Key == nil {
            return fmt.Errorf("force_post force[%d]: `key` is required", j)
        }
    }
}

Type guard

func forceHasKey(f ForcePostForceCfg) bool { return f.Key != nil }

Prevention

Every force item must have both `key` and `value`
Use consistent field names (key/value) when copying between phishlets
Check YAML merge keys/anchors resolve to complete maps
Run phishlet validation before enabling

When it happens

Trigger: Phishlet YAML force_post entry contains `force:` items where `value:` is present but `key:` is missing; p.Validate() is called on the phishlet.

Common situations: Typos (`field:`, `name:` instead of `key:`); copy-paste from other directives with different naming; hand-merging force lists and dropping a key line; YAML anchors resolving to maps without `key`.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/3eb8f315affe30a1. Report an issue: GitHub.