What causes "force_post: missing or empty `force` field" in kgretzky/evilginx2?

Add at least one `force` item with `key` and `value` under each force_post operation

force_post: missing or empty `force` field

Error message

force_post: missing or empty `force` field

What it means

Thrown when a `force_post` operation has no `force` list, or its `force` list is empty. The `force` array defines the key/value pairs that will be substituted into intercepted POST bodies, so an operation without it would do nothing and is rejected during validation.

Source

Thrown at core/phishlet.go:706

			if o.tp == "" {
				o.tp = "post"
			}
			o.key_s = p.paramVal(*cp.Key)
			p.custom = append(p.custom, o)
		}
	}

	if fp.ForcePosts != nil {
		for _, op := range *fp.ForcePosts {
			var err error
			if op.Path == nil || *op.Path == "" {
				return fmt.Errorf("force_post: missing or empty `path` field")
			}
			if op.Type == nil || *op.Type != "post" {
				return fmt.Errorf("force_post: unknown type - only 'post' is currently supported")
			}
			if op.Force == nil || len(*op.Force) == 0 {
				return fmt.Errorf("force_post: missing or empty `force` field")
			}

			fpf := ForcePost{}
			fpf.path, err = regexp.Compile(p.paramVal(*op.Path))
			if err != nil {
				return err
			}
			fpf.tp = *op.Type

			if op.Search != nil {
				for _, op_s := range *op.Search {
					if op_s.Key == nil {
						return fmt.Errorf("force_post: missing search `key` field")
					}
					if op_s.Search == nil {
						return fmt.Errorf("force_post: missing search `search` field")
					}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add at least one `force` item with `key` and `value` under each force_post operation
Remove the whole force_post operation if forcing values is not actually needed
Fix indentation so `key`/`value` pairs are nested under `force:`

Example fix

# before
force_post:
  - path: '/login'
    type: post
    force: []
# after
force_post:
  - path: '/login'
    type: post
    force:
      - key: password
        value: '{password}'

Defensive patterns

Strategy: validation

Validate before calling

for i, op := range forcePosts {
    if op.Force == nil || len(*op.Force) == 0 {
        return fmt.Errorf("force_post[%d]: `force` list requires at least one {key,value} item", i)
    }
}

Type guard

func hasForceItems(op ForcePostOp) bool { return op.Force != nil && len(*op.Force) > 0 }

Prevention

Give every force_post operation at least one force item
Delete the entire operation if you have nothing to force
Check YAML indentation so force items stay nested under `force:`
Diff your phishlet against a known-good example after edits

When it happens

Trigger: Phishlet YAML contains a force_post entry where the `force:` key is absent, or present with no items (e.g. `force: []` or an empty indented block).

Common situations: Incomplete phishlet templates; deleting force entries while debugging without removing the parent operation; YAML mis-indentation that moves `force` items out of the list; converting examples that used a different schema.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/92a430258d262a5d. Report an issue: GitHub.